https://authzed.com logo
Join Discord
Powered by
Getting list of authorized resources with details
# spicedb
z
Hello, in SpiceDB the only data we have about resources are relations and identifiers. Say I want to retrieve a list of documents for a user and show it in the UI. The only way I see is first to query SpriceDB to get a list of resource identifiers and then query another system to get the details in order to, say, show the title of each document in a list on the screen. Would there be another way of doing which would be more effective in term of performance?
Another thing I wanted to show in the UI is the list of permissions the user has on a document, like "read", "write"... I think I have to query SpriceDB for each possible permission and then combine the results. This isn't very optimal but how best to achieve this?
v
Hi 👋 - For the former question, we wrote about this in https://authzed.com/docs/spicedb/modeling/protecting-a-list-endpoint - for the latter question, you'll have to use a combination of 2 API calls - You'll first use reflection to list the permissions of the resource type: https://buf.build/authzed/api/docs/main:authzed.api.v1#authzed.api.v1.ExperimentalService.ExperimentalReflectSchema - Then you'd use 
CheckBulk
to send a batched request with a permission check for each one of the permissions. https://buf.build/authzed/api/docs/main:authzed.api.v1#authzed.api.v1.CheckBulkPermissionsRequest
Depending on your model you can also do the latter with an alternative strategy that uses 
ReadRelationships
. For example if the UI panel you are building shows roles, you can you can read all the relationships between the resource and the user. If instead of roles you want to list fine-grained permissions, you can also do 
ReadRelationships
to determine all the permissions defined by a specific role.
Please note the former strategy is more expensive and the latter is cheaper and more scalable
z
Thanks for your answer. Materialize sounds like the best solution. I was thinking about how permissions could somehow stream into another store and, good news, you are working on it. Unfortunately it's not yet available.
v
Materialize is available as Early Access on Authzed Dedicated.
Alternatively I've also described a non-scalable way to compute your own denormalized index in https://github.com/authzed/docs/pull/245
55 Views
PreviousNext
Powered by