That's worked great, thanks. I really appreciate it 🙂

We just published a new blog post with schema design patterns! https://twitter.com/authzed/status/1468634540205912084

that's awesome, we've also been keeping our own list of design patterns internally! excited to read it! 🙇🏻‍♂️

Hey, that's great. If you're open to sharing, we'd love to see them 👀

I think they are a bit specific to our business domain, but I'll see which parts I can share! 💯

Not sure if this is a bug, but if comments (

// my comment

) are added to the Test Relationships in the playground, exporting that playground results in an invalid yaml file. Here is an example playground: https://play.authzed.com/s/Zbshi3GVS9Fc/schema. It generates the following yaml:

yaml
schema: >-
  definition github/user {}


  definition github/project {
      relation reader: github/user
      relation writer: github/user
      relation owner: github/user

      permission read = reader + writer
      permission write = writer + owner
      permission admin = owner
  }
relationships: >-
  // Add users to project

  github/project:pied_piper#owner@github/user:milburga

  github/project:pied_piper#reader@github/user:tarben

  github/project:pied_piper#writer@github/user:freyja
assertions:
  assertTrue: []
  assertFalse: []
validation: null

When serving SpiceDB locally with this config,

zed schema read

fails with this error: > Error: rpc error: code = Unknown desc = unable to initialize upstream: failed to load config files: Error parsing relationship #0: // Add users to project

yeah that definitely looks like a bug

I believe the relationships block is parsed manually in spicedb, splitting each individual line and then unmarshalling them as "tuples"

so the comment is unexpected in the parser

or at least that's what I recall from my last incursions into the codebase 😅

Yeah, I'm pretty sure we don't support those comments in SpiceDB's parsing of the YAML -- only the playground

Should be a quick fix to just see if the line is a comment or not and continue

a question related to accessing authorization information in spicedb API for a single subject: Is it possible to get all resources and their current permission (not just relations) for a subject? Or this is only possible by specifying the relation/permission as well and calling the API multiple times with each relation/permission? For example: if I have a user who belongs to an organization and the organization has multiple resources (so no direct relation between the resources and the users), can we render a table with all accessible resources and their relations/permissions (read/write for example) using only a single API call?

currently, you'd have to call LookupResources for each specific resource type and permission/relation

however, this is only if your table has to include permissions inferred for that user via the organization or a group or another intermediary

if you have a direct relationship between the resource and the user, you could call

ReadRelationships

@User does your

read

permission include

write

? if so, you could call

LookupResources

and then issue a

Check

to see if the user also has write permission on each (although it would be a lot of calls)

thanks for the prompt reply, this is what we have figured out as well, to call the API n times until we have all the data we need

well, a user who has edit access can of course read the resource as well, so we were thinking about getting all visible resources first and then all writable to get the final list (and potentially admin and owner in the future)

yeah, it might be faster to get the list of visible, then call

Check

for each for the higher permissions to determine the user's additional permission(s) on each

longer term, there has been some discussion about potentially having "context" on the result of LookupResources, indicating the path that was taken to reach that resource for a subject

which would allow you to determine the other permission(s) from the result, but it comes with a data cost that we haven't yet fully evaluated

i see thanks

if you like, you can file an issue at https://github.com/authzed/spicedb/issues and we can use that to track your use case with an eye to a better solution down the road

sure, thanks

@User do you want to also create an issue for the bug ya'll found? would also be willing to review a PR that fixes it 😉

if not one of us can make a fix, thought i'd offer the opportunity though

@User ☝️how do you feel a first contribution to spicedb 😄

I'm on it 🙂

yasss 🎉