Andrii
09/17/2024, 10:29 PMdefinition organization {
relation admin: user
}
definition user {}
definition user_group {
relation parent: organization
relation group_admin: user
relation group_user: user
}
I need to be able to get all organizations that some user belongs to. I have 2 options
*Option 1: *
definition organization {
relation admin: user
**relation user_group: user_group**
}
definition user {}
definition user_group {
relation parent: organization
relation group_admin: user
relation group_user: user
}
Pros: simple straightforward gRPC request for getting all orgs.
Cons: everytime I'm adding/deleting a group I need to do 2 writes (one for the user_group and second for organization). And I'm not sure how recommended traverse relationships are for Zanzibar
Option 2:
definition organization {
relation admin: user
}
definition user {}
definition user_group {
relation parent: organization
relation group_admin: user
relation group_user: user
**permission access = group_admin + group_user + parent->admin**
}
Pros: easy schema update
Cons: I need to get all user_groups for the user and iterate through each of them looking for organization. I'm afraid that this might cause serious delays if amount of data will grow significantly.
Please, if somebody had a situation like this or has more experience working with SpiceDB - would appreciate an advise here.