spicedb
spicedb copied to clipboard
authzed
Implement AfterResponseCursor in LookupSubjects
Problem Statement
Hello,
I propose that included in the response to LookupSubjects is an AfterResponseCursor that behaves just as it does in LookupResources. Looking at the service, it is clear that this is implemented in LookupResources but not LookupSubjects. I'm not familiar with the underlying setup so I'm not sure what the reasoning is behind this, but I suspect it is a similar reason to the non-support of concrete limits here.
In my application we are trying to show a list of subjects/users that have a given permission on a resource, to help users understand the underlying permission system better and for auditing purposes. This is easy the other way around, since LookupResources supports cursor pagination, but can cause real problems for LookupSubjects since the whole set is returned each time. I'm working around this in the application code but it isn't ideal.
I thought I'd post here since based on the protobuf definitions, LookupSubjects is intended to support cursors as well.
First time posting an issue here, so please don't hesitate to let me know if there's anything else I can provide to help with a decision.
Thanks.
Solution Brainstorm
I'm not familiar enough with the codebase yet to suggestion a solution, but I'll happily look into it if this gets traction.
This was attempted in https://github.com/authzed/spicedb/pull/1379, and turned out to not be possible using that approach.
Unfortunately, at this time, we're still in the discussion phase as to what the solution (if any) there is to properly support limits on LookupSubject.
This was attempted in #1379, and turned out to not be possible using that approach.
Unfortunately, at this time, we're still in the discussion phase as to what the solution (if any) there is to properly support limits on LookupSubject.
thanks for pointing that out, @josephschorr. is there an active issue i should keep tabs on or will this proposal be left open?