but it might be better to explicitly do

org_admin

to make it more readable

the edit actually makes logical sense when the real names are put to it

can the schema be changed without re writing the relations if only permissions change and relations are preserved?

yes

you can also add relations or new types too

you just can't remove a relation or remove one of its supported types so long as there is data matching it (for safety)

its why we recommend using permissions, even if they are just

permission something = somerelation

that way, you can rewrite

something

whenever you like

That's awesome. I wasn't aware it was as flexible to change

yeah, it ensures a clear distinction between a relation for objects (like a role in RBAC) and how permissions are computed based off of those relations/roles

as an example, a user might be an

admin

on a resource

but if you have permissions like

permission can_comment = ..., permission edit = ...

, they could all be

admin

today... but maybe tomorrow you add

relation commenter

and now

can_comment

becomes

admin + commenter

, all without any data change

or code change

That is so nice. This made my day so much smoother. We had a minor misconfiguration and were pretty freaked out about the impact

yeah, that's one of the major benefits of Authzed/SpiceDB

trust me - I've been there with the minor misconfig leading to permissions heartache

that's why we have the assertions and expected relations validation in the playground too

to make darn sure your schema changes do what you think 😄

Ya this was i minor feature add that didn't restrict the results and everyone was like "oh crap..."\

been there, done that, got the t-shirt

Hi there. I had a question about making complex queries with spiceDb. Given the following schema: definition user {} definition resource { relation owner: user relation viewer: user | user:* permission view = viewer + owner } I am wondering if it is possible to obtain a list of 'resource's that are owned by some user (foo) that can be viewed by another user (bar). More plainly I am trying to get the intersection of resources that are owned by foo and viewable by bar. I tried looking through the api documentation and examples but I wasn't able to figure out how to make queries beyond basic checking permissions, writing relationships/schema etc. I would appreciate any advice. Thanks!

are

foo

and

bar

both dynamic for each call?

yes

so, a check or lookup call only allows for a single subject to be specified

that means you'd either have to write a relationship between those two users to restrict a permission, or filter yourself after the fact

Ok. So I guess the best way to go about it then would be to get a list of all resources owned by foo, then make a check permissions request for each resource to see if bar can view. Is that right?

or vice versa, but yes

aka a post filtering

ok thank you. I'm sorry I'm not familiar with post filtering. Is there somewhere I can read more about it?