Hi, I'm exploring the spicedb and I have question...
# spicedb
h
Hi, I'm exploring the spicedb and I have questions around ABAC and caveats. Let me start with a schema example (https://play.authzed.com/s/aonY6x_c-6sE/schema):
Copy code
definition user {}

caveat check_balance(balance int, amount int) {
  balance >= amount
}

definition account {
  relation owner: user
  relation owner_with_balance: user with check_balance

  permission withdraw = owner_with_balance
  permission access = owner
}
In the above schema, I have a
user
definition and an
account
definition. The
account
definition has two relations
owner
and
owner_with_balance
. The need to keep two relations seems like a bit of duplication. While two relations for the same subject are not a problem, the same approach when there are multiple caveats can lead to scalability, readability and maintainability issues. Imagine a scenario where there are 10 caveats, and I have to create a new relation for each. I can create one relation and apply all the caveats to it. But then, the context of the permission check has to query all data needed to evaluate all the caveats. Is there a way to achieve the same using a single relation? Or maybe there is a better pattern that you can recommend? As a comparison, in Permify, there is something called attributes. Looking at the same schema in Permify https://play.permify.co/?s=KF0Hkca8hDUx0Wo7x1Ho_ I find it more readable and maintainable, at least when defining ABAC.
13 Views