spicedb
spicedb copied to clipboard
Zed --explain flag uses cached results
What platforms are affected?
macos, others
What architectures are affected?
others
What SpiceDB version are you using?
v1.35.3
Steps to Reproduce
In Zed, the --explain flag makes use of cached results, even with the --consistency-full
flag set.
This makes it hard to get a full trace of how a permission decision was calculated.
For example, running the same permission check twice gives differed answers each time -
❯ zed --insecure permission check --explain timesheet:1 read_timesheet user:123 --consistency-full
4:00PM INF debugging requested on check
true
✓ timesheet:1 read_timesheet (2.347208ms)
└── ✓ engagement:3 read_timesheet (1.806125ms)
├── ⨉ engagement:3 supplier_for_attribute (994.125µs)
├── ⨉ engagement:3 manages_attribute (1.536667ms)
└── ✓ engagement:3 self_attribute (1.711417ms)
└── ✓ person:2 user (1.196667ms)
└── user:123
❯ zed --insecure permission check --explain timesheet:1 read_timesheet user:123 --consistency-full
4:00PM INF debugging requested on check
true
✓ timesheet:1 read_timesheet (cached)
└── user:123
I see the same behaviour when using the grpc api from a java client with the 'debug' flag set. My desired behaviour is an explanation of the permission checking path that can be displayed to a user.
Expected Result
A full permissions check trace each time.
Actual Result
The explanation for the second permission check is minimal.