but that's just a style choice

unless you want to also be able to

check

the

something

yeah I think for me the takeaway is to enforce that the

-

operator is always the last operator used in an expression. This aligns with my goal of making exclusions take priority over any inclusions, and will help me prevent bugs

I never want to see

A + B - C + D

because in reality that is

(A + B) - (C + D)

which does not align with an arithmetic intuition, which is probably what other devs on my team who aren't deep in the weeds here would assume.

yep, and its also important to write validation assertions to verify that it doesn't break over time

it should also be noted that exclusions should be kept to a minimum unless absolutely required

because they are less clear to newer users

fosho. I argued v hard to avoid the need for exclusions.

but yeah: test test test 🙂

zed validate

all the things!

we also have an examples repository that may help getting started: https://github.com/authzed/examples/blob/main/datastores/postgres.yml

Hi all! I'm considering using SpiceDB for our org. I have checked the examples and the documentation, and I would like an advice for experienced users or SpiceDB experts here on how to implement the following scenario. There's a collection of users, and a collection of educational courses. A user can be added to a course with role teacher or student. A course also has an associated license which has startDate and endDate, and also an attribute called protocol which has a string value. With this setup, how to implement a permission "invite_students" that would allow to add new users to course only if : * current user is a teacher in a course * the license startDate is at most 7 back days from now and the endDate is in the future * course's protocol attribute has value "HttpProtocol" I have started to work it out, but I'm a bit confused about what of these conditions to put as a caveat and which should be a relation, so I couldn't work out the full schema, but here's what I have so far: https://play.authzed.com/s/jl0sBWtc1mHu/schema. All the advise is much appreciated. Thanks!

just to be sure on this (because i have a flappy test and i'm ruling things out): a spicedb instance running in testing mode should be functionally fully consistent all the time, right? like i'm not going to end up with a stale response even if i'm using minimize_latency?

not really, it would behave just like a regular SpiceDB instance would, with the exception it uses the memory datastore, and it provides the client with a fully isolated datastore instance per preshared key (so it allows you to start with a clean slate on each test)

so yeah, unless I'm mistaken, you could end up with stale data if you use minimize_latency, because it still subject to the same caching semantics as a normal instance

so if that's something your tests do not handle, I suggest issuing all requests with fully consistent, or grab the zedtoken

correct

got it - that makes sense. not sure where i got my previous notion 😛

Trying to get the HTTP mode enabled in spiceDB. I dont think this flag name is correct: https://github.com/authzed/examples/blob/c69fe1664c9e70d281210fb95cde8abd59c93a0a/kubernetes/example.yaml#L101 what is the correct one?

Hi @Joey, I was doing performance test and as suggested by you i have verified the performance using postgres(earlier i was using mysql), i could see spice db with postgres performs well compared to mysql. i could see 1 sec difference for p99. one thing still i see is check call was taking more time than LR. would request you guys to take a look from your end as well.

we really can't; you have your own schema and data and without copies of the exact tests you're running, the problem space is more or less super large

the best approach, as described above, is to enable tracing and get us a trace along with the exact schema and relationship data for the slow query

Apologies in advance if I've missed the answer to this in the documentation - does Authzed/SpiceDB support rollback? That is, if a permission change is deployed with insufficient testing and something Goes Very Wrong, is it possible to revert the change?

so long as the schema doesn't reference a relation which was added, yes

if it does, you can just not use the relation in the permission computation

its "roll forward", but you'd just change how the permission is computed

sorry, I was unclear (or maybe I'm misunderstanding you) - I don't mean a change to the schema, I mean adding a new relation.

so you can't delete a relation with data, but you can just... not use it

So... "no" 🙂