|
1 | 1 | import { Callout } from 'nextra/components' |
2 | 2 |
|
3 | | -# AuthZed Materialize (Early Access) |
4 | | - |
5 | | -AuthZed Materialize works with AuthZed Dedicated and is inspired by the Leopard index component described in the [Zanzibar paper](https://zanzibar.tech/2IoYDUFMAE:0:T). |
6 | | -Much like the concept of a materialized view in relational databases, AuthZed Materialize supports SpiceDB permissions systems by precomputing permissions defined in your schema. |
7 | | - |
8 | | -By creating a materialized view of your permissions in a relational database, you can efficiently sort, search, and filter massive lists of authorized objects while leveraging the authorization computation capabilities of SpiceDB. |
| 3 | +# AuthZed Materialize |
9 | 4 |
|
10 | 5 | <Callout type="info"> |
11 | 6 | AuthZed Materialize is available to users of AuthZed [Dedicated] as part of an early access program. |
12 | 7 | Don't hesitate to get in touch with your AuthZed account team if you would like to participate. |
13 | 8 | </Callout> |
14 | 9 |
|
15 | | -[Dedicated]: ../guides/picking-a-product#dedicated |
16 | | - |
17 | | -## What Is AuthZed Materialize? |
| 10 | +AuthZed Materialize is inspired by the Leopard index component described in the [Zanzibar paper](https://zanzibar.tech/2IoYDUFMAE:0:T). |
| 11 | +Much like the concept of a materialized view in relational databases, AuthZed Materialize is a service that computes how permissions change after relationships |
| 12 | +are written, when those relationships affect a subject's membership in a permission set or a set’s permission on a specific resource. |
| 13 | +These permissions are then streamed to your client, so that you can store them as a denormalized table, and then do operations like searching, sorting, and filtering much more efficiently. |
18 | 14 |
|
19 | | -Materialize streams computed permission updates to a client. |
20 | | -Updates occur after a relationship is written that affects a subject's membership in a permission set or a set’s permission on a specific resource. |
21 | | -The intent is for users to process these updates and store them to form a precomputed and denormalized view of SpiceDB permissions. |
| 15 | +AuthZed Materialize allows you to: |
| 16 | +- speed up `CheckPermission` and `CheckBulkPermissions` |
| 17 | +- speed up `LookupResources` and `LookupSubjects`, especially when there is a large number of resources |
| 18 | +- build authorization-aware UIs, e.g. by providing a filtered and/or sorted list of more than several thousand authorized objects |
| 19 | +- perform ACL filtering in other secondary indexes, like a search index (e.g. ElasticSearch) |
22 | 20 |
|
23 | | -## When To Use AuthZed Materialize? |
24 | | - |
25 | | -If you need to provide a filtered and/or sorted list of more than several thousand authorized objects or if you need an authorization-aware search index, you probably need Materialize. |
26 | | - |
27 | | -The primary use case for Materialize is to denormalize computed permissions into systems that excel at data retrieval operations like searching, sorting, and filtering. |
| 21 | +[Dedicated]: ../guides/picking-a-product#dedicated |
28 | 22 |
|
29 | | -There are some authorized object listing scenarios where [LookupResources] or [LookupSubjects], without Materialize, can return a response without a large computational cost. |
30 | | -Those scenarios include: |
| 23 | +## Limitations |
31 | 24 |
|
32 | | -1. Paginating through a list of authorized objects without sorting or filtering ([LookupResources] supports cursor-based pagination, but the list of objects is returned in a non-deterministic order) |
33 | | -2. Listing a small set (in the realm of thousands) of ordered or filtered objects. |
| 25 | +If there are: |
34 | 26 |
|
35 | | -If you do make a [LookupResources] or [LookupSubjects] request with a significant computational cost, you can expect the request to be slow and to use a large number of system resources, leading to slower response times for other queries. |
| 27 | +- [Caveats] |
| 28 | +- [Wildcard] subject types |
| 29 | +- [.all] |
36 | 30 |
|
37 | | -## Current Limitations |
| 31 | +on the path of permissions computed by Materialize, it will error out. However, your schema can still include them. |
38 | 32 |
|
39 | | -- [Caveats](https://authzed.com/docs/spicedb/concepts/caveats) are not supported on the path of permissions computed by Materialize |
40 | | -- [Wildcard](https://authzed.com/docs/spicedb/concepts/schema\#wildcards) subject types are not supported on the path of permissions computed by Materialize |
| 33 | +[Caveats]: https://authzed.com/docs/spicedb/concepts/caveats |
| 34 | +[Wildcard]: https://authzed.com/docs/spicedb/concepts/schema\#wildcards |
| 35 | +[.all]: https://authzed.com/docs/spicedb/concepts/schema\#all-intersection-arrow |
41 | 36 |
|
42 | | -You can still use both Caveats and Wildcards, so long they are not part of the path to the permissions you've asked Materialize to query. |
| 37 | +[Dedicated]: ../guides/picking-a-product#dedicated |
43 | 38 |
|
44 | 39 | ## Client SDK |
45 | 40 |
|
|
0 commit comments