ok, here goes (and I suppose the response could be collected into a thread if they want) - The basic question is "does spiceDB support iterating entities by type?" Motivation: I'm thinking about synchronizing users from an external authority (per https://authzed.com/blog/why-model-users/). Whenever I have an external authority I always worry about anti-entropy (missed messages due to wiring mishaps or bugs), which requires being able to compare state. For very large datasets I'd do something like a merkle tree, but my data set is pretty small, so I just want to iterate one or the other and compare. Detecting deletes is always tricky, so I might want to iterate both sets to make sure there's nothing in my data that isn't in the original.

usually the recommendation here is to keep a hash relationship and use it as a precondition for each update

genuinely LOL'ed

so, let's say you're syncing, say, users

indeed, let's say that

when you go to add/remove a user, you calculate a hash of all the users', say, IDs

yeah, you're describing a one-level merkle tree

yes

hash all the entities, then you know if something is different

and then you store that hash in SpiceDB

the hash tells me "something is wrong." Now I need to know what

well, you wouldn't have "something is wrong"

yeah, it's effectively an optimistic lock on the entire collection

nothing precludes writing a reference to a tree you store somewhere

yeah, definitely overkill here

of course 🙂

hey, just occurred to me - computing a hash of all user's IDs requires iterating all users, doesn't it? If not, how do I compute that hash?

yes, it does

ok, so the original question was "does spicedb support iterating entities by type" - I had inferred from your earlier responses that you were saying 'no' but I now think you were saying 'yes, but do it a cooler way'

yeah

thx

We also have some folks that just schedule jobs for low-traffic times to replay events to ensure nothing got missed.

sure. there's other ways stuff can get out of sync, though. backfills, bugs, etc etc. It's useful to have a way to actually guarantee that what is effectively a durable cache stays in sync with the authoritative source.