https://authzed.com logo
Powered by
spicedb
  • j

    Joey

    12/13/2022, 7:04 PM
    you have
  • j

    Joey

    12/13/2022, 7:04 PM
    relation reader: role
  • j

    Joey

    12/13/2022, 7:04 PM
    but that points to the role itself
  • j

    Joey

    12/13/2022, 7:05 PM
    you want to point to the *bearer*'s of the role
  • j

    Joey

    12/13/2022, 7:05 PM
    so you'd likely want 
    relation reader: role#bearer
  • j

    Joey

    12/13/2022, 7:05 PM
    (for all four relations)
  • j

    Joey

    12/13/2022, 7:05 PM
    since the role isn't a reader, its bearers are
  • t

    Toi

    12/13/2022, 7:05 PM
    Thank you very much @Joey and @jzelinskie for the insights!
  • y

    yetitwo

    12/13/2022, 7:06 PM
    hmm... that makes sense. lemme try reworking around that.
  • j

    Joey

    12/13/2022, 7:07 PM
    @yetitwo
  • j

    Joey

    12/13/2022, 7:07 PM
    https://play.authzed.com/s/-qW3xORVBxPa/assertions
  • y

    yetitwo

    12/13/2022, 7:10 PM
    why is the subject_relation necessary on the write request?
  • j

    Joey

    12/13/2022, 7:10 PM
    you mean why does it need to be 
    bearer
    in this case?
  • y

    yetitwo

    12/13/2022, 7:10 PM
    yeah
  • j

    Joey

    12/13/2022, 7:10 PM
    so if you have
  • j

    Joey

    12/13/2022, 7:10 PM
    relation reader: role
    and 
    permission view = reader
  • j

    Joey

    12/13/2022, 7:10 PM
    that means that you're only able to walk to a 
    role
    itself
  • j

    Joey

    12/13/2022, 7:11 PM
    if you make it 
    relation reader: role#bearer
  • j

    Joey

    12/13/2022, 7:11 PM
    you're saying "this relationships is between a resource and the *bearer*'s of that role"
  • j

    Joey

    12/13/2022, 7:11 PM
    which, in this case, are users
  • j

    Joey

    12/13/2022, 7:11 PM
    so you have to give 
    bearer
    as the subject relation because you want to walk to the users there
  • j

    Joey

    12/13/2022, 7:11 PM
    an alternative would be
  • j

    Joey

    12/13/2022, 7:11 PM
    definition resource {
  relation reader: role
  permission view = reader->bearer
}
  • y

    yetitwo

    12/13/2022, 7:12 PM
    which would be explicitly walking the relationship
  • j

    Joey

    12/13/2022, 7:12 PM
    in either case, you need to reach 
    bearer
    to find the users
  • j

    Joey

    12/13/2022, 7:12 PM
    yep
  • y

    yetitwo

    12/13/2022, 7:12 PM
    i saw that that's discouraged - that you're encouraged to walk to permissions specifically
  • j

    Joey

    12/13/2022, 7:12 PM
    the subject_relation form is more compact and generally preferred unless you have a need for the 
    role
    itself somewhere else in the definition
  • j

    Joey

    12/13/2022, 7:12 PM
    yes
  • j

    Joey

    12/13/2022, 7:12 PM
    you'd likely do`
1...300301302...325Latest