https://authzed.com logo
Powered by
spicedb
  • j

    Joey

    01/24/2022, 9:21 PM
    try the one in the Dockerfile: https://github.com/authzed/zed/blob/main/Dockerfile
  • s

    Sleipnir

    01/24/2022, 9:21 PM
    golang:1.16-alpine3.13
  • j

    Joey

    01/24/2022, 9:21 PM
    yeah, that's why I thought it might be a dynamic link issue
  • s

    Sleipnir

    01/24/2022, 9:22 PM
    yeah I'm using 
    alpine:latest
    because it seemed to work on 
    gcr.io/distroless
  • s

    Sleipnir

    01/24/2022, 9:24 PM
    Same error
  • s

    Sleipnir

    01/24/2022, 9:25 PM
    /data # which go
/usr/local/go/bin/go
/data # uname -a
Linux 1bca4515bae8 5.10.76-linuxkit #1 SMP Mon Nov 8 10:21:19 UTC 2021 x86_64 Linux
/data # cd /usr/local/bin
/usr/local/bin # ./zed 
/bin/sh: ./zed: not found
/usr/local/bin #
  • j

    Joey

    01/24/2022, 9:26 PM
    strange
  • j

    Joey

    01/24/2022, 9:26 PM
    feels like the APK is borked in some manner
  • s

    Sleipnir

    01/24/2022, 9:27 PM
    trying it with the deb on ubuntu
  • s

    Sleipnir

    01/24/2022, 9:31 PM
    That did it
  • s

    Sleipnir

    01/24/2022, 9:47 PM
    OK now I'm running into this issue: 
    root@47006ca9a96f:/data# zed context set alto_perms spicedb:50051 $SPICEDB_KEY --insecure
Enter passphrase to unlock /root/.zed/keyring.jwt:
    And I'm not sure what the passphrase is.
  • s

    Sleipnir

    01/24/2022, 9:48 PM
    This is a fresh install of 
    zed
    on a brand new ubuntu container.
  • e

    ecordell

    01/24/2022, 9:51 PM
    @User you should be able to set the 
    --token
    and 
    --endpoint
    flags instead of using a context
  • s

    Sleipnir

    01/24/2022, 9:52 PM
    When I tried that: 
    root@b48ab8e41c53:/data# zed schema write alto-authz.zed --token $SPICEDB_KEY --insecure
Error: must first save a token: see `zed token save --help`
  • e

    ecordell

    01/24/2022, 9:53 PM
    what about with 
    --endpoint=spicedb:50051
    ?
  • s

    Sleipnir

    01/24/2022, 9:54 PM
    Connection failure. But it turns out spicedb didn't finish initializing so let me check that out
  • s

    Sleipnir

    01/24/2022, 10:32 PM
    So now I'm seeing this from spicedb: 
    elixir-localdev-spicedb-1         | {"level":"error","module":"pgx","args":[],"err":"can't scan into dest[0]: cannot assign 0 1 into *uint64","pid":61,"sql":"SELECT MAX(id) FROM relation_tuple_transaction","time":"2022-01-24T22:31:45Z","message":"Query"}
elixir-localdev-spicedb-1         | {"level":"error","grpc.method":"WriteSchema","grpc.method_type":"unary","grpc.service":"authzed.api.v1.SchemaService","grpc.start_time":"2022-01-24T22:31:45Z","kind":"server","system":"grpc","grpc.code":"Unknown","error":"unable to find revision: can't scan into dest[0]: cannot assign 0 1 into *uint64","grpc.time_ms":"4.218","time":"2022-01-24T22:31:45Z","message":"finished server unary call"}
  • s

    Sleipnir

    01/24/2022, 10:42 PM
    Failed to insert the first transaction.
  • u

    user

    01/24/2022, 11:15 PM
    I'll take a look into the apk now. The deb/apk/rpm are all done with goreleaser
  • m

    mixedCase

    01/25/2022, 5:01 PM
    Hey everyone. Had a couple of questions regarding SpiceDB: - How are people using the Lookup API when you have the need to further filter inside your main database? Do you just ping pong between SpiceDB and the database until you have a full of page objects that fulfills both permission criteria and the rest of filtering criteria? - What's the quickest way to answer "this person has X permission for at least 1 object"? Thank you in advance!
  • j

    Jake

    01/25/2022, 5:05 PM
    yes the lookup does Authzed prefiltering, then you would pass those IDs into a database query, maybe padded out enough so that you're likely to get a full page after DB post-filtering, you can also do you criteria in the DB and then pass each item to an authzed check for post-filtering
  • j

    Jake

    01/25/2022, 5:05 PM
    we're working on a system called the tiger cache that should help if your database supports roaring bitmaps (either natively or through an extension) https://github.com/authzed/spicedb/issues/207
  • j

    Jake

    01/25/2022, 5:07 PM
    > "this person has X permission for at least 1 object" this also sounds like Lookup, but you would just terminate the stream after the first response item comes back
  • j

    Jake

    01/25/2022, 5:07 PM
    the objects could also be added to a hierarchy with relationships (in case the N objects are related somehow) and then you could do a check on the hierarchy
  • j

    Jake

    01/25/2022, 5:08 PM
    @User hope this helps!
  • m

    mixedCase

    01/25/2022, 5:08 PM
    It definitely does! Tysm for the quick answer 😄
  • c

    cd

    01/25/2022, 9:57 PM
    Hi, I have a question on schemas... I noticed in the docs that a relation hierarchy can be walked by either a relation or a permission (looking at the super-admin and synthetic relations patterns from https://authzed.com/blog/schema-language-patterns/); are there scenarios in which a schema author should use one type over the other?
  • j

    Joey

    01/25/2022, 10:01 PM
    @User a relation is used for when a concrete relationship can existing between a resource and a subject (i.e. between two objects). permissions, on the other hand, are computed based on one (or more) relations or other permissions
  • j

    Joey

    01/25/2022, 10:02 PM
    if you were modeling a traditional RBAC-style permissions system, you could think of 
    relation
    as a role, and 
    permission
    as, well, a permission based on those role(s)
  • j

    Joey

    01/25/2022, 10:02 PM
    as a basic example, imagine you have two roles (reader and writer) for users on some sort of resource: 
    definition user {}

definition resource {
  relation reader: user
  relation writer: user
}
1...717273...325Latest