👍👍will try it

debug authzed.com tenancy error

Hi Jake, I tried my test against the cached version, it now way faster👏 👏! the lookup returns in ~9 seconds. Do you have any suggestion to make it around 1 sec?

@User we'd have to benchmark your specific shape and kind of data to know for sure, although there are some additional lookup improvements planned. There is also the work being done on the Tiger Cache (https://github.com/authzed/spicedb/issues/207), which once done, should enable lookups within no more than 10s of ms (but with a slight consistency delay)

@User did you change your test from the one you sent me yesterday? lookup is still taking an exceedingly long time on my machine

No I did not change the data. I built the spicedb from the main branch, and the result was much better

🤔

I've just started looking into what SpiceDB has to offer, and am excited by its potential. I think I'm starting to grok how to define schema and relationships for user centric needs. I am curious, are there any examples of using spiceDB for application to application authorization? I ask because we currently model applications as an identity with multiple attributes such as AWS region and test versus production. I'm looking at how we could model that in spiceDB, but I keep getting stuck when trying to solve for how to map our multi-attributes application identifiers into an identifier we can both WriteRelationships to and CheckPermissionRequest for. An example https://play.authzed.com/s/w3tYqjiojKuJ/relationships The best solution I can come up with would be to require a CheckPermission for every possible combination of application & attribute, but then essentially we're building a policy engine on top of SpiceDB.

@User can you point to where you're stuck in your schema?

Where i'm stuck is, do we need to build an engine that takes in an application identity, and then expands that into a sequence of CheckPermissions for each attribute we need to check.

While I can model the logic of this check in the schema itself (e.g. compose

permission read

with the logic of those attribute checks) I don't think there is a way I can leverage that via CheckPermission.

if your permissions are based on a combination of attributes, and those attributes are not changing for the application often, then you should be able to model them inside of Spice

While region/env don't change much, some of the attributes we rely on today change often for some use cases, which is why we provide the "any" escape hatch for grants today.

I'd recommend adding some assertions to test the modeling

it often helps me to think through the whole schema, as it means I'm thinking of it as-if the application is calling check

@User by "often" do you mean truly dynamic, or just changing often?

Generally, changing very often. In some cases the attribute may be used dynamically for other needs (ci/cd automation for example), and in that case, those teams rely on an "any" grant for that attribute. I'll add some assertions for you vs the comments.

so "any" is something we're looking to support via "public" support: https://github.com/authzed/spicedb/issues/1

that would allow you to check for a specific subject on the right hand side, but if the item was marked "public", any subject of the correct type would apply

but I'm not 100% certain that matches your use case

In the example playground, I worked around the any issue, but would still need to compose the true check permission as the output of multiple checkPermissions.

@User I'll wait for your assertions to know for sure, but I suspect if you can decorate the applications with their attributes, you can do a check like:

application:1 can (whatever) application:2

which means only a single check

Let me know if these assertions/comments help. https://play.authzed.com/s/r33BAjuKmCNu/assertions I'll read up on the public keyword. Presently, I'm struggling to grok how I'd do a check request against application:1, as it has many combinations of attributes.

@User you'd link the application to its attributes and walk through them to the other application

so the meta question is: if you could write a single check, what would it look like to you?

Thanks for the fast responses. I'm going to grab lunch, read that public keyword bit, and then see if it changes what I'm getting hung up on. Right now I was trying to solve for how both support "any" grants on some of the attributes on an application, while also not having to manage and distribute uniqueIDs for every combination of an applications' attribute. ... and that was an afternoon of interrupts. I'll follow up next week!