👋🏻 Howdy! That's one way to do it, but that wouldn't be transactional. The recommended way is to use

WriteRelationships

method and specify 2 updates: one with

operation=DELETE

and another one with

operation=CREATE

(or

TOUCH

).

I'm trying to use zed with an Authzed development permission system I have setup. Commands like 'schema read' and 'relationship read' are working fine but when I try to do 'check permission' I always get back this error

Error: rpc error: code = Internal desc = stream terminated by RST_STREAM with error code: NO_ERROR

Is there something I'm doing wrong?

That makes sense thanks.

Hi, I am using spicedb with mysql datastore, is there a way to see the queries issued to the datastore for all the APIs? \

@mister_vj I don't think there is a way right now, would you mind opening an issue? 🙏🏻

mister vj2174 I don t think there is a

I've deployed an instance of spicedb but I'm having some trouble connecting to it. I get this error:

"type": "Error",
"message": "2 UNKNOWN: "

Is it something on the server side?

I'm willing to admit that while I understand most of the Zanzibary stuff, the Zookies/ZedTokens are still a little fuzzy to me. Given the following flow: 1. Get the requested resource from a database. 2. Check if it has a ZedToken in the database. 1. If it does then make an auth call with at_least_as_fresh and the ZedToken. 2. If it does not then make an auth call with fully_consistent. 3. If there was no ZedToken then store the ZedToken in the database alongside the resource. I have the following questions: 1. Does that work? 2. Is there ever a case where that ZedToken needs to be invalidated? Or does the at_least_as_fresh mean that it doesn't. 3. Is there any reason I couldn't store the ZedTokens in a fast key value store?

1) yep 2) nope;

at_least_as_fresh

will handle that 3) nope, but it should ideally be stored next to the content to provide guarantees against the New Enemy Problem

a

ZedToken

is only necessary if you care about the New Enemy problem and a requirement for full consistency, while also wanting to use the faster cache when it is safe to do so

if you don't mind your checks being up to a few seconds out of date, regardless of the content, then you can simply use the default consistency level always

the canonical example is this: you are protecting something with content, like a document. your user removes access to the document for another user

badguy

, then writes in the document "here is the secret plan to sue badguy", but then badguy opens the document and, without the ZedToken or

fully_consistent

, sees that content because their access was just removed

the way to work around that is to store a ZedToken when the content of the document is changed

when used in the next

CheckPermission

call, you're saying to SpiceDB "I need to make sure that the data used for the Check is the same that said 'badguy does not have access'"

So the eventual consistency timeline is likely to just be a few seconds? That isn't too bad.

5s

by default

its based on the settings to SpiceDB

Thanks for clarification. That really helps.

Would it make sense to be more conservative with 3rdparty deps on the authzed-go package. For compliance I need to mirror the tree and e.g. using stringz is not worth the dep imho (https://github.com/authzed/authzed-go/search?q=stringz). I think explicit code here is more readable, then a utility function most people won't know

👋🏻 Can you elaborate on how the usage of these dependencies is a problem for you to adopt SpiceDB?

👋🏻 Can you elaborate on how the usage

Hello guys, Is there a place where I can find other enterprises using spicedb in production? I really would like to meet other companies using spicedb to get some insights on do's and dont's. If you are using it on production and reading this, I would love to have a chat 😁

are there any docs/resources on resource request/limits for spicedb pods? trying to set up HPA for spicedb on my cluster, not sure what requirements a spicedb container would have

it highly depends on your datastore, node size and schema. we can give very rough estimates, but it really depends on those factors

it highly depends on your datastore node

While trying to iterate I am getting this error

are you running this against SpiceDB or authzed.com?

authzed.com serverless

Watch API is not currently supported on authzed.com serverless

Okay gotcha. Dedicated one supports right ?