Maragues
03/28/2025, 8:57 AMdefinition user { }
definition group {
relation permission_sets: permission_set
}
definition permission_set {
relation members: user
relation group_subgroups_create: role:*
permission can_group_subgroups_create = group_subgroups_create
// many more relation/permission pairs
}
And these relationships
group:supergroup#permission_sets@permission_set:admin
permission_set:admin#members@user:tom
If I use DeleteRelationships method to remove permisson_set:admin, the group:supergroup#permission_sets@permission_set:admin isn't deleted?
spicedb_client.DeleteRelationships(DeleteRelationshipsRequest(
relationship_filter=RelationshipFilter(
resource_type="permission_set",
optional_resource_id="admin",
)
)
)
From my integration tests, it looks like I need to explicitly delete the group relation
spicedb_client.DeleteRelationships(DeleteRelationshipsRequest(
relationship_filter=RelationshipFilter(
resource_type="group",
resource_id="supergroup",
relation_type="permission_sets",
subject_type="permission_set",
subject_id="admin",
)
)
)
Is this correct? Is there a way to cascade the delete of permission_set:admin so that every reference to "admin" is removed?
Furthermore, it looks like order matters, and first I need to remove the relation group:supergroup#permission_sets@permission_set:admin, or deleting the permission_set does nothing.