@Joey Awesome! Knows any user running spicedb in k8s with postgreSQL outside k8s?

I don't recall their names, but I do believe there are people doing so

Hi - any idea when https://github.com/authzed/authzed-node will be released as https://github.com/authzed/authzed-node/pull/23 is causing issues for us

We could build ourselves but if a release is imminent they would rather not

Hi all! I started integrating spicedb in our project but found something in the authzed-py library that stops us from proceeding. Unfortunately, if one tries to instantiate a client inside a sub-thread it throws a RuntimeError. All details can be found in the following issue: https://github.com/authzed/authzed-py/issues/33. Is this a real issue or am I missing something?

Hi, what is the way to filter data using permission model. Example: Users assigned with roles which are created based on some criteria like location and each user can just see their location's data only

Hi @User, we can do a release tomorrow

@User It is recommended that you instantiate a single client on startup and use it, and it will take care of making the calls in an async fashion

@User you could either have a relationship linking a user to a location, and then have roles be based on those, are do post-filtering after the fact. Caveats will likely make this easier once that proposal has been implemented

i was thinking a cool extra for integrating spicedb into an existing system would be a kafka connect sink

send messages to a topic that describe writes, like

{ "type": "DeletePermissions", "filter": ... }

or what have you and then the connector executes those calls against the configured spicedb endpoint, bumping the offset once it succeeds

then you can use the transactional outbox pattern to guarantee eventual consistency between spicedb and postgres or whatever. instead of writing to spicedb you write to a

spicedb_ops

table within the transaction. commit and rollback work as expected, and then you can use debezium to dump those ops onto the topic that the sink is listening to

I actually discuss that idea briefly in my blog post from this week: https://authzed.com/blog/writing-relationships-to-spicedb/

Less detail though 🙂

I understand and I'll try to do that. Anyway I think the issue I opened is worth to be checked because the method from asyncio that is used in client init is deprecated since python 3.10 and the solution I suggested should fix it

@User cool, will wait for the release

Just released v0.5.0 of the client which includes this update

We've published a post-mortem for the elevated API latency we observed last week. https://authzed.com/blog/post-mortem-feb-2022/

Thanks @User it works as expected together with Jest

Hey guys, wanted to know if we can define a yaml or a config file for database config instead of specifying db details in the serve cli command. Couldn't find anything related to that in the docs

Hi! Just found about about SpiceDB and wanted to ask you a few questions: 1. What is you opensource model for SpiceDB? I've seen many OSS projects that start fully opensouce but after a while start to diverge in feature sets when most new features are added to the enterprise version. 2. Any plans to add native support YugabyteDB? Like CRDB, it has a postgres compatible API.

hi @User, SpiceDB makes use of github.com/spf13/cobra for its command line arguments. Currently that means only CLI args work, but we could investigate using the compatible https://github.com/spf13/viper project to allow for config files too.

ohhh, alright. Thanks for the info 👍 I think you guys should definitely look into allowing config files, makes starting up and working with spicedb a bit easier in my opinion

I was pondering on an issue regarding permission checks, would appreciate any insight from you guys. I wish to do conditional rendering on my frontend based on the permission the user has. For example, if the user has the permission to create an employee in the organization he should be able to do so. If in the future the permission for adding employees has been revoked then that part of the UI must not be rendered for the user. Would it be advisable to do permission check calls in my Next.js frontend itself or should I approach this problem differently? I am also worried about a lot of permission check requests going from my frontend and whether i would have to scale spicedb for this.

@User the recommendation would be to do permissions checks either in your API or in Next.js server side rendering handlers, and then pass the permission info to your frontend

you can't (safely) do a permission check directly from the frontend

is your app fully Next.js?

its a combination of a next.js frontend and a golang backend

gotcha

so either call the extra permissions checks in your golang backend and pass them to Next.js