SpiceDB language preview

1. A document sharing schema

viewers and editors, with editors implying view access

horizon-dark

definition user {}

definition document {
  relation viewer: user | user:*
  relation editor: user

  permission view = viewer + editor
  permission edit = editor
}

atom-one-dark

definition user {}

definition document {
  relation viewer: user | user:*
  relation editor: user

  permission view = viewer + editor
  permission edit = editor
}

github-dark

definition user {}

definition document {
  relation viewer: user | user:*
  relation editor: user

  permission view = viewer + editor
  permission edit = editor
}

dracula

definition user {}

definition document {
  relation viewer: user | user:*
  relation editor: user

  permission view = viewer + editor
  permission edit = editor
}

nord

definition user {}

definition document {
  relation viewer: user | user:*
  relation editor: user

  permission view = viewer + editor
  permission edit = editor
}

github

definition user {}

definition document {
  relation viewer: user | user:*
  relation editor: user

  permission view = viewer + editor
  permission edit = editor
}

2. An organization with inherited folder permissions

a permission computed through a parent relation with ->

horizon-dark

definition user {}

definition organization {
  relation admin: user
  relation member: user
}

definition folder {
  relation org: organization
  relation viewer: user

  permission view = viewer + org->admin
}

atom-one-dark

definition user {}

definition organization {
  relation admin: user
  relation member: user
}

definition folder {
  relation org: organization
  relation viewer: user

  permission view = viewer + org->admin
}

github-dark

definition user {}

definition organization {
  relation admin: user
  relation member: user
}

definition folder {
  relation org: organization
  relation viewer: user

  permission view = viewer + org->admin
}

dracula

definition user {}

definition organization {
  relation admin: user
  relation member: user
}

definition folder {
  relation org: organization
  relation viewer: user

  permission view = viewer + org->admin
}

nord

definition user {}

definition organization {
  relation admin: user
  relation member: user
}

definition folder {
  relation org: organization
  relation viewer: user

  permission view = viewer + org->admin
}

github

definition user {}

definition organization {
  relation admin: user
  relation member: user
}

definition folder {
  relation org: organization
  relation viewer: user

  permission view = viewer + org->admin
}

3. A caveated relationship

a caveat expression that must evaluate true for the relationship to hold

horizon-dark

definition user {}

definition resource {
  relation viewer: user
  permission view = viewer
}

caveat has_valid_ip(user_ip ipaddress) {
  user_ip.in_cidr("192.168.0.0/16")
}

caveat during_business_hours(current_time timestamp) {
  current_time.getHours() >= 9 && current_time.getHours() < 17
}

atom-one-dark

definition user {}

definition resource {
  relation viewer: user
  permission view = viewer
}

caveat has_valid_ip(user_ip ipaddress) {
  user_ip.in_cidr("192.168.0.0/16")
}

caveat during_business_hours(current_time timestamp) {
  current_time.getHours() >= 9 && current_time.getHours() < 17
}

github-dark

definition user {}

definition resource {
  relation viewer: user
  permission view = viewer
}

caveat has_valid_ip(user_ip ipaddress) {
  user_ip.in_cidr("192.168.0.0/16")
}

caveat during_business_hours(current_time timestamp) {
  current_time.getHours() >= 9 && current_time.getHours() < 17
}

dracula

definition user {}

definition resource {
  relation viewer: user
  permission view = viewer
}

caveat has_valid_ip(user_ip ipaddress) {
  user_ip.in_cidr("192.168.0.0/16")
}

caveat during_business_hours(current_time timestamp) {
  current_time.getHours() >= 9 && current_time.getHours() < 17
}

nord

definition user {}

definition resource {
  relation viewer: user
  permission view = viewer
}

caveat has_valid_ip(user_ip ipaddress) {
  user_ip.in_cidr("192.168.0.0/16")
}

caveat during_business_hours(current_time timestamp) {
  current_time.getHours() >= 9 && current_time.getHours() < 17
}

github

definition user {}

definition resource {
  relation viewer: user
  permission view = viewer
}

caveat has_valid_ip(user_ip ipaddress) {
  user_ip.in_cidr("192.168.0.0/16")
}

caveat during_business_hours(current_time timestamp) {
  current_time.getHours() >= 9 && current_time.getHours() < 17
}