https://authzed.com logo
Join Discord
Powered by
roles being assigned to a specific object id can y...
# zanzibar
j
> roles being assigned to a specific object id can you expand on that?
r
this is the model I'm playing with, but it does not work
Copy code
definition user {}

    definition group {
        relation member: user | group#member
        relation assigned_to: location
    }
    
    definition role {
        relation membership: group#member
    }
    
    definition thing {
        relation group: group
        relation viewer: role#membership
        permission view: viewer + group
    }
j
relation group: group
is going to terminate at the group
so you either need to store 
group#member
there or have 
view = viewer + group->member
but I think you wanted it to be both viewer and a group member
which would make it 
view = viewer & group->member
r
Copy code
schema: |-
  definition user {}
  
  definition group {
      relation member: user | group#member
      relation assigned_to: location
  }
  
  definition role {
      relation membership: group#member
  }
  
  definition thing {
      relation group: group
      relation viewer: role#membership
      permission view: viewer & group
      relation creator: role#membership
      permission create: (creator + viewer) & group  
  }
  
relationships: |-
  group:managers#member@user:jane
  group:clerks#member@user:mary
  
  role:manager#membership@group:managers#member
  role:clerk#membership@group:clerks#member
  
  thing:*#viewer@role:clerk
  thing:*#creator@role:manager


assertions:
  assertTrue: [
    thing:thing1#view@user:jane,
    thing:thing1#view@user:mary,
    thing:thing1#create@user:jane,
  ]
  assertFalse: [
    thing:thing1#create@user:mary,
  ]
validation: {}
like this?
j
permissions need to use a 
=
relation group: group
and that would need to be 
relation group: group#member
or
permission create = (creator + viewer) & group->member
r
ok here it is, this passes:
Copy code
schema: |-
  definition user {}
  
  definition group {
      relation member: user | group#member
  }
  
  definition role {
      relation membership: group#member
  }
  
  definition thing {
      relation group: group#member
      relation viewer: role#membership
      relation creator: role#membership
      permission view = viewer & group -> member
      permission create = (creator + viewer) & group -> member 
  }

relationships: |-
  group:managers#member@user:jane
  group:clerks#member@user:mary
  
  role:manager#membership@group:managers#member
  role:clerk#membership@group:clerks#member
  
  thing:*#viewer@role:clerk
  thing:*#creator@role:manager


assertions:
  assertTrue: [
    thing:thing1#view@user:jane,
    thing:thing1#view@user:mary,
    thing:thing1#create@user:jane,
  ]
  assertFalse: [
    thing:thing1#create@user:mary,
  ]
validation: {}
but I feel there is something wrong as I never assigned any group to thing1 and yet the assertions work
j
Copy code
thing:*#viewer@role:clerk
  thing:*#creator@role:manager
that's not valid
r
ok, that's what I need to make the role generic and not assigned to a specific thing. the playground does not complain about it though....
j
I'll file a bug to make sure it does
just use a name
thing:whatever
yeah
playground isn't processing it
because its raising an error
I'll make that more explicit
r
I don't want it to mean thing:whatever, I want it to mean all the things...
j
you cannot assign relationships to entire definitions of resources
https://github.com/authzed/spicedb/issues/346 is an issue discussing it, but its not something we've committed to supporting yet
it comes with many complications
r
so wildcards work only on subjects?
j
yes
currently
the current recommendation is to just connect each 
thing
b
I'm not sure if this is going to helpful, but going to toss it out there in case it is! This is roughly how I modeled roles: https://play.authzed.com/s/WrQiSLQJ9H-V/schema.
j
thanks @Bryan!
r
@Bryan thanks for sharing your model. I'll give it a try.
4 Views
PreviousNext
Powered by