https://authzed.com logo
Join Discord
Powered by
Hi everyone, I am new to spiceDB and
# spicedb
b
Hi everyone, I am new to spiceDB and stuck while creating a schema. definition user{} definition organization { relation admin: user relation member: user relation application: application permission org_members = admin + member permission org_admin = admin } definition application{ relation admin: user | organization#admin relation member: user | organization#admin relation org: organization permission users = member + admin + org->org_admin permission full_access = admin + org->org_admin } Test Relationships organization:foo#admin@user:u1 organization:foo#member@user:v1 organization:foo#application@application:bar organization:foo#application@application:bar1 application:bar#admin@user:u2 application:bar#member@user:u3 application:bar#member@user:u4 Expected relations application:bar#full_access: [] application:bar#users: [] organization:foo#org_members:[] when i check application:bar#users: [] it doesnot show organization admins in it. I don't know where am going wrong
v
Hey 👋 When sharing your schema, it's easier for troubleshooting if you share a playground link. You can click on the share button and paste the URL.
You don't have any link between the application and the organization, hence 
permission users
in 
application
unable to traverse to 
organization#admin
You need to add 
application:bar#admin@organization:foo#admin
this means 
every admin of the organization foo is also an admin of application bar
b
Thanks @vroldanbet that solved the issue. I saw the share feature now, will use it next time.😁
https://play.authzed.com/s/nU8DFNSfo8Sx/expected hey I ran into another issue. Above is the link for my schema and test relationships. What I am trying to achieve is i have defined a few policies and those policies are attached to a role. I have bound some users to that role, but when i check which users has access to that policy, it's returning empty array. Can anyone help
v
Can you please write the assertions you expect in the playground link? (you need to export URL again after modifying)
b
Hi @vroldanbet , this is the new link with assertions https://play.authzed.com/s/kBPB5Cq3OFB8/assertions I have also added comments against each assertion explaining y I think it should be true
v
the assertions seem to run correctly?
b
i wan the false parts to return true actually,
v
then please add those in the correct assertion, otherwise the reader is confused
b
ok
v
there is no relationship that creates a connection up to the org admin
- the policy:geocode_api misses the 
belongs_to
, which links it with an application - then the application needs to be linked with an organization to be able to reach to the org admin
if you add 
policy:geocode_api#belongs_to@application:apihub
, then it works
I used zed terminal in the playground to do an 
--explain
and visualize what was happening
Copy code
$ zed permission check policy:geocode_api access user:bharath --explain
false
⨉ policy:geocode_api access (800µs)
└── ⨉ policy:geocode_api attached_to (300.032µs)




$ zed permission check policy:geocode_api access user:bharath --explain
true
✓ policy:geocode_api access (2.200064ms)
├── ⨉ policy:geocode_api attached_to (0s)
└── ✓ application:apihub full_access (1.299968ms)
    └── ✓ application:apihub admin (899.84µs)
        └── ✓ organization:onze admin (199.936µs)
            └── user:bharath
b
thank you
I am using the go client library, how do i write the following relationship to spiceDB? application:apihub#admin@tenant:onze#admin I followed https://authzed.com/docs/spicedb/getting-started/protecting-a-blog this as well request := &pb.WriteRelationshipsRequest{Updates: []*pb.RelationshipUpdate{ { // tenant onze admin is a admin on application apihub Operation: pb.RelationshipUpdate_OPERATION_CREATE, Relationship: &pb.Relationship{ Resource: &pb.ObjectReference{ ObjectType: "application", ObjectId: "foo", }, Relation: "admin", Subject: &pb.SubjectReference{ Object: &pb.ObjectReference{ ObjectType: "tenant", ObjectId: "bar", }, }, }, }, } how do i add that i want to define that relation on tenant admin rather than tenant
v
@bharath3166 you'd set 
admin
as the 
OptionalRelation
, which is a field in 
SubjectReference
b
thanks @vroldanbet.
Hi @vroldanbet . I am not understanding y my assertion is failing. Can you help me please? https://play.authzed.com/s/eoNoF6H1oSwQ/assertions
2 Views
PreviousNext
Powered by