Looking for help with the schema, cannot find this...
# spicedba
andvla
09/19/2022, 10:59 AMLooking for help with the schema, cannot find this in docs:
Copy code
definition unit {
relation administration_director: user
relation sales_director: user
permission manage = administration_director + sales_director
}
definition company {
relation unit: unit
}
definition order {
relation company: company
permission update = company->unit->manage
}company->unit->managev
vroldanbet
09/19/2022, 11:05 AMhi! the usual way to address the lack of nested arrows is to create "proxy permissions"
Copy code
definition unit {
relation administration_director: user
relation sales_director: user
permission manage = administration_director + sales_director
}
definition company {
relation unit: unit
permission manage = unit->manage
}
definition order {
relation company: company
permission update = company->manage
}a
andvla
09/19/2022, 11:12 AMSo proxy is the only way to solve it, or do I have other options? I'm slightly worried, as we have about 15 user roles, where for some permissions I'll need to do this:
Copy code
definition unit {
relation administration_director: user
relation sales_director: user
permission manage = administration_director + sales_director
}
definition company {
relation unit: unit
permission manage = unit->manage
}
definition order {
relation company: company
permission update = company->manage
permission delete = company->unit->administration_director // This doesn't rely on permission from unit but a user roles instead
}andvla
09/19/2022, 11:14 AMWith the proposed solution, do I have any other options than this?
Copy code
definition unit {
relation administration_director: user
relation sales_director: user
permission manage = administration_director + sales_director
}
definition company {
relation unit: unit
permission manage = unit->manage
permission sales_director = unit->sales_director
}
definition order {
relation company: company
permission update = company->manage
permission delete = company->sales_director
}v
vroldanbet
09/19/2022, 11:16 AMhrm, you are turning a role into a permission here. It would suggest to think in terms of actions that can be authorized instead of how the permission is implemented
Copy code
definition unit {
relation administration_director: user
relation sales_director: user
permission manage = administration_director + sales_director
permission delete = sales_director
}
definition company {
relation unit: unit
permission manage = unit->manage
permission delete = unit->delete
}
definition order {
relation company: company
permission update = company->manage
permission delete = company->delete
}a
andvla
09/19/2022, 11:18 AMsales_director in our case is not allowed to delete a unit nor company. Order is the first thing in this structure we allow to delete.
v
vroldanbet
09/19/2022, 11:21 AMthen turn it into a permission that better represents what the sales director can do on the unit, like
manage_salesmanage_unit Copy code
definition unit {
relation administration_director: user
relation sales_director: user
permission manage = administration_director + sales_director
permission finances = sales_director
}
definition company {
relation unit: unit
permission manage = unit->manage
permission finances = unit->finances
}
definition order {
relation company: company
permission update = company->manage
permission delete = company->finances
}vroldanbet
09/19/2022, 11:27 AMat the end of the day is a question of naming that captures the business intent. I do understand it can be easier to reason to implement the permission in terms of "who can actually perform the operation" in this particular case
vroldanbet
09/19/2022, 11:29 AMmaybe orders should be associated with units?
vroldanbet
09/19/2022, 11:29 AMcompany has units, units has sales?
a
andvla
09/19/2022, 11:30 AMOk, thanks for the suggestion. So there's nothing I can improve about the schema in order to not have to do it this way? Maybe my role assignment for the users within a unit can be done differently in order to simplify it?
andvla
09/19/2022, 11:30 AMin our case every unit has multiple companies, each company can have orders, each order has invoices and so on
andvla
09/19/2022, 11:31 AMhaving this schema allows us to move companies between the units, without a need to relink all the children of a company to something else
andvla
09/19/2022, 11:32 AMin case we start relating all the children directly to the unit, each company-unit relation update will require bunch of other relations to be updated
v
vroldanbet
09/19/2022, 11:34 AMso yeah, however you name it, if you have a 3 level hierarchy like yours, you need a proxy permission. Feel free to bump the nested arrows issue if you feel this is a problem for y'all
https://github.com/authzed/spicedb/issues/15
a
andvla
09/19/2022, 11:36 AMthat would save us lots of rows in schema for sure, thanks for this URL and for all the suggestions above!
2 Views