I will try to repro this morning

I will at first try with this specific simplified schema (as my model is quite a bit bigger than this) and verify it still has the same issue

If so, I will file a bug

This seems to be too simplified, as this does resolve everything, I might have an idea what actually creates the problem, will try to repro

Ok, yeah

Usually it’s a mixup with a relation vs permission

Somewhere in the resolution chain

in the simplified example ^ there's an issue along those lines: > group:1#member@user:1337 member is a permission, not a relation, so you can't write a relationship like that. worth checking the full schema for similar issues

yeah that was an error indeed, changed it to user in my repro

But I found the actual problem

> definition folder { > relation parent: folder > relation reader : user | group#member > relation organization : organization > permission organization_member = organization->member > permission read= reader + parent->read & organization_member > > } > definition group{ > relation user: user > relation group: group#member > permission member = user + group->user > } > definition user{} > definition organization{ > relation reader: user | group#member > relation member: user | group#member > permission read = reader > }

> folder:bottom#parent@folder:one_up > folder:one_up#parent@folder:top > group:1#user@user:1337 > folder:top#reader@group:1#member > organization:1#member@user:1337 > folder:top#organization@organization:1 > folder:bottom#organization@organization:1 > folder:one_up#organization@organization:1

lookupresources gives back top and one_up but not bottom, checkpermission results in PermissionshipHasPermission

@User https://github.com/authzed/spicedb/issues/470

hey all - i'm trying to represent a default set of permissions for a group, for all newly created resources. this alone is straightforward enough, we create our resource with an inherit relation to a global resource that allows roles to give RW access. then all resources are created with references to this global resource this doesn't work in the subtractive case: if we have a group admin that by default has RW on all resources by defualt, but only R on a specific one we specify. It's non obvious to me how to represent this - maybe I'm missing something obvious? Here's what I have at the moment: https://play.authzed.com/s/8MF_242Z5Zf0/schema

hi @User you'd represent it as a relation on the resource to "remove" access

using your example:

you could also do

reader + (inherit->reader - notinherited)

if you wanted to make it just for that case

Hi all, I have spicedb running with PostgreSQL 12.4. I have my schema setup like this. https://play.authzed.com/s/qElc49zx_hb4/schema I am getting EOF error when I do permission lookup on transaction resources for some user. e.g > wenye@WENs-MBP-3 service % zed permission lookup transaction read user:u_6g6n28GL5Qo7ASLUGAshJY --insecure > Error: rpc error: code = Unknown desc = unable to query tuples: unexpected EOF I am able to do permission lookup for a user with over 32800 transactions, but getting EOF error for this user doesn't have much transaction but a lot of virtual cards. Any idea what could be causing it?

hi @User, are your "cards" nested?

sorry, just saw your schema link

looking

does your SpiceDB show any postgres errors?

it does't show error for EOF, another error I got is Error: rpc error: code = Unknown desc = unable to query tuples: ERROR: could not resize shared memory segment "/PostgreSQL.1253073668" to 42449280 bytes: No space left on device (SQLSTATE 53100)

sounds like your Postgres is running out of memory or disk

lookup can be a heavy operation, since it has to query a lot of data for a subject

I got that error once, all other request are ended with EOF, yeah, lookup query is expensive. Anyway I could make the lookup query pageable? wenye@WENs-MBP-3 service % zed permission lookup transaction read user:u_A6aQ7VMtQfC8PYSnJ1NWuz --insecure Error: rpc error: code = Unknown desc = unable to query tuples: unexpected EOF

we're planning to make it paginated

but in the interim, you'll likely to give your postgres more memory