https://authzed.com logo
Join Discord
Powered by
hello) i have a question about
# spicedb
y
hello) i have a question about LookupResources request. I have definition project and user, user can be owner ,commenter, editor. User with each this relation can_view project. I want to get all user projects which user can_view but user is not owner. As i see i can not set in request: 
"permission": "can_view - owner"
because of validation and i don`t want to send 2 requests with filter by role (commenter, editor) should i send 2 requests for each role, or can i filter it in request? thanks)
v
have you considered creating a new permission 
permission can_view_minus_owner = can_view - owner
and run LookupResources over that? Sharing your schema would help
y
i thought about permission 
can_view_minus_owner = can_view - owner
but i have a lot of items in my db If I add this relation, it won't load the postgres too much?
Copy code
definition project {
    relation owner: user
    relation parent: folder
    relation viewer: user | link | group
    relation editor: user | link | group
    relation commenter: user | link | group
    relation signer: user
    relation filler: user
    relation restricted_owner: user 
    permission can_view = viewer + can_edit + viewer->membership + parent + parent->can_view + can_fill + can_comment + can_sign + restricted_owner
    permission can_edit = editor + editor->membership + parent + parent->can_edit + can_all - restricted_owner
    permission can_sign = signer + can_fill
    permission can_fill = filler
    permission can_all = owner - restricted_owner
    permission can_comment = commenter + can_edit + parent + parent->can_comment + commenter->membership
    permission has_access = can_view
}
v
>If I add this relation, it won't load the postgres too much? it's a 
LookupResources
. It will have to load much anyway. Just make sure to use cursors and low page size.
y
so, i will add this permission
thanks
@vroldanbet , if i will add new permission, will spice db "reindex" all data?
v
there is no reindexing to be made. Permissions are computed, nothing has to be written to the database other than the schema definition. I think there may be a misunderstanding on how SpiceDB works.
y
i just tried limit/cursor options) and i see that spice db CPU memory graffic is better, but cursor/limit loaded posgress cpu more) i tested on subject with 12k objects
@vroldanbet ⬆️
v
Yep, expected
y
v
Makes sense. There are changes coming soon to lookup resources which we hope will reduce memory further
4 Views
PreviousNext
Powered by