Filed https://github.com/authzed/spicedb-operator/issues/114 and added what works for me

From time to time, I'm getting

could not CREATE relationship XXX#YYY@ZZZ:*, as it already existed. If this is persistent, please switch to TOUCH operations or specify a precondition

I do use TOUCH, never CREATE 😅 I'm on 1.13.0, it looks like a bug in SpiceDB? possibly a race condition (it doesn't happen often, less than once a day)

mind opening an issue? That does not sound right 👍🏻

Hi, we are explorinq spicedb as a possible authz solution, I was playing with the API, but I couldn't seem to find a way of getting all the permissions a user has on a specific resource?

Hi! I believe you're looking for the Lookup API - have a look at this https://buf.build/authzed/api/docs/main:authzed.api.v1#authzed.api.v1.PermissionsService.LookupSubjects

@vroldanbet I think we're still missing something with pr #112 :/

mind elaborating? 🙏🏻

added comment to pr, I've build your change and replaced the image and now get a different error

Error: rpc error: code = Unimplemented desc = unknown service dispatch.v1.DispatchService

means something is still trying to use dispatch

Are there no integration tests for the operator?

if you refer to spinning up a kube cluster and test all of this, I believe there are under

e2e

folder.

as to your error - that is a very weird one. Can you share the ENVs of your SpiceDB

Deployment

? also logs?

The tests don't seem to verify that the cluster works, but I'll read them more carefully. I'll upload the data to a paste in a minite

I believe it tests the cluster ends in a given final state

Hi I believe you re looking for the

Hey folks 👋

hi!

The way I achieved, maintain all the permissions associated with a resource by parsing schema. At run time issue parallel request of lookup resource for each permission. Combine the result and return it.

Sorry if it has been asked multiple time but I'm currently evaluating SpiceDB for the next version of our access control.

We would like to offer a way for end users to define custom "Permission Sets". A permission set is an holder of the fact that a user with it can read an objectType A and edit an objectType B.

Then, a permission set would be granted to Users or Groups of Users + on a set of Records on which the Permission Set can be applied.

The object containing the link between Users, Records and Permission Sets will be called a "Role"

I'm unsure of how to map this in SpiceDB => as the permissions sets are custom, they can be created by the end users and thus will have to be dealt as a "dynamic" thing. Is it possible to encode such behavior into a static schema and putting all the "dynamic" part of the problem into relationships? Or should the schema be generated dynamically when new permission sets are added in the system? As out app is multi tenant and permissions sets will be "per tenant", what is the proper approach with SpiceDB schema? Should we have 1 schema per tenant? Or a global schema definition with "per tenant" permissions declarations?

If you have any link / ressource to a schema that is achieving something similar, it would be awesome 🤩

PS: To give context, I'm the CTO of Whaly, a Self Service BI like Looker. As a BI is a B2B tool (think Looker) that is deployed to all employees of business and have to match its internal organisations (C-Levels, Data Analysts, Employees) + the fact that many different teams exists (Marketing, Finance, Product, ....), things have to be very customisable by the Customers Admins to adapt the access control to their exact needs and information sharing policy for 100+ users.

Nice to meet you! This sounds similar to user-defined roles problem that I talk about here: https://authzed.com/blog/user-defined-roles/

That was what I was looking for!

Question - I see in your docs that installing SpiceDB requires picking a supported datastore https://docs.authzed.com/spicedb/selecting-a-datastore Is this also a consideration and option when setting up your managed dedicated SpiceDB? Or do you pick a datastore behind the scenes and abstract that away?

I hope you saw the playground link too