Can someone tell me what I'm doing wrong
# spicedbt
torben_26072
03/12/2024, 5:12 PMCan someone tell me what I'm doing wrong here? https://play.authzed.com/s/B_kdTvoeYO5-/assertions
api_key:key1#view@user:admin1 and api_key:key1#edit@user:admin1 fail to validate.
I expected it to go key1 -> owner_org: bot1#owner_org = org1 -> org1#admin = admin1.
Copy code
definition api_key {
relation owner_org: bot#owner_org
permission edit = owner_org->admin
permission view = edit
} Copy code
$ zed permission check --explain api_key:key1 owner_org organization:org1
true
✓ api_key:key1 owner_org (0s)
└── ✓ bot:bot1 owner_org (0s)
└── organization:org1
$ zed permission check --explain organization:org1 admin user:admin1
true
✓ organization:org1 admin (0s)
└── user:admin1
$ zed permission check --explain api_key:key1 owner_org organization:org1
true
✓ api_key:key1 owner_org (0s)
└── ✓ bot:bot1 owner_org (0s)
└── organization:org1
$ zed permission check --explain api_key:key1 edit user:admin1
false
⨉ api_key:key1 edit (0s)v
vroldanbet
03/12/2024, 5:58 PMthat check does not resolve to
userorganizationbot#owner_orgvroldanbet
03/12/2024, 6:00 PMah no, this is a known gotcha, it's documented but not trivial. Let me find that for you
vroldanbet
03/12/2024, 6:01 PMyou basically can't do
bot#owner_org->adminvroldanbet
03/12/2024, 6:04 PMyou want to do something like this: https://play.authzed.com/s/fWZFtEMCJswS/assertions
vroldanbet
03/12/2024, 6:05 PMor perhaps a better option is
Copy code
definition api_key {
relation owner_bot: bot
permission edit = owner_bot->admin
permission view = edit
}
`t
torben_26072
03/12/2024, 6:09 PMOk, I guess if you know that using a relation which has a # in a permission with a -> is not possible there are different ways to model around it. But I would have expected it to work.
I'll try to remember it. 🙂 But I think this should be mentioned here: https://authzed.com/docs/spicedb/concepts/schema#--arrow
v
vroldanbet
03/12/2024, 6:27 PMyep I understand the friction, been myself there, it still does not feel right
vroldanbet
03/12/2024, 6:27 PMWe had added some docs but may have gotten lost in the rewrite, I'll make a note