something like this? https://github.com/authzed/spicedb/issues/613

yep

there is also this too: https://github.com/authzed/spicedb/issues/439

both will likely be combined into a reflection API of some sort

both would be incredibly helpful

i'm considering keeping a graph on my side but maintaining mirrored state is fraught with potential sync issues.

if your schema contains the intersections, then the revocation of a role/relation higher up should just "work"

so in the above example, as soon as the user is no longer a district admin (or the district is removed), they'd lose access

yea, that's what I'm hoping 🙂

awesome

you'd just need to delete the relationship you know

no need for reflection

thank you

@Joey is it not possible to use or logic in the intersection? I thought

|

was supported?

permission add_page_type = site_admin & (division->contractor | division->staff | division->agent)

Expected one of: [TokenTypeRightParen], found: TokenTypePipe

+

is or

|

is only for type defs in relations

ah, thanks

they aren't boolean operators; they are set combinators, hence

+

instead of

|

and

&

instead of

&&

but I do understand why that can be confusing at first glance 🙂

btw @chance if you're walking

division->

three times, it might be cleaner to do

division->somecombinedpermission

then define

permission somecombinedpermission = contract + staff + agent

there

especially if you'll be reusing it in other places

aahh, nice

that's awesome, thanks

Hi, how do you grant permissions in user-defined roles? Since permissions cannot be created directly but is the main focus in the UI used to create roles, should there be a one to one relationship between the relation and its corresponding permission. So when the person creating the role selects a permission we know which relation to create?

there should be a 1-to-1 on the relation, if you are using a role-based design

so if the user is going to be a viewer, grant the viewer relation

For - serverless authzed offerings , where does the server running? We are hitting the permission check endpoint from India (local) & Europe (AWS-Ireland). Permission check call taking on average 1 second & 500 ms respectively with fully_consistent and very few record in place (less then 10). This is not really a performance test , just hitting it from postman. 500ms seems pretty high , just wanted to check is there any network latency involved.

US Central