844600078504951838 #spicedb

Channels

Joey

11/12/2021, 9:22 PM

apiresource:api2#banned@application:pgo#player

Joey

11/12/2021, 9:22 PM

that will ban any players of the app

trungvu

11/12/2021, 9:23 PM

thanks. That's not what I want. I want only a specific player of that app banned

Jake

11/12/2021, 9:23 PM

you also want to drop these unions

on the types:

relation consumer: application#player | application 
    relation banned: application#player | application

Jake

11/12/2021, 9:24 PM

and just make it

: application#player

Jake

11/12/2021, 9:24 PM

do you want the player to be banned within the context of an app?

Jake

11/12/2021, 9:24 PM

like can the player still access the API on a different app?

trungvu

11/12/2021, 9:25 PM

yes

Jake

11/12/2021, 9:25 PM

ah ok

trungvu

11/12/2021, 9:25 PM

and they can access other api that they weren't explicitly banned from

Jake

11/12/2021, 9:26 PM

definition user {}
definition application {
    relation player: user
    relation banned: user
}

definition apiresource {
    relation consumer: application

    permission call = consumer->player - consumer->banned
}

Jake

11/12/2021, 9:26 PM

oh actually that could be improved!

Jake

11/12/2021, 9:26 PM

definition user {}
definition application {
    relation player: user
    relation banned: user

    permission active_player = player - banned
}

definition apiresource {
    relation consumer: application

    permission call = consumer->active_player
}

trungvu

11/12/2021, 9:27 PM

gotcha

trungvu

11/12/2021, 9:27 PM

i think this would meet most requirement except if i add add a user as banned to the app, they are banned from all api that app has access to

Jake

11/12/2021, 9:27 PM

for the first, if they got banned from any application they would be banned globally

Jake

11/12/2021, 9:28 PM

i'm not sure I understand your last statement

trungvu

11/12/2021, 9:30 PM

My bad, it's a bit of a weird use case. when api receives a request, it'll have the user id & the app id. It need to check if the app is allowed to access the api and it needs to check if the user is not explicitly banned from that API. It only grant access when both are true

Joey

11/12/2021, 9:30 PM

if you're checking for distinct app and user, you'll likely want to use two checks, unless the user and app are linked in some way directly

trungvu

11/12/2021, 9:31 PM

yes, it'll perform 2 check

trungvu

11/12/2021, 9:31 PM

may be i'm missing a 2nd permission in the api resource for user

trungvu

11/12/2021, 9:32 PM

actually, user and app are linked. User are player of an app. I'd prefer to only have to do 1 check given the player id

Jake

11/12/2021, 9:32 PM

why wouldn't this schema handle that case?

Jake

11/12/2021, 9:33 PM

do you do something differently if the app is allowed to access the apiresource but the user is not?

trungvu

11/12/2021, 9:33 PM

give me a sec, let me try the schema you just did. I'm probably missing something here. Thanks all

Jake

11/12/2021, 9:34 PM

in general we try to look for O(1) relationship creations for permissions driven API actions as a sign that the schema is optimal/normalized

Jake

11/12/2021, 9:35 PM

adding an app to an apiresource in this case is one relationship create:

apiresource:thething#consumer@application:theapp

Jake

11/12/2021, 9:35 PM

and banning a user from an app is also one relationship create:

Jake

11/12/2021, 9:35 PM

application:theapp#banned@user:jake

trungvu

11/12/2021, 9:48 PM

That's correct. Hopefully the banning would be much less frequent