SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions.

SpiceDB

So in my case, these would be `BEFORE` triggers which write the `relation_tuple` and `relation_tuple_transaction` tables, and augment the `NEW` record with a `zedtoken` value.

while still also noting that this sideloading of relationships into the datastore is WAY out of the parameters for which we designed the system

We follow a policy of "make it work, *then* make it right" which I think this falls into. Long term we'll be better served using the postgres connector as soon as it's ready but we also have time to market pressures.

of course, and this makes for an interesting case study, for our own edification, into the ways other people have integrated with SpiceDB at the very least

I don't _think_ PL/PGSQL supports gRPC out of the box and installing it might be a hard sell to our infra team.

good news then: https://github.com/authzed/spicedb/pull/188

I should have said "HTTP out of the box" but that's good to know.

I logged in to task about GCP CloudSQL multi region replicas but it seems like that was being discussed above. Would using zedtokens prevent the New Enemy Problem if the data wasn't yet replicated?

This isn't a direct answer, but for multi-region deployments we recommend using CockroachDB and not Postgres.

we have some docs on that here: https://docs.authzed.com/spicedb/selecting-a-datastore

If you were reading from a replica that was out of sync, I'd assume it would return the same no-data error that jake mentioned earlier.

Yes, I was reading through that. We're trying to find a managed solution and would need to see what's involved in maintaining a CRDB cluster

There's cockroach cloud and a serverless platform available by their team

I have not used their serverless since it's pretty new, but that might be good for testing

Thanks! I signed up for it earlier this week so we'll test that

Any reason you want to run it yourself when you want to back it by a managed service? Authzed.com is serverless SpiceDB, so you don't have to think about running that in addition to the storage layer.

We have an existing GCP billing account but there would be more hoops to jump through to use another service. It's not out of the question yet but we're trying to move quickly with an initial solution

It should also be very straightforward to create a backend for cloud Spanner if you want to try that avenue

https://github.com/grpc-ecosystem/grpc-gateway/blob/master/ADOPTERS.md I'm sure the nice folks at grpc-gateway would appreciate an entry 😉

true! Johan definitely knows we're using the project, haha.

https://github.com/grpc-ecosystem/grpc-gateway/pull/2413