github authzed/spicedb v1.49.0
on GitHub

5 hours ago

Highlights

Support for self keyword added to permissions

Previously, if you wanted to represent something like "a user should be able to view themselves," this required adding a relation to the schema and then writing a relation from the user to itself. We've added support for a self keyword in permissions that represents this directly, which reduces storage requirements, removes the need for a trip to the database, and removes a relationship that needs to be synced.
For more information, see the Docs and the PR: #2785

Experimental

Postgres Foreign Data Wrapper

In #2806, we added a new experimental command to SpiceDB that serves a Postgres Foreign Data Wrapper: spicedb postgres-fdw [flags].
If you configure your Postgres instance accordingly, it can speak to SpiceDB through the FDW as a proxy, allowing you to write queries like: 

-- Check if user:alice has permission to view document:readme
SELECT has_permission
FROM permissions
WHERE resource_type = 'document'
  AND resource_id = 'readme'
  AND permission = 'view'
  AND subject_type = 'user'
  AND subject_id = 'alice';

You can now express checks and lookups as SELECTs and JOINs in your main application code, and you can read, write, and delete relationships using Postgres as the client.
For more information, see the documentation in the repo.

Warnings
  • This feature is experimental. We'd welcome you trying it out and providing feedback, but it will likely change before its final GA'd form.
  • This feature DOES NOT solve the Dual-Write Problem. You can make updates in the context of a Postgres transaction, but Postgres's FDW protocol doesn't support a two-phase commit semantic, which means there are still failure modes where a transactional write will land in SpiceDB but not Postgres or vice-versa.

Query Planner

This release includes the first experimental handle on our new Query Planner. If you run SpiceDB with the new --experimental-query-plan flag, SpiceDB will use the query planner to resolve queries.
This is mostly provided for the curious; there's still work to do on statistics sources and optimizations before we expect that it will provide performance benefits across most workloads.
We don't yet recommend turning on this flag in your system outside of experiments in your local or development environments. We'll continue work and let you know when it's ready for production.

Smaller Things

  • A fix for cockroach's connection pooler where the pooler won't report itself as ready until all connections are ready to be used: #2766
  • A fix for a segfault when providing datastore bootstrap files with caveats in them: #2784
  • Touching an existing relationship and providing an empty expiration field will now clear an existing expiration value in CRDB and MySQL: #2796
  • A fix for lexing Unicode characters in string literals in schemas: #2836
  • We've deprecated datastore hedging, as it didn't provide performance gains and led to a less stable system: #2819
  • There's a new --datastore-watch-change-buffer-maximum-size flag for the Watch API that determines how many changes SpiceDB will buffer in memory before it emits an error. This protects against OOMkills when the backing datastore fails to produce a checkpoint: #2859

What's Changed

New Contributors

Full Changelog: v1.48.0...v1.49.0

Docker Images

This release is available at authzed/spicedb:v1.49.0, quay.io/authzed/spicedb:v1.49.0, ghcr.io/authzed/spicedb:v1.49.0

Check out latest releases or
releases around authzed/spicedb v1.49.0

Don't miss a new spicedb release

NewReleases is sending notifications on new releases.

Get notifications