authzed / spicedb

Open Source, Google Zanzibar-inspired database for scalably storing and querying fine-grained authorization data
https://authzed.com/docs
Apache License 2.0
4.98k stars 267 forks source link

Add more descriptive subject type error messaging #1939

Closed josephschorr closed 3 months ago

josephschorr commented 3 months ago

Consider a schema:

definition user {}

caveat somecaveat(...) { ... }

definition document {
  relation viewer: user with somecaveat
}

Attempt to write a user without the caveat returns:

rpc error: code = InvalidArgument desc = subjects of type `user` are not allowed on relation `document#viewer`

This is technically correct, because the caveat is part of the subject type, but it can be confusing given lack of context.

We should consider returning more information if the requested subject type is present, but only with a caveat. Maybe even offer suggestion(s) via a "did you mean: ..."