if you run SpiceDB with --log-level=trace and run a check, it should show which paths its taking

Does that work as a

SPICEDB_LOG_LEVEL=trace

env var?

Oh... yes it does 😅

@User I'll see if I can have the developer API return more info about this

what does it walk?

and that may be going back to user

and then back to admin?

potentially?

Does my relation graph have to be a DAG?

To define "a user can always upload a document associated with their own account"

like, its fine on another rel

or permission

so

user { 
relation admin: alto#act_as_admin 
permission impersonate = admin    
}

that's fine so long as there isn't a path from

impersonate

back to itself

should be pretty easy to check though; just comment out the use of it and see if the cycle resolves

that would cause it

so if I did like

impersonate = non_admin->admin

that should work in theory

that's what validation helps with

we'll endeavor to make the error more prominent

and informative

BTW I have this in a couple places.

permission upload_document = self + admin

Does it make sense to do this to get rid of the recursive self-reference?

permission upload_document = self + (admin - self)

Or will that only exclude

self

from

admin

after fully traversing

admin

which it won't do because it's a loop?

yeah

plus, if/when we do expression simplification, that would just become

admin