2 ms·

Authorized search isn't difficult. Store authorized readers (people, groups, etc) on each result to pre-filter results, then post-filter results with an additio

Authorized search isn't difficult. Store authorized readers (people, groups, etc) on each result to pre-filter results, then post-filter results with an additional authorization check in case the authorization store was updated but the search results store was not. Context: I've built an authorized search solution before.

fleahunter 1y ago
[flagged]
- jschorr 1y ago
  > I remember building a project where we kept a mapping table of users to permissions for quick lookups, but man, it got messy with data updates. Yep, as I mentioned above, its not an easy problem but once it is solved for you, it becomes "just" watching the events and performing the JOINs. > especially if we could create an extension for other databases See my video I linked above about the Postgres FDW: It does exactly this for SpiceDB and works seamlessly as-if there is a denormalized permissions table sitting in your Postgres, while still supporting the full array of complex authorization rules found in ReBAC.
  - babelfish 1y ago
    Joey is the man and the domain expert on this for sure :-)
    - jschorr 1y ago
      Happy to answer any other questions :D
- ants_everywhere 1y ago
  > I remember building a project where we kept a mapping table of users to permissions for quick lookups, but man, it got messy with data updates. Do you mean literally users to permissions? Usually users map into groups, groups are subgroups of each other, and permissions are granted to groups. So you can only see the financial data if you're in financial-report-preparers. Can Bob see the report? That depends on if he's an indirect or direct member of financial-report-preparers. This is different from RBAC where Bob might have an admin or manager role directly. If he has admin access it's because he's a member of a certain group of employees that's a subgroup of another group of employees who all have admin access etc. similarly for groups of end users. It would be a combinatorial explosion to try to enumerate the permissions of a given user. If people are having lot of syncing problems they may not have granular enough groups. Groups make it safe. Groups are best.

fleahunter 1y ago

[flagged]

jschorr 1y ago
> I remember building a project where we kept a mapping table of users to permissions for quick lookups, but man, it got messy with data updates. Yep, as I mentioned above, its not an easy problem but once it is solved for you, it becomes "just" watching the events and performing the JOINs. > especially if we could create an extension for other databases See my video I linked above about the Postgres FDW: It does exactly this for SpiceDB and works seamlessly as-if there is a denormalized permissions table sitting in your Postgres, while still supporting the full array of complex authorization rules found in ReBAC.
- babelfish 1y ago
  Joey is the man and the domain expert on this for sure :-)
  - jschorr 1y ago
    Happy to answer any other questions :D
ants_everywhere 1y ago
> I remember building a project where we kept a mapping table of users to permissions for quick lookups, but man, it got messy with data updates. Do you mean literally users to permissions? Usually users map into groups, groups are subgroups of each other, and permissions are granted to groups. So you can only see the financial data if you're in financial-report-preparers. Can Bob see the report? That depends on if he's an indirect or direct member of financial-report-preparers. This is different from RBAC where Bob might have an admin or manager role directly. If he has admin access it's because he's a member of a certain group of employees that's a subgroup of another group of employees who all have admin access etc. similarly for groups of end users. It would be a combinatorial explosion to try to enumerate the permissions of a given user. If people are having lot of syncing problems they may not have granular enough groups. Groups make it safe. Groups are best.