runtime grant with caveat
# spicedb
j
wrap the assertions with
with
statements in
'
s
Thanks Joey. I'm getting another error after fixing this. Spicedb seems to think a user that doesn't have direct grant and doesn't pass caveat has permission? https://play.authzed.com/s/ckMDHlDL0lFr/assertions
j
without the caveat the system doesn't know how to answer that check
you can see its returning a "maybe" because the caveat is missing context
(btw, check watches makes this all super easy to debug)
Copy code
assertTrue:
  - company:c1#send_notification@user:1
  - 'company:c1#send_notification@user:2 with {"action": "SEND_NOTIFICATION"}'
assertCaveated:
  - company:c1#send_notification@user:2
assertFalse:
  - 'company:c1#send_notification@user:2 with {"action": "ANOTHER_ACTION"}'
this passes
one sec..
fixed
s
Gotcha. That makes a lot of sense. Thank you so much for quick answers!!!
j
of course 🙂