Hi <@897100069558452274> - I believe this is what...
# spicedbd
dsieczko
12/05/2022, 2:31 PMHi @costap - I believe this is what you're looking for
Copy code
definition user {}
definition organization {
relation member: user
permission view_all_contracts = member
}
definition contract {
relation owner: organization
permission view = organization->view_all_contracts
}dsieczko
12/05/2022, 2:45 PMHi @costap
dsieczko
12/05/2022, 2:45 PMSorry - I meant to start a thread
c
costap
12/05/2022, 2:54 PMHi @dsieczko thanks for this, is a bit different that though, at the moment I have something like
Copy code
definition user {}
definition organization {
relation member: user
relation contract_owner: organization
permission edit_documents = contract_owner->member
permission view_documents = member + contract_owner->member
}
definiton document {
relation organization: organization
}costap
12/05/2022, 2:55 PMis just that most times the org is also a contract owner, so endup with a self relation, while a few orgs have other orgs as contract owner
costap
12/05/2022, 2:57 PMinstead i was looking to see if could say "if this org is a contract owner and the user is a member then they can edit if the org is not a contract owner they can only view
d
dsieczko
12/05/2022, 3:15 PMgotcha
Copy code
definition user {}
definition organization {
relation member: user
permission view_all_contracts = member
}
definition contract {
relation owner: organization
relation guest_access: user | user:*
permission view = guest_access + owner->view_all_contracts
permission edit = guest_access & owner->view_all_contracts
}dsieczko
12/05/2022, 3:16 PMThe interesection operator (&) will solve for this i belive
dsieczko
12/05/2022, 3:18 PMhmm actually sorry i'm re reading your statement
dsieczko
12/05/2022, 3:21 PMyea that should do it
dsieczko
12/05/2022, 3:27 PMbut you may not need the owner->view_all_contracts on the view permission
dsieczko
12/05/2022, 3:54 PMafter some internal discussion - to be more semantically correct i updated "viewer" to "guest_access"
c
costap
12/05/2022, 4:48 PMthanks @dsieczko trying to make sense of it 🙂
d
dsieczko
12/05/2022, 4:57 PMsure thing! let me know if you have any questions
dsieczko
12/05/2022, 4:57 PMyou've played around with the playground ?
dsieczko
12/05/2022, 4:57 PMc
costap
12/05/2022, 5:29 PMyep I have 🙂 great tool!
costap
12/05/2022, 5:29 PMI suppose what i'm missing is how do I plug this into the organization resources, like documents in my case
costap
12/05/2022, 5:30 PMas what i need to verify is permissions on those resources rather then the contract
costap
12/05/2022, 5:33 PMand i would like to avoid linking all resources to the owner of contract org and the they already liked through the orgs
d
dsieczko
12/05/2022, 5:52 PMsorry can you breakdown all of the objects you need to define?
dsieczko
12/06/2022, 1:31 PMHi @costap! Let me know if you have any other schema questions - happy to help!
c
costap
12/07/2022, 10:15 AMHi @dsieczko Im sorry i didn't get back to you. I wanted to put up a basic example in playground and share but other things got on the way yesterday. will share something soon
costap
12/07/2022, 10:42 AMd
dsieczko
12/07/2022, 9:53 PMThanks @costap ! Have a look at this https://play.authzed.com/s/5PXE00W2RX_U/schema
dsieczko
12/08/2022, 11:00 AMAlso @costap take a look at this one my colleague put together https://play.authzed.com/s/phQvCwMqYfpb/schema
c
costap
12/08/2022, 11:16 AMThanks! This will work, I think i was trying to see if there was a way to avoid linking the owner to every doc and is only the same for each guest org, if that makes sense
d
dsieczko
12/09/2022, 5:33 PMHey! Sorry - this thread got lost for me.
dsieczko
12/09/2022, 5:34 PMA doc will always have an owner right?
2 Views