Is there a way to find all the relation a subject and object has with each other ?

you mean all the relationships?

yes

use the ReadRelationships API

does spicedb support the concept of multiple stores/models in the same database (perhaps via that prefix option)? And multiple stores/models served by the same spicedb instances like openfga?

talking to different datastores? no

you can use prefixes to logically break out your different permission systems if you like

but its a convention

if you want a truly and fully isolated permission system, you should run a different cluster to ensure physical isolation

and if you want to share data, then you can use prefixes for some models but not others to allow some things to be shared

are you intending to have the permission systems 100% isolated or...?

Hi, given the schema:

definition group {
    relation owner: user
    relation member: user | group#member

    permission can_edit = owner
    permission can_view = owner + member
}

Any ideas on how to create a relationship

groupA#member@groupB#member

, using the authzed client libs? If I try a subject with id

groupB

, I get:

… object_id:"groupB" is not allowed as the subject of namespace …

If I try a subject with id

groupB#member

, I get:

message failed validation 
| caused by: invalid Relationship.Subject: embedded message failed validation 
| caused by: invalid SubjectReference.Object: embedded message failed validation |
 caused by: invalid ObjectReference.ObjectId: value does not match regex pattern "^(([a-zA-Z0-9_][a-zA-Z0-9/_|-]{0,127})|\\*)$

There is an optional subject relation parameter that you need to set to

member

is it possible to make a query to fetch all the resources that a subject has any permissions to? the

LookupResources

request requires a

permission

field and I don't think I can pass in a wildcard character there

no; it would have to be implemented as a lookup for each permission anyway, so it is recommended to either lookup a base permission and then check to narrow, or to use multiple lookups (lookup + narrowing is generally considered a better idea)

got it. and is it possible to get all subjects that have permissions to a resource without counting computed permissions? just permissions that come from direct relations

you can use read relationships to read the direct relationships for a subject and a resource type

so if your goal is to get, say, all the direct roles a user might have on all resources of a particular type, you can use a read relationships to do so: https://buf.build/authzed/api/docs/main:authzed.api.v1#authzed.api.v1.RelationshipFilter

Hey all, another more POC'ing question here: in dealing with permissions in the past, we've run into cases where we have to figure out why a user does not have a specific permission on a resource. For SpiceDB, what would be the best steps to understand that in a production environment - is there an easy way to indicate why a user cannot obtain that permission without having to manually walk the policy?

yes, there is the debug flag in zed: https://github.com/authzed/zed/pull/130

I'll get that added to the docs

there is also the Playground for debugging while developing and the validation tooling (https://docs.authzed.com/guides/validation-and-testing) for verifying your permissions before commit

Nice, that does look really useful. Will that be added into other clients as well (i.e. nodejs, etc)

it is accessible via the API

take a look at that PR on how to set the proper header and how to read the resulting debug protos

if you like, we'd love a contribution into the NodeJS client to make it easy to do 🙂

happy to contribute, thanks @Joey

Do we typically want to ask SpiceDB if an user has access to a resource such that a users's roles and org membership would be stored in SpiceDB? Or is it better to add org membership and roles as custom claims to the ID token and ask SpiceDB if this org/role as access to the resource?

the former, unless you really need it to be dynamic

you should, if you can, always ask the most fine grained question