https://authzed.com logo
Join Discord
Powered by
Hi everyone I am trying to set an optional relati...
# spicedb
p
Hi everyone I am trying to set an optional relation to my user but unable to do it
v
👋🏻 hi! can you expand on what you mean with "optional"? writing relationships is not mandatory and permissions in an object type can be evaluated with relations being unset.
p
The optional relation column in relationship
How do we really set it
v
oh, I see what you mean! It's failing because relation 
writer
is of type 
blog/user
, and you are trying to assign it to a 
group
. If you want to write the relationship on 
grouping
, you need to make 
relation writer: blog/user | group
p
Will try
Could you ping me any documents on this
I searched all over the blog and website but could not find any
I need an explanation of how to creeate an optional relation and assign it to a resource
v
I can have a look at the docs and see if I can find any reference to this.
I actually misled you, and the relation should be like this: 
relation writer: blog/user | blog/user#grouping
so it says "this relation points to 
blog/user
or to the grouping relation in `blog/user`"
@prasanna all I could find was https://docs.authzed.com/reference/schema-lang#subrelations, which refers to it as "subrelation", whereas the playground refers to it as "optional relation". I think we need some naming consistency here cc @Joey
p
It’s very tough to@understand the whole concept of optional relation with this document Hope I can get more info
v
would you perhaps help me understand what you are trying to achieve?
p
We have a whole entitlement spice db ApI set and I am trying to understand the parameters and the spicedb terminology related to real time scenarios
j
so the optional subject relation allows you to link one relation to another
rather than to a subject "directly"
a canonical example might be if you have a relation representing a role on a resource
like, say:
Copy code
definition user {}

definition team {
  relation direct_member: user
  permission member = direct_member
}

definition resource {
  relation viewer: user
  permission view = viewer
}
now, what happens if you want to grant the 
viewer
"role" to all members of a particular team?
you could add each user from that team to 
viewer
, but that means they are now all individually managed
you could, also, have a 
relation viewer_team: team
and use an arrow, but that means having two relations
instead, you can do this:
Copy code
definition user {}

definition team {
  relation direct_member: user
  permission member = direct_member
}

definition resource {
  relation viewer: user | team#member
  permission view = viewer
}
by adding 
team#member
you can write a relationship on 
viewer
between the resource and any member of a team as a whole
and SpiceDB will just walk to 
member
to check for the users
p
Thanks a lot @vroldanbet and @Joey
PreviousNext
Powered by