844600078504951838 #spicedb

Channels

zanzibar

spicedb

Jake

01/27/2022, 12:44 AM

So the exclusion doesn’t get represented in the graph directly

Jake

01/27/2022, 12:47 AM

For exclusion we’re basically saying: is there a path to the subject on the left hand side, and if there is we need wait until we know if there is a path to the subject on the right hand side before we can make our final determination

thomas.richner

01/27/2022, 12:55 PM

So, I've been trying to model some use cases that we want to solve with SpiceDB and there is one thing I came across. Considering the following schema:

Copy code

definition user {}

definition blob {
    relation owner: user_archive | shared_document // | ... and so on

}

definition user_archive {
    relation owner: user
}

definition shared_document {
    relation editors: user
}

Is there a useful way to invert the definition of relationships in

blob

? I.e. the service handing out blobs does not really care if it is part of a user_archive or a shared_document and ideally the definition would not have to be changed.

thomas.richner

01/27/2022, 12:56 PM

Or can I somehow merge schemas along the lines of:

Copy code

definition user {}

definition blob {
    relation owner: user_archive

}

definition user_archive {
    relation owner: user
}


definition blob {
    relation owner: shared_document

}

definition shared_document {
    relation editors: user
}

and each service would push the schema/relations relevant to it?

Jake

01/27/2022, 1:31 PM

@User the intention would be to set a permission on the blob, so that the service handing out blobs always checked it uniformly

Jake

01/27/2022, 1:32 PM

Copy code

definition user {}

definition blob {
    relation owner: user_archive | shared_document // | ... and so on
    permission can_access = owner->owner + owner->editors
}

definition user_archive {
    relation owner: user
}

definition shared_document {
    relation editors: user
}

Jake

01/27/2022, 1:32 PM

currently the entire schema is uploaded as a single atomic unit, to ensure that types can be checked and computed across all relations and permissions

Jake

01/27/2022, 1:33 PM

so there's no idea of federation of schema fragments

Jake

01/27/2022, 1:33 PM

we may build an import system in the future, but the final schema write call would still need to resolve everything before it could be written

thomas.richner

01/27/2022, 2:10 PM

ah, I see. Federation would be nice for microservices, though I also see that this would come along with a lot of footguns...

thomas.richner

01/27/2022, 2:11 PM

On a related note, is there any means for schema migration? I.e. can I add new relations to existing schemas? Can I remove some?

thomas.richner

01/27/2022, 2:12 PM

i.e. if I add something like

Copy code

definition avatar_image {
    relation owner: user
}

I'd need to update

blob

, but not affect existing tuples that I created earlier for blobs.

Joey

01/27/2022, 4:42 PM

@User new relations can be added to definitions, but you still need to keep all the existing ones

Joey

01/27/2022, 4:42 PM

relations can be removed IF they have no relationships referencing them; otherwise, it will error

Joey

01/27/2022, 4:42 PM

basically - you need to cleanup the data first before removing them, in case it needs to be migrated

Joey

01/27/2022, 4:43 PM

longer term, we're developing a proposal for a formal migration system of some kind, but its still quite early in the design phase

thomas.richner

01/27/2022, 4:49 PM

@User thanks a lot for the clarification, that makes sense.

thomas.richner

01/27/2022, 4:54 PM

@User another question that popped up: Is the current https://github.com/authzed/spicedb with the Java client production ready with a backing Postgres DB?

Jake

01/27/2022, 4:56 PM

people have different definitions of production ready, what I will tell you is that: there are no known issues with the postgres datastore, java client, or spicedb itself that should prevent you from using it in production

Jake

01/27/2022, 4:57 PM

and if you happen to find something, we're committed to getting it fixed up for you right away

thomas.richner

01/27/2022, 4:57 PM

Fair enough, thanks. That sounds good to me.

thomas.richner

01/27/2022, 4:58 PM

we will do a PoC, let's see if we find anything 😉

thomas.richner

01/27/2022, 5:01 PM

Anyways, thanks for all the help so far.

vroldanbet

01/27/2022, 6:53 PM

Authzed folks, have you noticed the new enemy tests flaking? We are seeing that in our fork

vroldanbet

01/27/2022, 6:53 PM

it's in the e2e test suite:

Copy code

panic: Log in goroutine after TestNoNewEnemy has completed: no such process



goroutine 32 [running]:
testing.(*common).logDepth(0xc00038ab60, {0xc000df68a0, 0x11}, 0x3)
    /opt/hostedtoolcache/go/1.17.6/x64/src/testing/testing.go:779 +0x4c9
testing.(*common).log(...)
    /opt/hostedtoolcache/go/1.17.6/x64/src/testing/testing.go:761
testing.(*common).Log(0x40ca07, {0xc00046b9c0, 0xaf1be0, 0x1})
    /opt/hostedtoolcache/go/1.17.6/x64/src/testing/testing.go:800 +0x45
github.com/authzed/spicedb/e2e.(*TLogger).Write(0xc000128318, {0xc000860000, 0x10, 0x9})
    /home/runner/work/spicedb/spicedb/e2e/util.go:17 +0xa6
fmt.Fprintln({0xd1d720, 0xc000128318}, {0xc0001f47c0, 0x1, 0x1})
    /opt/hostedtoolcache/go/1.17.6/x64/src/fmt/print.go:265 +0x75
github.com/authzed/spicedb/e2e.cleanupOnDone.func1()
    /home/runner/work/spicedb/spicedb/e2e/run.go:55 +0x87
created by github.com/authzed/spicedb/e2e.cleanupOnDone
    /home/runner/work/spicedb/spicedb/e2e/run.go:51 +0xa7
FAIL    github.com/authzed/spicedb/e2e/newenemy    87.671s
FAIL

ecordell

01/27/2022, 6:56 PM

it does seem like they've gotten flakier in the past few days. I looked at a couple of failures and it seemed like the GHA nodes are slower than they used to be, and sometimes the clock skew we add (+ the slower GHA node) makes cockroach eject the node from the cluster (which then means it can't be properly tested). if you see a failure, the artifacts for the job will include the crdb node logs; we can start collecting them to see if my thesis is right

ecordell

01/27/2022, 6:56 PM

they are unfortunately sensitive to hardware/noisy neighbors

ecordell

01/27/2022, 6:57 PM

but maybe if we could at least detect that state we could adjust constants and retry or something

vroldanbet

01/27/2022, 7:03 PM

right

fukuroutoimasu

01/27/2022, 7:04 PM

is this something that the gobencher service might be able to help us out with?