SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions.

SpiceDB

relations and permissions, if used as part of a subject

is there a way to indicate `self` for a permission of a definition? For example: 
```
definition user {
    relation tenant: tenant
    permission manage_profile = self + tenant->admin 
}
```

there is not: https://github.com/authzed/spicedb/issues/338

thanks, i should have checked open issues first.

so defining a relation to `self` is the best way to achieve this for now?
```
definition user {
    relation self: user
    relation tenant: tenant
    permission manage_profile = self + tenant->admin 
}
```

cool, that definitely works. Much obliged.

Is there a performance benchmarking result available report available for authzed?

benchmarking *heavily* depends on the size of your cluster and its node sizes, as well as the datastore used and your schema

I understand that , Is there any performance analysis report available with different configuration and different  size of datasets . Which can give us some idea.

Is there a way to list all the permissions(not relations) a user has along with the resources for which the permissions apply?

no; you need to lookup per permission or lookup a general one and use check to filter further

Is there a way to LookupResources with a relation constraint?

`definition project {
    relation member: user

    permission view = member
}

definition folder {
    relation project: project
    relation viewer: user

    permission view = viewer
}

definition file {
    relation folder: folder
    relation viewer: user


    permission view = viewer
}`

can I ask to list all the files a user can view that are only in a specific folder?

here the relation constraint would be the folder of the file.

use `ReadRelationships` and just read the users in the `viewer` relation

LookupResources *will* work on a relation

but that would give me all the files the user can view without taking into account the folder relationship that the files have, right?

`ReadRelationships` only takes one filter. If took multiple filters I could also filter on the folder

or if `LookupResources` allowed additional filtering on the relations/permissions on the resources being looked up

in your above schema, there is no relationship between `view` and folders

If I change the definition of `file` to be: 
`definition file {
    relation folder: folder
    relation viewer: user
    
    permission view = viewer + folder->view
}`

can I do the action: list all files that a user has `view` permission on and that file is in some specified folder?

you can list *all* files that a user has view on with a LookupResources

oh so the permission specified in the `LookupResources` call doesn't have to be an exact permission? It can be that syntax with the colon and #?