4 ms·

> What's the short summary of how the authorization system works for this? We built a permission system on top of Google's CEL [1]. Every object returned in a

> What's the short summary of how the authorization system works for this? We built a permission system on top of Google's CEL [1]. Every object returned in a query is filtered by a 'view' rule. Similarly, every modification of an object goes through a 'create/update/delete' rule. The docs: https://www.instantdb.com/docs/permissions https://www.instantdb.com/docs/permissions The experience is similar to Firebase in three ways: 1. Both languages are based on CEL 2. There's a distinct separation between data retrieval and access policy 3. You can start on a happy path when developing, and lock down later. AFAIK, Firebase Realtime can be more efficient, as it can tell if a permission check has passed statically. I am not sure if Firestore works this way. We wanted to be more dynamic, to support more nuanced rules down the road (stuff like 'check this http endpoint if an object has permissions'). We took inspiration Facebook's 'EntPrivacy' rules in this respect.

SahAssar 2y ago
> Every object returned in a query is filtered by a 'view' rule. Similarly, every modification of an object goes through a 'create/update/delete' rule. Is that efficient for queries that return many rows but each user only has access to a few? Is there a specific reason to not use something like postgresql RLS that would do the filtering within the database where indexes can help?
- Guillaume86 2y ago
  Yes, reading the essay, that seems like the only "red flag" to me, the rest sound like a dream db. Not being able to leverage permission rules to optimize queries (predicate pushdown) seems like too big a compromise to me. It would be too easy to hit pathological cases, and the workaround would probably be something akin to replicating the permission logic in every query. Is there any plans to improve this?
  - stopachka 2y ago
    Yes, in the near future we plan to convert CEL expressions to where clauses, which we attach to queries. This would push permissions to the query level, like postgres RLS.
    - Guillaume86 2y ago
      Great, and congrats on the launch!
dudus 2y ago
While it seems inflexible at first this system is surprisingly capable and provides great DX, one of the best things about working with firestore.
rockwotj 2y ago
> Firebase Realtime can be more efficient, as it can tell if a permission check has passed statically. I am not sure if Firestore works this way. Firestore's rules are also able to prove before the query runs if the query will only return data that the user has access to according to the rules. That's a pretty important property that "rules aren't filters" because it prevents bad actors from DDOSing your system. My former colleague wrote about this: https://medium.com/firebase-developers/what-does-it-mean-that-firestore-security-rules-are-not-filters-68ec14f3d003 https://medium.com/firebase-developers/what-does-it-mean-tha...

SahAssar 2y ago

> Every object returned in a query is filtered by a 'view' rule. Similarly, every modification of an object goes through a 'create/update/delete' rule. Is that efficient for queries that return many rows but each user only has access to a few? Is there a specific reason to not use something like postgresql RLS that would do the filtering within the database where indexes can help?

Guillaume86 2y ago
Yes, reading the essay, that seems like the only "red flag" to me, the rest sound like a dream db. Not being able to leverage permission rules to optimize queries (predicate pushdown) seems like too big a compromise to me. It would be too easy to hit pathological cases, and the workaround would probably be something akin to replicating the permission logic in every query. Is there any plans to improve this?
- stopachka 2y ago
  Yes, in the near future we plan to convert CEL expressions to where clauses, which we attach to queries. This would push permissions to the query level, like postgres RLS.
  - Guillaume86 2y ago
    Great, and congrats on the launch!

dudus 2y ago

While it seems inflexible at first this system is surprisingly capable and provides great DX, one of the best things about working with firestore.

rockwotj 2y ago

> Firebase Realtime can be more efficient, as it can tell if a permission check has passed statically. I am not sure if Firestore works this way. Firestore's rules are also able to prove before the query runs if the query will only return data that the user has access to according to the rules. That's a pretty important property that "rules aren't filters" because it prevents bad actors from DDOSing your system. My former colleague wrote about this: https://medium.com/firebase-developers/what-does-it-mean-that-firestore-security-rules-are-not-filters-68ec14f3d003 https://medium.com/firebase-developers/what-does-it-mean-tha...