Unable to use the attributes from the gR...
# spicedb
c
I'm having some issues with the Python package. Can't read responses: https://github.com/authzed/authzed-py/issues/121
v
have you written the schema to SpiceDB first? Are you using the zedtoken from the schema write? Python version?
c
Thx for helping 🙂 - I'm using version 0.13.0 of
authzed
- The schema has been written, yes 🙂 - I'm not using the zedtoken when trying to check the permissions - Python 3.11.6 The permission-check works fine from the commandline, if that's of any help 🙂
@vroldanbet I think I've stumbled across something. Updated the issue on github with details
v
Interesting, so there is a combination of dependencies where this does not work? What versions were you using before? Using poetry as well?
c
I'm using Poetry as well, yes. Also - this may just have been a coincidence, but I'll try to dig deeper 🙂 Here's all the packages that we're downgraded with your lock-file:
Copy code
• Downgrading pyasn1 (0.5.1 -> 0.5.0)
  • Downgrading cachetools (5.3.3 -> 5.3.1)
  • Downgrading certifi (2024.2.2 -> 2023.7.22)
  • Downgrading charset-normalizer (3.3.2 -> 3.3.0)
  • Downgrading idna (3.6 -> 3.4)
  • Downgrading urllib3 (2.2.1 -> 2.0.7)
  • Downgrading appier (1.32.0 -> 1.31.4)
  • Downgrading google-auth (2.28.1 -> 2.23.3)
  • Downgrading googleapis-common-protos (1.62.0 -> 1.61.0)
  • Downgrading google-api-core (2.17.1 -> 2.15.0)
  • Downgrading grpcio (1.62.0 -> 1.59.0)
Please let me know if there's something specific you'd like me to test 🙂
v
Would you mind posting this to the issue? With this I can try to find time to pin point which dependency was causing the issue, likely grpc stuff
c
Yes of course 🙂
v
I'm not able to reproduce this after updating to the latest versions of everything
c
Hmmm. I'll try to make something that's reproducible
v
tried building a new project, couldn't reproduce it: Python 3.12 main.py
Copy code
from authzed.api.v1 import (
    CheckPermissionRequest,
    Client,
    Consistency,
    ObjectReference,
    SubjectReference
)

from grpcutil import insecure_bearer_token_credentials

client = Client("localhost:50051", insecure_bearer_token_credentials("foobar"))
resp = client.CheckPermission(
        CheckPermissionRequest(
            resource=ObjectReference(object_type="resource", object_id="res1"),
            permission="read",
            subject=SubjectReference(object=ObjectReference(object_type="user", object_id="user1")),
            consistency=Consistency(fully_consistent=True),
        )
    )

print("permissionship is " + str(resp.permissionship))
pypoetry.toml
Copy code
[tool.poetry]
name = "authzed-py-example-01"
version = "0.1.0"

[tool.poetry.dependencies]
python = "^3.12"
authzed = "^0.13.0"


[build-system]
requires = ["poetry-core"]
build-backend = "poetry.core.masonry.api"
c
Hmmm interesting.
How can I use the zedtoken when I check permissions with python?
I cannot reproduce the issue either anymore. This is really strange
I'm now in a situation where it does not happen if I run the code with poetry, but if I run the code in a jupyter-lab session, it fails
v
>How can I use the zedtoken when I check permissions with python? The zedtoken you get from a previous request, pressumably your call to write schema
c
@vroldanbet Yes 🙂 I have the token, just not sure how to use it with the Python-library.
CheckPermissionRequest
does not have a
revision
parameter,
v
Is perhaps our documentation not clear on this regard? Trying to identify if there is any improvement we could introduce to make this clearer
If you go to authzed.com/docs, there is a "API Reference" menu, which takes you to https://buf.build/authzed/api/docs/main:authzed.api.v1
c
Hmmm. I can't seem to find it, but of course there's a real possibility that my question does not really makes sense. Sorry if that is the case. In your examples on the
protecting-a-blog
page, the
zed
example includes a zedtoken:
Copy code
zed permission check post:1 read  user:emilia   --revision "zedtokenfromwriterel" # true
However, the Python example does not:
Copy code
python
resp = client.CheckPermission(
    CheckPermissionRequest(
        resource=post_one,
        permission="read",
        subject=emilia,
    )
)
Trying to look at the docs you sent, but I can't seem find where / how to pass along the
zedtoken
. Thank you very much for your patience!
v
the question does make absolute sense!
if you look at the API definition for CheckPermission, you'll find a "consistency" field: https://buf.build/authzed/api/docs/main:authzed.api.v1#authzed.api.v1.PermissionsService.CheckPermission
SpiceDB has a "tunable consistency model". The zedtoken is for the
at_least_as_fresh
and
at_exact_snapshot
options
c
Aaah! of course! I see now:
Copy code
python
consistency = Consistency(at_least_as_fresh=ZedToken(token="GgYKBENLMEc="))

resp = client.CheckPermission(
    CheckPermissionRequest(
        consistency=consistency,
        resource=post_one,
        permission="read",
        subject=emilia,
    )
)
Thanks again! 🙂