Alright, thanks!

How would conditional access work in authzed? Here is an example of the policy schema policy { policy-bindings: [] } policy-bindings { principals : { users: [], groups: [] }, role: role-id, conditions { locations : [ { location location-name} }, time-interval start-time and end-time } }

@User if you mean based on dynamic restrictions such as location and time you mentioned in your example, Zanzibar doesn't natively support it. However, we have a proposal to add "caveats" to SpiceDB and Authzed: https://github.com/authzed/spicedb/issues/386

@User : Thank you so much for the dynamic restriction doc. Yes the proposal above handles our use case. May I request you to share the timeline of this feature's general availabiity?

its still in discussion, so there isn't (as of right now) a firm timeline, but I'd recommend subscribing to the proposal issue for updates

Hi! I am currently evaluating Authzed (running spicedb on one of our servers) to implement authorization for mulitple products on a central point. Our authorization decisions mainly come from 2 factors: 1. are you in any way related to the document you want to view/edit/delete/etc? 2. what plan are you operating on (free / paid) which will in turn enable /disable certain features. e.g. when i ask "**Can this user duplicate a document?**" - that requires them to 1. be able to see the document (being author, or being in the team that has access etc) and 2. have paid plan which includes the "duplicate" feature. **My Question**: Can such complex rules be covered in a single model and then be queried with a single query?

Usually such a model required intersection, and yes it’s usually possible with a single query using some creativity

Hey Jake - thanks for responding so quickly 🙂 Are there any online examples for similarly complex queries? All the resources I could find so far are handling the most basic examples like user/admin role and view/edit permissions. I couldn't figure out how to even begin to model structures like I just described

And to be blunt - our centralized authorization system will not get more budget than 1 auth request per user request.

something like that should give you a good starting point

thanks a lot!

you're welcome, let me know if you get stuck!

Looks good so far 👍

ohh you need to be careful with those links for the playground. They overwrite your work in progress there O.o Nearly lost my entire spec ....

yeah, its a single shared local storage

we're working on making it provide different context

That playground is a really cool tool - and since it's young some small issues like that are totally ok 😉

please file them if you see them

I am now running spicedb locally and trying to use the REST API. Unfortunately any HTTP requests to port 8080 simply respond with the Schema, so I assume it's the gRPC port 50051 I need to talk to. My HTTP client is not happy with the results tho:

iex(4)> Authzed.watch()
16:32:49.266 [debug] Connection closed with data left in the buffer: <<0, 0, 6, 4, 0, 0, 0, 0, 0, 0, 5, 0, 0, 64, 0>>
{:error, %Mint.TransportError{reason: :closed}}
{:error, %Mint.TransportError{reason: :closed}}

I cannot find documentation about how to turn on HTTP for my local spicedb https://docs.authzed.com/reference/clients#curl mentions the REST API and links to swagger docs. How can I use those?

@User https://authzed.com/blog/authzed-http-api/

8080 is the dashboard

--http-enabled

😄 thanks

50051 is for gRPC

I didn't check the blog 😄

thanks @User !

no worries; we're working on copying the informative blog posts over to the docs as well

anytime

sorry to be such a bother 🙂 Does

connection error: desc = \"transport: Error while dialing dial tcp: missing address\

mean anything to you? Any http calls i try to make end up with the same 503 response (It seems to me the default HTTP server in spicedb may be misconfigured)

@User best to ask in #844600078948630559