authzed / spicedb

Open Source, Google Zanzibar-inspired database for scalably storing and querying fine-grained authorization data
https://authzed.com/docs
Apache License 2.0
5.11k stars 279 forks source link

wildcard support #1996

Closed pathing closed 3 months ago

pathing commented 3 months ago

Problem Statement

In api authentication, wildcard authentication is often required, for example, resource:/api/v1/user/*#access@user:testuser

Then the user: testuser will has the resource: /api/v1/user/user access permissions

Or is there any other way to achieve this scenario

Solution Brainstorm

No response

vroldanbet commented 3 months ago

👋🏻 My apologies but I'm having difficulties to parse this request. Please try to reframe the question

josephschorr commented 3 months ago

@pathing If you're asking if you can link a subject to all resources of a type, the answer is no. See: https://github.com/authzed/spicedb/issues/346 for why this will likely not be supported; instead, we will likely support static relationships: https://github.com/authzed/spicedb/issues/1266

pathing commented 3 months ago

@pathing If you're asking if you can link a subject to all resources of a type, the answer is no. See: #346 for why this will likely not be supported; instead, we will likely support static relationships: #1266

Thanks for your reply. But what I need to support is that the resource id has a definite prefix and a * representing all resources that support a particular prefix @josephschorr

josephschorr commented 3 months ago

@pathing if your goal is to handle the prefix yourself, you can just encode a representation of a wildcard. Otherwise, take a look at this proposal: https://github.com/authzed/spicedb/issues/1266