844600078504951838 #spicedb

Channels

zanzibar

test-forum

spicedb

vroldanbet

11/24/2022, 10:07 AM

it does yeah

vroldanbet

11/24/2022, 10:07 AM

hace you tried checking with the

zed

command line tool, at least to rule out problems with the exposed container port

romil

11/24/2022, 10:09 AM

Zed is all working fine , so need to see how we establish connection via the java client . Should it be localhost:50051 or something else I am missing

romil

11/24/2022, 10:11 AM

Attached is the file for reference

vroldanbet

11/24/2022, 10:11 AM

friendly tip for friendlier container logs: pass

--log-format=console

vroldanbet

11/24/2022, 10:14 AM

I see you commented out

useTransportSecurity

. Can you add

.usePlaintext()

romil

11/24/2022, 10:16 AM

It did work, thanks for the quick insight .

vroldanbet

11/24/2022, 10:16 AM

glad to hear 🙏🏻 I'll open a PR to edit the example and leave a clarifying comment

vroldanbet

11/24/2022, 10:21 AM

FYI https://github.com/authzed/authzed-java/pull/31

romil

11/24/2022, 12:17 PM

Hello, Are caveat supported via com.authzed.api 0.3.0 ? I do find caveat under https://buf.build/authzed/api/file/main:authzed/api/v1/permission_service.proto#L239 but when I try to load the said jar via maven repo (0.3.0) , I dont see the context reference ? Any view ? and if not supported , any view by when it will be available ? Under 0.3.0 I see below proto being referred to for permission and seems it does not have the caveat

message CheckPermissionRequest {
  Consistency consistency = 1;

  // resource is the resource on which to check the permission or relation.
  ObjectReference resource = 2 [ (validate.rules).message.required = true ];

  // permission is the name of the permission (or relation) on which to execute
  // the check.
  string permission = 3 [ (validate.rules).string = {
    pattern : "^([a-z][a-z0-9_]{1,62}[a-z0-9])?$",
    max_bytes : 64,
  } ];

  // subject is the subject that will be checked for the permission or relation.
  SubjectReference subject = 4 [ (validate.rules).message.required = true ];

bigzofsg

11/24/2022, 7:52 PM

Ugh.....! I've been having a hard time modelling nested teams concept

bigzofsg

11/24/2022, 7:52 PM

I need some help

bigzofsg

11/24/2022, 7:56 PM

So I have the following requirements: Teams have an owner, manager and members (direct_members). So let's say I have Team A that consists of Team A1 and Team A2 (nested). The owner of Team A1 and owner of Team A2 should all be members of Team A

bigzofsg

11/24/2022, 7:56 PM

How do I craft the schema for the team object?

bigzofsg

11/24/2022, 7:59 PM

definition user {} definition team { relation owner: user relation manager: user relation direct_member: user | team#member | team#owner | team#manager permission member = owner + manager + direct_member }

bigzofsg

11/24/2022, 8:25 PM

So I modified it a bit: `

Jake

11/24/2022, 8:26 PM

This schema looks fine. What’s not working?

bigzofsg

11/24/2022, 8:27 PM

definition user {}

definition team {
    relation owner: user
    relation manager: user
    relation parent: team
    relation direct_member: user

    permission member = owner + manager + direct_member + team->member
}

// Testing relationships
team:tam#owner@user:phil#...
team:tam#manager@user:reid#...
team:tam#direct_member@user:mark#...
team:stap#owner@user:steven#...
team:stap#direct_member@user:zhinan#...
team:stap#parent@team:tam   (What I want to say is:  Team TAM is a parent of Team STAP, is this line correct?)

Jake

11/24/2022, 8:28 PM

Yes, that’s how you express a parent relationship

bigzofsg

11/24/2022, 8:29 PM

When I try to assert the above:

assertTrue:
- "team:tam#owner@user:phil"
- "team:tam#member@user:mark"
- "team:tam#member@user:phil"   // this line fails!

bigzofsg

11/24/2022, 8:30 PM

Because user phil is an owner of the team TAM, he is also naturally a member of the team

Jake

11/24/2022, 8:32 PM

What is

team->member

meant to express?

Jake

11/24/2022, 8:32 PM

That should actually raise an error because

team

isn’t a valid relation name

bigzofsg

11/24/2022, 8:33 PM

team is the object

bigzofsg

11/24/2022, 8:34 PM

and team->member I thought this is what inheritance means..... members of a team includes the current team's owner, manager, direct_members AND all of child team's members

bigzofsg

11/24/2022, 8:35 PM

Actually none of my lines work

bigzofsg

11/24/2022, 8:39 PM

// Testing relationships
**team:tam#owner@user:phil#...**
team:tam#manager@user:reid#...
team:tam#direct_member@user:mark#...
team:stap#owner@user:steven#...
team:stap#direct_member@user:zhinan#...
team:stap#parent@team:tam   (What I want to say is:  Team TAM is a parent of Team STAP, is this line correct?)

// WHy would this assertion below not work:
assertTrue:
- "team:tam#owner@user:phil"

Jake

11/24/2022, 8:40 PM

Probably because the schema references an invalid relation

bigzofsg

11/24/2022, 8:46 PM

solved it