spicedb

document:specificdocument#reader@user:specificuser
|_______________________| |____| |_______________|
        resource         relation     subject

# Docker
docker run --rm -it \
  -p 50051:50051 \
  --name spicedb authzed/spicedb serve \
  --grpc-preshared-key "PSK"

# macOS Brew
brew install spicedb
# --grpc-preshared-key "PSK"
SPICEDB_GRPC_PRESHARED_KEY=PSK spicedb serve

# zed 作为 spicedb 客户端
brew install zed

zed context set local localhost:50051 "PSK" --insecure
zed schema read --insecure

definition user {}

definition organization {
  relation administrator: user
  permission view_all_documents = administrator
}

definition team {
  relation member: user
}

definition document {
  relation owner_org: organization

  relation reader: user | team#member
  relation writer: user

  permission view = reader + owner_org->view_all_documents
  permission edit = view + writer

  relation peek: user | anonymoususer:*
  relation retrive: service#token
}

definition anonymoususer {}

definition token {}
definition service {
    token: token
}