authzed / spicedb

Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications
https://authzed.com/docs
Apache License 2.0
4.92k stars 264 forks source link

[enhance] Add Constant support for permission or ObjectId #856

Open pathing opened 1 year ago

pathing commented 1 year ago

such as:

definition role{ permission admin_pages = "UserManagement" + "ProductManagement" + "OrderManagement" permission pmc_pages = "ProductManagement" + "OrderManagement" }

and, role:1#admin_pages: ["UserManagement", "ProductManagement", "OrderManagement" ]

or Whether the current version achieve the above requirements

vroldanbet commented 1 year ago

@pathing I'm not sure I fully grasp the request but it seems like this request is at odds with the fundamental design of Zanzibar, where a graph of relations is defined.

You can see how is done in this blog: https://authzed.com/blog/user-defined-roles/

vroldanbet commented 1 year ago

I perhaps hit the close button to quickly here 😅 my apologies! After some discussion with the team, there could be scenarios where constants could come handy in the schema language, just not sure if that's what you need in your particular example.

Could you describe what you are trying to achieve?

pathing commented 1 year ago

Thank you for your reply! ObjectId is a user-defined value in the current version. But I think it could be a enumeration variable in the schema file. For example, I define "definition role{}" and "definition page{}", and I want to make the role named Engineer to have page:user_management_interface permission. I think this permission is best defined in the schema file rather than initialized in the program.

josephschorr commented 1 year ago

See also https://github.com/authzed/spicedb/issues/1266