This Repo is not available

I got it, it has changed now to https://github.com/authzed/spicedb/tree/main/internal/services/integrationtesting/testconfigs

I am running SpiceDB in Azure AKS, it is not starting up if I set , automountserviceaccounttoken: false, it works otherwise.

How can we run it with, automountserviceaccounttoken: false , has anyone done it ?

Hi folks, I have a use case were the permissions are defined dynamically and i.m not too sure if its possible to model or how to in spicedb. The use case the users can define permission sets objects and add individual permissions to it. Permission sets are the add to users. So I can create a PS

ps1

with permission

view_folder

example, and then give that to

user1

. I also make user1 a user of a folder, And i want to ask if a user is able to view a folder. As response should be true if the user is both a user of that folder and member of a permission set with the the view_folder permission. Not sure that makes ... i've been trying to model this but struggling to find a way

AH, thanks Jake! Yep that looks like what I need

you're welcome!

sorry, don't want to bother much but how do i express missing a relation? is i introduce a parent folder relation, and want to say you can view the folder if this plus i can view the parent (if it has one)?

Do you mean to say I can access this or I can access the parent folder? That's how it usually works...

Indeed usually would be like that, but our case is both, i.e. if i dont have access to parent then i can not see children, even i have explicit permission for it

like

permission view = (user & type->view_type) & parent->view

but only if parent is defined

if

parent

is not defined in the above, then that will return NO_PERMISSION

what about if I have permissions to a parent folder, can I view its children automatically?

@costap ^

nope

https://play.authzed.com/s/fZMPu2ig1qh2/schema this is what i mean

where to view the bottom folder i need permission on both root and child but i should be able to view root if no parent

is there appetite for bumping authzed-py to protobuf ^4.21.0 / grpc ^1.50? Long story short, the environment I'm using the authzed client in requires using those deps. Happy to help if necessary!

is there appetite for bumping authzed py

Hi I am wondering the scope of zookie if the plugged in DB is not Spanner. Zanzibar's zookie is just a pseudo encoded spanner true time, so it is global, how about mysql and other database?

our datastore implementations for MySQL and Postgres do their own revision tracking and the ZedToken (zookie) encodes those revision IDs

Makes sense. That means these revision is local to the writing DB. Thanks

in MySQL/Postgres, there is only one master DB, so yeah

Another question is what if I need relationships distributed in different regions? Assuming a resource hierarchy like GCP projects/buckets. I need to write bucket ACLs in their own regions but also inherit project ACLs from a global region. Any mechanisms in AuthZed to do these?

if you used a globally distributed datastore like Spanner or CRDB, then it should Just Work

for Authzed Dedicated, you'd choose the regions in which to run

Hi, I am trying to create a relationship using Postman, and i get the following message: invalid WriteRelationshipsRequest.Updates[0]: embedded message failed validation | caused by: invalid RelationshipUpdate.Relationship: embedded message failed validation | caused by: invalid Relationship.Resource: embedded message failed validation | caused by: invalid ObjectReference.ObjectType: value does not match regex pattern "^([a-z][a-z0-9_]{1,61}[a-z0-9]/)?[a-z][a-z0-9_]{1,62}[a-z0-9]$"

This is the message { "updates": [ { "operation": "OPERATION_CREATE", "relationship": { "resource": { "objectType": "document", "objectId": "001" }, "relation": "reader", "subject": { "object": { "objectType": "user", "objectId": "elisa" } } } } ] }