you could add

resource -> organization -> platform

it means attaching every org to the platform, but that should be fairly minimal vs attaching to every resource

it also means you can tenant out these kinds of "global" permissions later, if you decide you want a "partially 'global'" staff member

ok yeah I had the concept of

site

which seems like what you are suggesting for

system

or

platform

yeah

let me give it a shot with the

organization

intermediary

one other item to consider is how we might make this easier with public

the current proposal for public is to allow something like

resource:someresource#viewer@user:*

this is theoretically the inverse:

resource:*#viewer@user:staffgal

so maybe we consider both for the "public" proposal

although we'd have to think through the implications on performance and dispatch

ohh, interesting

that seems like it would solve our use-case pretty cleanly

yeah, and if we made it type system driven (some kind of annotation on the

relation

I'd wager), then it would only affect performance minimally

(for

check

)

@User would you mind adding your use case to the public issue (https://github.com/authzed/spicedb/issues/1/), and then I can add some text about this to spur further discussion? I can do so too, but it would be great to get further details on your use case if possible

can do!

haha, notice the issue number

@User the intermediary pattern works! thanks for the tip

anytime 🙂

done https://github.com/authzed/spicedb/issues/1/#issuecomment-973357174

Thanks!

Hey, I'm

@robinbraemer

and just want to make sure that the SpiceDB devs ( @User @User ) are aware of it... While I read through your watch crdb code https://github.com/authzed/spicedb/blob/a75cd6484c313c71dfd98072dadf0a4fffaed4d0/internal/datastore/crdb/watch.go#L29 and the crdb docs https://www.cockroachlabs.com/docs/v21.2/changefeed-for#considerations

It is therefore critical that you close the connection, otherwise the application will be blocked forever on Rows.Close().

- Since you use a pgx.Pool underneath, are you sure that the connection gets closed after the context to Watch stops watching, and that the pg connect is not just released back into the pool leaving the connection in an unusable state for new normal SQL queries?

hey @User , thanks for raising that. From looking at the docs and the

watch

code, I agree with your assessment that we're missing some important connection handling for changefeeds. I don't recall having seen any of the errors the crdb docs warn about, but maybe we've just been getting lucky

would you like to write up a github issue with this info?

Hey, can someone refer me to the best open source project solving **authen**tication? I already know that authzed is the best for solving authorization, now I need the best authn friend. 😄

It depends on your requirements. There are enterprise solutions like Ping, Okta. SaaS solutions like Auth0. Open source solutions like SuperTokens

Hi - I'm looking at a system similar to Google Cloud where there are permissions that can be added to different layers of the tree

Example: tenant -> vendor

Where a user could have vendor read permission on either tenant or vendor