So I m playing around with authzed SpiceDB #spicedb

So I m playing around with authzed

tea.gremlin

08/07/2023, 7:35 AM

So I'm playing around with authzed/spicedb and it's been really ergonomic and powerful so far- I do have one question around best practices though- does anybody know whether having bi-directional relationships helps speed up queries if you're querying by a particular object type? Say that we have a uni-directional schema like this:

Copy code

/** user represents a registered user's account in our application */
definition user {}

/** document represents a document with access control */
definition document {
    relation owner: user
    relation reader: user
    relation writer: user

    permission read: owner + reader + writer
    permission write: owner + writer
}

And say for example that my access pattern includes showing a user what documents they have access to- would it make more sense to add in a bidirectional relationship to speed up that particular access pattern? e.g.

Copy code

/** user represents a registered user's account in our application */
definition user {
    relation access: document // <- only thing that was changed
}

/** document represents a document with access control */
definition document {
    relation owner: user
    relation reader: user
    relation writer: user

    permission read: owner + reader + writer
    permission write: owner + writer
}

And then for every relationship update we add in both a

user -> document

relation as well as a

document -> user

relation, so that normal permission checks work fine, but we're still able to quickly show the set of documents a user has access to?

tea.gremlin

08/08/2023, 7:11 AM

Expanding on this further, with

LookupResources

I'm able to help answer the question "what documents do i have access to", but what happens when I'd like conditional matching to occur? E.g. say that our schema looked like the above, except now we add in a

directory

definition to our object model:

Copy code

definition document {
    // <snip> all of the above is still the same
    relation parent: directory
}

definition directory {
    relation parent: directory
}

And we populate with the following relationships:

Copy code

// Adding a file in each directory
document:file_in_dir_a#parent@directory:dir_a
document:file_in_dir_b#parent@directory:dir_b_sub

// Nesting dir_b_sub underneath dir_b
directory:dir_b_sub#parent@directory:dir_b

// Adding the user as the owner of the files
document:file_in_dir_a#owner@user:some_user
document:file_in_dir_a#owner@user:some_user

Would there be a way to conditionally query and help answer the questions: * "What documents does

some_user

have owner permissions for in `dir_a`"? * "What documents does

some_user

have owner permissions for in

dir_b

(which has a file owned by the user nested underneath a subdirectory)" Looking at the docs it looks like [Caveats](https://authzed.com/docs/reference/caveats#lookupresources-and-lookupsubjects) might allow for this, but it's a bit confusing on how exactly i'd write a caveat to support "checking a file's parent

directory

against the one passed in" in a way that would respect the

parent

relationship recursively

tea.gremlin

08/08/2023, 7:22 AM

More concretely, if I have the following

zed

commands:

Copy code

sh
zed permission lookup-resources document own user:some_user
# Returns document:file_in_dir_a and document:file_in_dir_b

Would the way to add in conditionals to answer the first question be something like:

Copy code

sh
zed permission lookup-resources document own user:some_user --caveat-context '{"root_dir": "dir_a"}' # Or whatever else is required to trigger conditional matching behavior
# Expected behavior: returns document:file_in_dir_a only

and if so, what would I need the caveat to look like in order to support this?

tea.gremlin

08/11/2023, 10:56 PM

Anybody know how I can add in conditional lookups?

6 Views

Previous Next