Hubert
06/20/2024, 8:26 PMdefinition user {}
caveat check_balance(balance int, amount int) {
balance >= amount
}
definition account {
relation owner: user
relation owner_with_balance: user with check_balance
permission withdraw = owner_with_balance
permission access = owner
}
In the above schema, I have a user
definition and an account
definition. The account
definition has two relations owner
and owner_with_balance
.
The need to keep two relations seems like a bit of duplication. While two relations for the same subject are not a problem, the same approach when there are multiple caveats can lead to scalability, readability and maintainability issues.
Imagine a scenario where there are 10 caveats, and I have to create a new relation for each.
I can create one relation and apply all the caveats to it.
But then, the context of the permission check has to query all data needed to evaluate all the caveats.
Is there a way to achieve the same using a single relation? Or maybe there is a better pattern that you can recommend?
As a comparison, in Permify, there is something called attributes.
Looking at the same schema in Permify https://play.permify.co/?s=KF0Hkca8hDUx0Wo7x1Ho_
I find it more readable and maintainable, at least when defining ABAC.