844600078504951838 #spicedb

Channels

zanzibar

test-forum

spicedb

vroldanbet

10/12/2022, 12:40 PM

Hey all is there any forum or area where

alex87

10/12/2022, 1:30 PM

I have a modelling question on role hierarchy: In my case there is a hierarchy of 1 to N roles, e.g. user -> manager -> senior manager -> chief manager -> .... It should be possible for each role to define that it should have the same permissions as all of the users below in the hierarchy, e.g. manager can do everything what user can do. But: The depth (level) to go down in the hierarchy should be configurable, e.g. 1 level deep, 2 level deep, all levels deep, ... e.g. Chief manager can do everything what all users below can do, but only 2 levels deep. I have modelled the role example with "all access, all levels deep", this works. Although i find it not ideal to pass through all the permissions from one role to another along the hierarchy. Maybe there is some better way, because if one permission is not passed trough, the upper level in the hierarchy will miss the permission. But I currently do not see an easy way to make the depth/levels easily configurable. Any ideas? schema:

definition user {
      relation manager: manager
      permission add_user_rights = manager->add_manager_rights
  }

  definition manager {
      relation user: user
      relation senior_manager: senior_manager
      permission add_manager_rights = senior_manager->add_senior_manager_rights + user
  }

  definition senior_manager {
      relation user: user
      relation chief_manager: chief_manager
      permission add_senior_manager_rights = chief_manager->user + user
  }

  definition chief_manager {
      relation user: user
  }

  definition user_details {
      relation user: user
      permission edit_user_details = user + user->add_user_rights
  }

relations:

manager:max#user@user:max
  user:mike#manager@manager:max
  senior_manager:marco#user@user:marco
  user_details:details_mike#user@user:mike
  manager:max#senior_manager@senior_manager:marco
  chief_manager:matthias#user@user:matthias
  senior_manager:marco#chief_manager@chief_manager:matthias

symion

10/12/2022, 1:34 PM

We seem to get this error fairly often when trying to seed spicedb

symion

10/12/2022, 1:34 PM

details: max retries exceeded: ERROR: could not serialize access due to read/write dependencies among transactions (SQLSTATE 40001)

symion

10/12/2022, 1:36 PM

seems like something is trying to operate on data before a transaction in the storage backend has completed

Joey

10/12/2022, 3:15 PM

how are you seeding SpiceDB and what datastore are you using?

Joey

10/12/2022, 3:17 PM

are the roles predefined or will they be dynamically named as well?

symion

10/12/2022, 5:07 PM

Postgres.

symion

10/12/2022, 5:08 PM

we have a migration that sets up the schema.

symion

10/12/2022, 5:08 PM

then a migration to create the types and relation ships for a few things. there aren't that many. I'm not sure how much detail you want here

Joey

10/12/2022, 5:14 PM

this is likely related to the previous write serialization performance issue; HEAD of SpiceDB should fix it

symion

10/12/2022, 5:23 PM

That has the memory leak previously talked about as well?

symion

10/12/2022, 5:24 PM

what was the serialization issue? an issue with postgres, or spicedb?

Joey

10/12/2022, 5:24 PM

SpiceDB talking to Postgres

Joey

10/12/2022, 5:25 PM

it could not make many concurrent writes that overlapped

Joey

10/12/2022, 5:25 PM

its fixed in HEAD but not yet released

Joey

10/12/2022, 5:25 PM

the fix went in yesterday

symion

10/12/2022, 6:31 PM

estimation on a release?

Joey

10/12/2022, 7:08 PM

probably a week or two

Joey

10/12/2022, 7:08 PM

we're doing testing of it now

mgagliardo

10/12/2022, 7:10 PM

I'm working on setting up a repo that will handle the versioning/migrations of our schemas for SpiceDB - I saw there was a few github actions out there for testing, does anyone have a good example of a base template that handles schema migrations as well as testing via those/other actions?

mgagliardo

10/12/2022, 7:37 PM

I m working on setting up a repo that

marina.galenko

10/13/2022, 10:28 AM

Hi there! What exactly does

relationships

part do when I run

zed validate file.yml

? I see ‘X relationships loaded’ in the output but it looks like it neither adds those relationships nor checks that they are currently present.

mgagliardo

10/13/2022, 1:15 PM

Usage best-practice question: when bringing this into an API that supports Relay pagination on specific types, what is the best way to approach filtering by users permissions to read an entity? It seems like the best approach would be to use the

LookupResources

endpoint and filter using a set of IDs in the API. Any opinions on this workflow?

Jake

10/13/2022, 1:28 PM

Those relationships are used as the test relationships when evaluating assertions and expected relationships. They are used on an ephemeral spicedb only.

Jake

10/13/2022, 1:30 PM

That way works. Another way is to just send a check request for each item (in parallel) before you send it back to the user. It's going to be use-case dependent which is preferable.

mgagliardo

10/13/2022, 1:34 PM

I think the worry I had with per-item request that is that it feels like it would break pagination - you're going to the database for a specific page of data, then permissions may filter some of that page out which would leave you with less than a page to show. Plus, page info about total count/remaining items would also not necessarily be factual for the specific user.

Jake

10/13/2022, 1:35 PM

yeah, it's definitely a challenge, you could also just overfetch a bit if it is relatively likely that the checks will pass, if it's highly unlikely then a lookup based solution would be better

LarsRan

10/13/2022, 2:05 PM

Hi, we are running integration tests and we have some random failing tests due to the following error:

io.grpc.StatusRuntimeException: CANCELLED: unable to read namespace config: context canceled
    at io.grpc.Status.asRuntimeException(Status.java:535) ~[grpc-api-1.47.0.jar!/:1.47.0]
    at io.grpc.stub.ClientCalls$BlockingResponseStream.hasNext(ClientCalls.java:660) ~[grpc-stub-1.47.0.jar!/:1.47.0]

We were wondering where this error is coming from. From the search history it seemed to come from some timeout mechanism, is this the case? Also between integrationtests we are clearing (part of) the relation_tuple table in postgres, is this problematic for the performance of spicedb?

Jake

10/13/2022, 2:08 PM

Can you tell me more about your test? You likely want to be using the SpiceDB testserver