schema question docs say ```Relations can also contain refer SpiceDB #spicedb

schema question: docs say ```Relations can also "...

fierro9418

02/07/2023, 11:15 PM

schema question: docs say

Copy code

Relations can also "contain" references to other relations/permissions.

For example, a group's member relation might include the set of objects marked as member of another group, indicating that the other group's members are, themselves, members of this group:

definition user {}

definition group {
    /**
     * member can include both users and *the set of members* of other specific groups.
     */
    relation member: user | group#member
}

fierro9418

02/07/2023, 11:27 PM

how would you represent a relation that is a composite of other relations defined on the same object. That example is effectively saying "a member of this group can be a user or a member of another group" I want to express something like the following:

Copy code

definition container {
    relation viewer: user
    relation writer: user
    relation member: viewer | writer
}

I want a member to be defined as the union of the set of viewers and writers on this and only this object I could obviously do

Copy code

definition container {
    relation viewer: user
    relation writer: user
    relation member: container#viewer | container#writer
}

but I don't want it to be true that any other container's viewer could be a member of this container

Joey

02/07/2023, 11:53 PM

permission member = viewer+ writer

Joey

02/07/2023, 11:53 PM

if it’s always the case

Joey

02/07/2023, 11:54 PM

If not, the design above is the best approach

fierro9418

02/08/2023, 12:04 AM

yeah was hoping to avoid modeling

member

as a permission, since it's not really a capability, rather a relationship

Joey

02/08/2023, 2:02 AM

well, it is a relationship

Joey

02/08/2023, 2:02 AM

its just a synthetic one

Joey

02/08/2023, 2:02 AM

which is what a

permission

fierro9418

02/08/2023, 2:23 AM

hmm ok. It's not intuitively clicking for me why supporting

relation member: container#viewer | container#writer

either isn't feasible, wouldn't be a good idea if it were feasible, or is just nonsensical haha

Joey

02/08/2023, 2:25 AM

you can do that

Joey

02/08/2023, 2:25 AM

its supported

Joey

02/08/2023, 2:25 AM

but it can be any container

Joey

02/08/2023, 2:25 AM

and if it is just saying "member is viewer and writer"

Joey

02/08/2023, 2:25 AM

then that's what permission is for

fierro9418

02/08/2023, 2:31 AM

woops sorry, yeah I meant

relation member: viewer | writer

, the version that would be "scoped" to the current container. But ok, sounds like I need to update my mental model of the difference between relations and permissions.

Joey

02/08/2023, 2:35 AM

relation

is a defined data-based relationhip

Joey

02/08/2023, 2:35 AM

permission

is a synthetic relationship

fierro9418

02/08/2023, 2:35 AM

ok I think I get it! A permission is a computed set of concrete relationships. A relation merely defines the blueprint for which types can relate to other types. I was confused because I was thinking of permission as a synonym for "capability" or "action" when it's actually just a label for a set of relationships, which is what I was trying to express via

relation member: viewer | writer

Joey

02/08/2023, 2:35 AM

yeah

Joey

02/08/2023, 2:36 AM

we named it

permission

because that's how it is commonly used

Joey

02/08/2023, 2:36 AM

permission is_member = viewer + writer

would be more accurate naming

Joey

02/08/2023, 2:36 AM

and with that name, it makes sense: a user is_member if they are a viewer or writer

fierro9418

02/08/2023, 2:37 AM

makes sense. ty sir

5 Views

Previous Next