ah, I see how that could be confusing

the

1

is an example

not the default

oh, that's right

we could add a column with the default to make it clearer, but means those in sync with the code

yeah

either way, I think a warning here is good

alright, is there another place to look for defaults?

should show them

alright cool, yea I was using the operator so I haven't been interfacing with the CLI directly

yeah, makes sense

we'll get a warning added

@mgagliardo https://github.com/authzed/spicedb/issues/1051

thanks!

did setting both min and max work for you?

yes, setting them both fixed what I was seeing

glad to hear 👍🏻

A couple of questions around ways that people have approached things in the past. 1. Is there a way to batch permission check requests? I see this issue: https://github.com/authzed/spicedb/issues/621. I could also just wrap all of the calls in Promise.all to do them in parallel. 2. What is the most efficient way to deal with admins and listing resources. I.e. an admin will be able to list all resources (lots) while a non admin would only be able to list a subset. I could do a permissions call for an admin only list all permission followed by a lookup resources call if that failed, but then I would be doing two calls.

1. its recommended to make them in parallel

2. not sure I follow for #2. Can you expand?

Yeah I guess that was a little obtuse. Let's take the following schema:

definition user {}

definition platform {
    relation admin: user

    permission read_all_resources = admin
}

definition resource {
    relation resource_admin: user
    relation platform: platform
    
    permission read = account_admin + platform->read_all_resources
}

Imagine that we had 1,000,000 instances of resource. The platform admin could read all 1,000,000 of them. Whereas the resource admin could only read the small number they are the admin of.

For the resource admin making a lookup resources call for resource makes sense here, but it would be non performant for the platform level admin.

To handle both cases I could see a call to check for read_all_resources and then a look up resources call.

I was wondering if there was a way to avoid the double calls there.

add a

permission local_read = account_admin

and lookup that?

Which would work for the resource level admin, but not for the platform level admin. I'm not sure that there is a single call that will do what I want here.

is the goal to display all of the resources for the platform-level admin?

perhaps I'm misunderstanding the goal