With Watch API streaming relationship updates, is ...
# spicedb
a
With Watch API streaming relationship updates, is it possible to get extra context about who made those updates? something that would correlate the updates with users' requests/sessions in the app that uses spicedb. Like the CheckPermission call, a request header (with tracing) can be propagated through SpiceDB for the request's lifetime. I understand that CheckPermission is a read-only request and does not persist in the database. As far as I can see from the source code, there is no way to provide extra/debug payload for WriteRelationships and DeleteRelationships calls, and the
relation_tuple
table doesn't store any additional context. On the client side, I have a grpc client interceptor that injects x-request-id into client details metadata, which is then logged by spicedb server in
requestID
field:
Copy code
{
  "level": "info",
  "protocol": "grpc",
  "grpc.component": "server",
  "grpc.service": "authzed.api.v1.PermissionsService",
  "grpc.method": "WriteRelationships",
  "grpc.method_type": "unary",
  "requestID": "this-is-injected-by-client",
  "peer.address": "172.21.0.5:47620",
  "grpc.start_time": "2024-05-24T13:15:04Z",
  "grpc.code": "OK",
  "grpc.time_ms": 14,
  "time": "2024-05-24T13:15:04Z",
  "message": "finished call"
}
But that request-id is not persisted and is not exposed via Watch API. I wonder how the Audit log records (with Extender feature in enterprise builds) have metadata with x-request-id without storing request context in the database. Does it push the data/logs from spicedb to another service/API?
9 Views