Howdy all - I'm (re)trying to create a schema setup with users and 'permission profiles'. These profiles can be assigned to the user (only one per user). The profile havea bunch of permissions attached, so to do anything we will need to consult the user's profile to check that it has the correct permission. In this schema example I am trying to introduce the rule that a user's management page can only be accessed by users with the correct admin profile permissions https://play.authzed.com/s/nHmuQb-gxtXT/schema

yaml
definition user {
    relation team: user_team
    relation profile: profile_binding

    // You can access a user's page if you are the admin of all users, or this user is in your team
    permission access_management_page = profile->admin_all_users + (profile->admin_team_users & team->same_team)
}

definition user_team {
    relation member: user
    permission same_team = member
}

definition profile {
    // Possible permissions each profile could have enabled
    // user:* => “any user who holds this profile will have this permission”
    relation admin_all_users: user:*
    relation admin_team_users: user:*
    permission admin_all_users_enabled = admin_all_users
    permission admin_team_users_enabled = admin_team_users
}

// This is acting as a synthetic relation (not needed once nested -> is a thing)
definition profile_binding {
    relation bound_user: user
    relation bound_profile: profile

    // Check that user has the profile AND the profile has the permission
    permission admin_all_users = bound_user & bound_profile->admin_all_users_enabled
    permission admin_team_users = bound_user & bound_profile->admin_team_users_enabled
}

It works... BUT the issue I have is when I setup the relationships - now every user needs to know about every profile binding...

> now every user needs to know about every profile binding can you elaborate on that? and i'm not entirely sure that it applies here, but if the idea is that a user either has the permission on all resources or on no resources, it's usually better not to reference the resource in the permission

> can you elaborate on that? What I mean is, when I define the user relationships (see my second message) I have to map every 'profile_binding' to the 'profile' (poorly named) attribute of the user. This is so the user can access the profile binding directly for the access permission check e.g.

profile->admin_all_users

yeah, the usual model for a google cloud iam-style permission is that you tie the resource (in this case the user) to the role_binding in addition to the role and the subject (also a user)

Ah my mistake - im still very much a spice noob

and lemme give you an example of what i'm talking about with a platform object

Thanks for the help!

no worries! i still feel like i'm wrapping my head around schema modeling and i've been doing it for a while ^.^

Your example makes sense thank you - in our case its not as simple as 'user has access to all `access_management_page`s or none. It's more - we have profiles (essentially roles) and the profile can have either - allow access too all

access_management_page

permission enabled OR allow access to

access_management_page

of only users in your team. I have attempted to follow your approach here - using organisation as our singleton - https://play.authzed.com/s/xS8FUsgtpmeX/schemae

> a user can only have one profile assigned there isn't a way to enforce this at the SpiceDB level currently. we've got a propoosal in the works that would allow you to enforce a 1:m structure on a given relation, but i'm not sure that would help in this case because the profile bindings obscure things. if a user only has a single set of perms across all objects, you could collapse the role_binding and role definitions together. that may fit the semantics of your system better. the reason that it might not be desirable is that if you want to change the definition of a role, you have to touch all of the roles that all users have in order to update them. but again, that may match what you're trying to do