Question on caveats - SpiceDB playground worked fine for the below definition of the caveat, relationships and assertions but I want to double confirm and see that it is ok to just send the required context even though caveat is defined with multiple other parameters.
caveat restrictions (restricted_groups list
, restricted_users list
, this_group string, this_user string) {
this group in restricted_groups || this_user in restricted_users
}
// relationship
doc:Doc1#restriction@company:Company1[restrictions:{"restricted_users":["myUser1"]}]
# assertion
'doc:Doc1#access@company:Company1 with {"this_user": "myUser1"}'
// relationship
doc:Doc1#restriction@company:Company1[restrictions:{"restricted_groups":["SalesGroup"]}]
# assertion
'doc:Doc1#access@company:Company1 with {"this_group": "SalesGroup"}'
You can see in the above relationships, only one of restricted_users or restricted_groups is set but not both. SpiceDB playground did not complain but is this style of saving relationships ok to proceed?