@User anything out of the ordinary to get it running on ACI?

@User @User I have created an unofficial docker compose for spiceDB & postgres . Will do same for cockroach as well for local development . https://github.com/dvdthecoder/authzed-docker-compose-postgres

Hi there , when using local instance of spiceDB , and connecting with a programmatic client [ Node ] , what is the environment variable to over ride the server address . Is it hard coded or have I missed reading the settings

const authzedEndpoint = "grpc.authzed.com:443";

You should be able to override the

endpoint

arg on the NewClient constructor

UNKNOWN: invalid preshared key: rpc error: code = Unauthenticated desc = Request unauthenticated with bearer

although same key is working fine with zed but does not work fine when used through node .

Are there any relevant server logs?

We published a new blog post today https://twitter.com/authzed/status/1479137255503585281

Hi All, starting to test out spice db. I've installed spicedb and am following the instructions on the localhost landing page. When I run

zed context set first-dev-context :50051 "the preshared key here" --insecure

I am getting this modal. Why does zed need access to my keychain?

@User it stores your token/preshared key in your keychain

so you don't have to supply it everytime

that way when you do

zed ...

on the context, it can get the token from your keychain securely

got it, thanks Joey. One more question, what is the preshared key? I didn't find anything in the docs related to what that is. Do I make up my own?

yes

you specify it on the CLI when you start SpiceDB

Lots of questions, hope you dont mind: 1. Do you have an example/recommendation on how to setup a schema for a codebase with hundreds of objects and thousands of permission combinations? Is it possible to break the schema up into sub schemas? 2. How does the node client know which schema to load? Looking at this [example](https://github.com/authzed/authzed-node/blob/main/examples/v1alpha1/example.js), is the recommendation to load the schema into memory at runtime on app startup?

schema is written using

WriteSchema

and is persisted to your datastore

node client simply connects to the SpiceDB, which should have its schema previously loaded with

WriteSchema

as for #1, we're exploring some options but right now all schema must be in a single call

Nope, it worked as expected. Note that I'm not using the official SpiceDB container, I have an Ubuntu base image with SpiceDB and zed CLI on it.

I have been doing some experiments with graphql-mesh ( https://github.com/dvdthecoder/authzed-graphql-api ) . When I try to run handlers for gRPC transformations , I was not able to run it due to https://github.com/protobufjs/protobuf.js/issues/1683 , where it is not able to parse

(validate.rules).repeated .items.message.required = true

. I wanted to know the significance of this . Whilst the parser does understand repeated and required , it is not able to tokenize further.

@Abhishek Dwivedi it’s metadata used by proto validate to generate validation code for checking the incoming message contents. The tool used is https://github.com/envoyproxy/protoc-gen-validate

Anything inside of the [] in proto definitions should be treated as structured metadata by proto parsers

Thanks Joey for additional comments. I will update the issue . I think so it is not respecting this nuance

Yeah, probably a parser deficiency somewhere

I had a question regarding email ids as resource ids for users . I am not sure , i will test it again but I did see that that zed tooling was uncomfortable with the interpretation because of

@

. Whilst this was just an experiment , I was not interested beyond trying out for GDPR reasons.

@User

@

is not allowed in object IDs and we highly recommend against using email addresses as subjects because they cannot always be confirmed, nor are they considered "stable". Instead the recommendation is generally to link to the

sub

field of an OAuth flow, or use an internal user ID representation from your database. If neither is applicable, you can base64 encode the email address to store it, but again, that is not recommended

Agreed and thanks @User for response

Hi @User , is there any release plan to go alpha for the Tiger Cache ?

I was looking at https://github.com/authzed/spicedb/issues/207#user-content-fn-2-d1b57c4a1cab8d00d1aabc751d98a86a , when we talk about

Various tests show approximately ~100ms for a LookupResources call on a SpiceDB with 100-250K relationships, and a graph nesting of 3-5 deep.

, is it that number of relationships on a particular subject or in general a store containing that many relationships ?

@User it was for the store containing that many relationships, but for the test case in question it was a fully connected graph