authzed / authzed-rb

Official SpiceDB client library for Ruby

Authzed Ruby Client

This repository houses the official Ruby client library for Authzed and SpiceDB.

SpiceDB is a database system for managing security-critical permissions checking.

SpiceDB acts as a centralized service that stores authorization data. Once stored, data can be performantly queried to answer questions such as "Does this user have access to this resource?" and "What are all the resources this user has access to?".

Authzed operates the globally available, serverless database platform for SpiceDB.

Supported client API versions:

• v1

You can find more info about the API in the Authzed Documentation API Reference or the Authzed API Buf Registry repository.

See CONTRIBUTING.md for instructions on how to contribute and perform common tasks like building the project and running tests.

Getting Started

We highly recommend following the Protecting Your First App guide to learn the latest best practice to integrate an application with Authzed.

If you're interested in example uses of the API, see the spec files in the spec directory.

Basic Usage

Installation

This project is packaged as the gem authzed on Ruby Gems.

The command to install the library is:

gem install authzed

Initializing a client

In order to successfully connect, you will have to provide a Bearer Token with your own API Token from the Authzed dashboard in place of t_your_token_here_1234567deadbeef in the following example:

require 'authzed'


client = Authzed::Api::V1::Client.new(
    target: "localhost:50051",
    credentials: :this_channel_is_insecure,
    interceptors: [Authzed::GrpcUtil::BearerToken.new(token: "somerandomkeyhere")],
)

Performing an API call

require 'authzed'

# Is Emilia in the set of users that can read post #1?
resp = client.permissions_service.check_permission(
  Authzed::Api::V1::CheckPermissionRequest.new(
    consistency: Authzed::Api::V1::Consistency.new(
      at_least_as_fresh: Authzed::Api::V1::ZedToken.new(token: zed_token)
    ),
    resource: Authzed::Api::V1::ObjectReference.new(object_type: 'blog/post', object_id: '1'),
    permission: 'read',
    subject: Authzed::Api::V1::SubjectReference.new(
      object: Authzed::Api::V1::ObjectReference.new(object_type: 'blog/user', object_id: 'emilia')
    )
  )
)
can_read = Authzed::Api::V1::CheckPermissionResponse::Permissionship.resolve(resp.permissionship) ==
  Authzed::Api::V1::CheckPermissionResponse::Permissionship::PERMISSIONSHIP_HAS_PERMISSION

authzed-rb's Issues

Protobuf import path issue

Warning: Protobuf detected an import path issue while loading generated file /usr/local/rvm/gems/ruby-3.1.4/gems/authzed-0.7.0/lib/authzed/api/v1/core_pb.rb
Each proto file must use a consistent fully-qualified name.
This will become an error in the next major version.
Warning: Protobuf detected an import path issue while loading generated file /usr/local/rvm/gems/ruby-3.1.4/gems/authzed-0.7.0/lib/authzed/api/v1/schema_service_pb.rb
Each proto file must use a consistent fully-qualified name.
This will become an error in the next major version.
Warning: Protobuf detected an import path issue while loading generated file /usr/local/rvm/gems/ruby-3.1.4/gems/authzed-0.7.0/lib/authzed/api/v1/watch_service_pb.rb
Each proto file must use a consistent fully-qualified name.
This will become an error in the next major version.
Warning: Protobuf detected an import path issue while loading generated file /usr/local/rvm/gems/ruby-3.1.4/gems/authzed-0.7.0/lib/authzed/api/v1/permission_service_pb.rb
Each proto file must use a consistent fully-qualified name.
This will become an error in the next major version.
Warning: Protobuf detected an import path issue while loading generated file /usr/local/rvm/gems/ruby-3.1.4/gems/authzed-0.7.0/lib/authzed/api/v1/experimental_service_pb.rb
Each proto file must use a consistent fully-qualified name.
This will become an error in the next major version.

Dependencies:

• rails 7.1.1
• google-protobuf (3.24.4-aarch64-linux)
• google-protobuf (3.24.4-arm64-darwin)
• google-protobuf (3.24.4-x86_64-linux)
• grpc (1.59.2)
• grpc-tools (1.59.2)

README parity with other clients

Add CI for publishing a gem

Please Add `LookupResources` Example

It's not clear how to interact with the stream-based responses. Can you please add an example that includes LookupResourcesRequest and LookupResourcesResponse and fetches a list of resources?

Use buf remote plugins for generation

When the BSR supports it, our buf.gen.yaml should use remote plugins.

Add examples

This client library needs examples for each version of the API and to be included in the Protecting Your First App doc

Integrate validate.proto codegen with main codegen

#79 fixes codege by vendoring validate.proto and generating it directly.

There should be a way to integrate the generation of the validation code with everything else with buf, something along the lines of https://buf.build/docs/how-to/replace-protoc-with-buf#doc-content