Hi! I believe you're looking for the Lookup API - have a look at this https://buf.build/authzed/api/docs/main:authzed.api.v1#authzed.api.v1.PermissionsService.LookupSubjects

I think that's to check for a specific permission, I want to be able to provide a resource and a user, and get back all the permissions the user has on the provided resource

sorry for jumping on to this, but I'm looking for a way to do this as well! If there isn't a major tech constraint to do this, I'd be happy to have a go at having a PR open to do this as well (+ having a way to distinguish between direct permissions and propagated (?) permissions through some other relation)

it's surprising it doesn't provide it already..

its not provided because its not really doable in a performant manner: to find all permissions, you'd have to walk backward to every permission and path in the entire schema

sorry @gvf you're right

note that ^ is a structural, reflective walk

Yes, RBAC-like. There are multiple possible 'accessors' of any given resource, (users, organizations etc), I need to be able to fetch all the permissions that an accessor has on a resource (direct and indirect) in order to have different states on the UI and expose different actions to the users

the recommendation right now is to issue a

check

for each permission, in parallel

is there a way to get "only" a particular subject type's permissions?

that's what the ^ reflection issue is about

not exactly that for example, if a user has permissions on resource X, and they are also part of an org that has permissions on resource X, can I retrieve only the permissions that the user has, while not retrieving what they have through the org?

you'd issue a check on the overall permission and the org-only one

gotcha

or, if you're using an RBAC-like schema, you could just see if they have any of the roles

not exactly, that part is for our discovery layer. being able to display content that's been "shared" with just you vs your org

ah. in that case, you'd want to either define a permission that is just the user and check it

yeah thats what I ended up doing.

reader

vs

org_reader

aha

unfortunately my schema seems to be getting more complicated as i have to deal with more accessor types with the same edge cases as others haha

speaking hypothetically: if we added an API that was a check, but returned on which relationship(s)/path(s) the check found the subject had permission, would that solve your problem?>

hmm, wouldn't I have to make a check for every permission either way and then read the path that it went through? unless there was a way to tell the

check

to go through a particular path? sorry not completely able to visualize how it'd work out

in theory, we could turn off short circuiting for it

yeah thats what I was thinking. I'm assuming that parallel checks would be a lot faster

likely, yes

right, thats what I was thinking. and from what I read, the results of each of those branches get cached as well, future requests would be a lot faster?

yep

i can also maintain a secondary cache which gets invalidated based on updates being emitted from the watch service, that should help

just be careful with maintaining a secondary cache: handling arrows is non-trivial

gah yeah. i'm assuming the duration of the cache in spicedb is configurable? i vaguely recall reading 5 seconds as the ttl somewhere but I feel like that would be too low?

its 5s for the quantization window

ah yeah, i need to figure out the correct place to store the zedtoken as well - do you usually suggest storing it along with the resource metadata? or is something else idiomatic there

yes

In our case it's not RBAC, all users have the same role, but we apply rules to some of them. Our app serves content, to when the user lands on a given page, we want to request to the auth system: what grants does this user have for this doc? (it could be: "title", "audio", "pdf", "agenda", "summary" and so on

are these grants represented by `relation`s?

mhh...I'm very new to spicedb...I don't really know, but whatever you suggest is the best option...

normally, no, but sometimes its a combination of relations

ok, I'll try that tomorrow, thxs

thank you! i was able to get the behavior i wanted by readrelationships + keeping a map of relationship to permission in code (would not need this once the reflection API comes out)

that's awesome! thanks for the update