844600078504951838 #spicedb

Channels

Joey

11/03/2022, 10:50 PM

export const getServerSideProps = withCapabilities(
  withPagePermissionRequired<MyProps>(
    async () => {
      return {
        props: {
          status: 200,
        }
      }
    },
    (ctx) => Document(ctx.query.doc as string).view
  ),
  (ctx) => Document(ctx.query.doc as string).admin,
)

Joey

11/03/2022, 10:50 PM

that would say "view permission on the document is required to load the page and check if they have admin permission as well"

Joey

11/03/2022, 10:51 PM

and then something like

Document(doc as string).admin.has(props)

Joey

11/03/2022, 10:51 PM

for checking it within the page

Joey

11/03/2022, 10:55 PM

the other option as Jake mentioned would be to reexpose a read-only subset of the SpiceDB API to your frontend, but you need to be careful about information leakage in doing so; its better to issue the checks you need on the backend and only return the results in a

capabilities

permission

set

raffaelespazzoli

11/04/2022, 12:55 AM

hello, from the CLI help:

--telemetry-ca-override-path string                       TODO
      --telemetry-endpoint string                               endpoint to which telemetry is reported, empty string to disable (default "https://telemetry.authzed.com")
      --telemetry-interval duration                             approximate period between telemetry reports, minimum 1 minute (default 1h0m0s)

I assume these are traces. What protocol though? Can I assume this is OTEL?

Jake

11/04/2022, 1:03 AM

there are separate flags for traces using OTEL, these flags are for usage telemetry, and they use the prometheus remote write protocol

raffaelespazzoli

11/04/2022, 1:11 AM

where are those flags documented? They don't seem to come up with --help

raffaelespazzoli

11/04/2022, 1:11 AM

oh wait they are in the global flags

silencer.xyz

11/04/2022, 6:59 AM

Hey mate, we are building an open-source low-code tool for developers. Our product supports multi GUI to CRUD your database. Such as MangoDB, Maria DB, MySQL, etc. We can support your Spice DB as well. Check out our Github here: https://github.com/illa-family

seeruyy

11/04/2022, 3:04 PM

Hey there! I have a question about https://github.com/authzed/authzed-py I use this client to do Locust stress tests and it looks like I found some issue running

LookupResources

request. After creation of bunch of relationships I need to check some of them using the

LookupResources

endpoint, it returns empty response in case of no resources by query but if there are some resources in SpiceDB the call get stuck forever. It returns an empty

<_MultiThreadedRendezvous object>

there are no code and details and if try to get this data by using methods

.code()

.details()

these calls just got stuck.

vroldanbet

11/04/2022, 3:27 PM

👋🏻 any chances you can create a test case? Which version of SpiceDB are you using?

seeruyy

11/04/2022, 3:28 PM

I use

authzed/spicedb:v1.12.0

seeruyy

11/04/2022, 3:29 PM

I have just tested the same query using NodeJS client, no issue

vroldanbet

11/04/2022, 3:32 PM

got it, I'd suggest opening an issue in the repository. If you could share the schema you use (maybe changing the name of things if if sensitive) that'd help us reproduce the problem.

seeruyy

11/04/2022, 3:36 PM

Let me create a test case to reproduce it, it'll be helpful for you to investigate an issue

vroldanbet

11/04/2022, 3:42 PM

you can use our tests as template: https://github.com/authzed/authzed-py/blob/main/tests/v1_test.py

seeruyy

11/04/2022, 3:44 PM

Thanks! I will

yetitwo

11/04/2022, 6:48 PM

we've had a request in our product discussions for customer service people to be able to define "custom roles" for users on a particular set of objects. my sense is that this is probably just "create a role that has access to a subset of the objects and then assign users to that role," and the concern on my team was that we might have to allow for schema writing. my sense is that that probably isn't necessary because we can reimplement RBAC in the context of ReBAC with the right entity definitions (if indeed it does end up being necessary - still hashing out the details with product). is that more or less the case, or is it more complicated than that?

Joey

11/04/2022, 6:49 PM

basically - you could define a custom role type and grant it access

Jake

11/04/2022, 6:50 PM

the only time you might need to write schema per user is if there are user defined resources, i.e. object types for which your system has no foreknowledge

yetitwo

11/04/2022, 6:50 PM

okay, that makes sense. i'll bring that back to my team. thanks!

pquerna

11/04/2022, 9:35 PM

Hmm, just another thought/question -> Is there a way to think about "subscribing" to changes relevant to a specific identity? eg, could I make a feed of changes that affect a specific Principle? or... Even like the current "Document ID" a User is currently on? eg... "Watch" in the zanzibar paper, but... "scoped" for things relvant to the current user or the "objects" on their page? Hrm.. you'd need to like Expand Gorups or other relationship mechinisms.

Joey

11/04/2022, 9:57 PM

See the

WatchResources

proposal: https://github.com/authzed/spicedb/issues/207

Joey

11/04/2022, 9:57 PM

but I would not recommend using that for UI updates unless you intend it to be push-based

Joey

11/04/2022, 9:57 PM

(and probably not even then)

pquerna

11/04/2022, 10:03 PM

we already have.... a gRPC-web stream from our backend to our frontend... so.... more just some more objects down the pipe 🙂

Joey

11/04/2022, 10:05 PM

oh, well, in that case

Joey

11/04/2022, 10:05 PM

if you are using an RBAC-like model in SpiceDB, you could also just use the normal Watch and just check for changes on those role relations too

Steve Lillis

11/06/2022, 10:05 AM

What's the most appropriate way to get an intersection of two lookups? In the application, or is there a way in the spice query?