Exploring Relationship-Based Permissions...
# spicedb
u
Hi! Our company is starting a new project, and I suggested trying SpiceDB as a great access control solution. We found an article that says we can also use it to find relations between entities without storing that information in a classic relational database like PostgreSQL. https://authzed.com/blog/writing-relationships-to-spicedb The question is: for example, we have two definitions such as "resource" and "user." Is it possible somehow to find all resources to which a user is related? Usually i see what "user" is just blank definition and in resource we have several relations (for example by roles: "administrator", "viewer", etc). Have no idea how to make such request by user id
v
Hi, welcome 👋 SpiceDB defines relations and permissions. Permissions are computed out of set operations over relations. If you want to read relations a user has with a resource, yes you can do that with
ReadRelationships
. If however you want to answer the question tell me all the resources the user has
view
access to
, then that's is done with
LookupResources
u
oh thanks then one more thing - is it possible to ask "tell me all the resources the user has any relation to"?
v
I'd like to stress that "relation" is different than "permission". Relation would be like an edge in a graph, which is what you construct when you store things in SpiceDB
permission, on the other hand, is a computation over that graph
so if you want to read relations, not permissions, yes, you can "read all the resources the user has any relation to"
but you can not get "tell me all the resources the user has any permission to"
you have to list each permission individually
we plan, however, adding an API that will tell you "given a user, and a resource, which permission(s) does the user have?"
u
Thank you so much, you just solved all our main concerns about using spicedb 🙂 Thanks!
Any API evolving is great That method can also help a lot. Already know where i can use it xD
6 Views