question is why it is being canceled when trying to check the datastore is up to date

Ok, I'll try to investigate it

This was not the reason.

datastore health context was canceled

It appears when spicedb shuts down. I don't see any other health checks crashing on startup.

try enabling debug logs

Hi! We're currently evaluating SpiceDB for our permission storage and I've got a few things that I'm still a bit unclear on: * What is the "canonical" way to handle schema migrations? The guides only briefly mention this as "you will want to write data migrations and apply those changes using a schema migration toolchain". Is there some prior art on this somewhere? * We want to use the SpiceDB operator to manage our instance. Is there documentation on the

config

part of a `SpiceDBCluster`'s spec? * Are there recommendations on how many resources to allocate for the SpiceDB server?

Oh and another thing I forgot: we have a relation in our schema that we'd like to be reflexive because it models a "Users can see other users in their organizational unit" permission and the only thing I could come up with was to add a

relation part_of: org_unit

to users and

relation member: user

to the org unit and computing "they can see them" as

permission get = part_of->member

. This seems to work, but it requires us to maintain and keep in sync both sides manually. Is there a way to add a reflexive relation?

Hi We re currently evaluating SpiceDB

Oh and another thing I forgot we have a

is there a way to express a permission in terms of the existence of a particular relation? like, a user can perform some action if they are a member of any organization

typically you'd just walk to the organizations'

member

relation to find the user

perhaps something like this:

definition organization {
  relation members: user
}

definition resource {
  relation member: organization#members
  permission read = member
}

definition user {

}

ah i see, perhaps i'm thinking about the problem from the wrong direction. thank you!

you could also use an

->

if you want to walk to other relations on the organization(s) as well

Yeah I was definitely thinking about it wrong. The question I was trying to ask was “is the user a member of an organization” which does not fit the model of “can user x do whatever to resource y”. Starting from that template got me where I needed to go

Hello Gurus, any tentative date to release Schema Parser/ Reflections API? If not planned , we will have to implement our own 😞

We're having an internal debate over whether to commit to a new public API. Would you be willing to run a sidecar service that provides this functionality?

No, not as sidecar, we are trying to build UI on top of APIs.

there is a checkedAt field on the CheckPermissionResponse. is that safe to reuse for future checks w/ atLeastAsFresh?

yep! just be aware that AtSnapshot is not safe to use "long term"

but AtLeastAsFresh is

at_exact_snapshot

?

does at_least_as_fresh not return the

Snapshot Expired

error?

at_least_as_fresh

should always work; it just sets a lower bound which is usually far exceeded

so we could debounce an internal cache with that token from the check call for a few-ish minutes and its fine as long as writes always refresh the token stored in cache

so long as every single write did so, yes. but why have an internal cache when SpiceDB has its own cache?

thats kind of what it suggests doing here.

the ZedTokens would usually be stored alongside the resources in a persistent database

whats the difference there? why is that better?

because it ensures the New Enemy Problem cannot occur, which is the primary purpose of ZedTokens