general

[dawn gorge]

Hello, does anybody know if permify next steps are set?

[untold imp]

Hi @dawn gorge, couldn’t understand the question, can you elaborate a little bit.

[dawn gorge]

Sure, I want to know what are the next features. I've just started to use permify and I want to know what to expect in the short term

[untold imp]

You can find the public roadmap on https://github.com/orgs/Permify/projects/1

Also we’d love to learn your use case and help out in anyways. Feel free to schedule a call from my calendar: https://meetings-eu1.hubspot.com/ege-aytin

[dire moss]

what is the error "ERROR_CODE_SCHEMA_NOT_FOUND" in the Playground? I get it a lot and assume I'm doing something wrong as I'm still learning, but have not figured out quite what I'm doing wrong...

[untold imp]

Hi @dire moss, probably you're not doing anything wrong because I'm getting the same error right now, we're on it. I have created an issue you can track the progress on there: https://github.com/Permify/permify/issues/270

[upbeat tundra]

Hi @untold imp , IMO in play ground , the data authorization part should be scrollable my bad

[upbeat tundra]

hi @untold imp , i am creating some relatioship using api, I wonder for few relatiopship i can leave subject's relation emplty, but for few relationship i can not as it throws error. On the other hand in playground for both the cases subject's relation is left empty. can you tell me why is this so?

[wintry eagle]

Sorry, for cross-posting, but I think this might be an interesting case for the audience here as well 🙂 https://github.com/Permify/permify/discussions/333

[untold imp]

Hi @wintry eagle, no worries at all, thanks for sharing actually ✌🏻

[tacit mountain]

how do i secure the connection with jwt
basicly generate the random token and post request page is login it. this big mistake how can i fix?
so i want to token check is vaild.

sorry my english :S

just i check the have token in local storage if have yo can go. like that but this a big vulnabilty for access the auth page.

@untold imp @vagrant lichen

[untold imp]

Hi @tacit mountain, assuming that you're coming from the "JWT Authentication in React" post. We just create that post for demonstration purposes and yes you should consider more secure options for storing your tokens, such as session storage and cookies.

[fathom coral]

It looks like there is a broken link in the documentation:

https://docs.permify.co/docs/getting-started/modeling#common-use-cases -> Link in the paragraph leads to a 404

https://docs.permify.co/docs/example-use-cases

I am unsure where it is suppose to go in the documentation since there is a parent use-case.md and a folder use-cases that doesn't have an index so I didn't want to submit a PR without knowing the intent

[untold imp]

Hi @fathom coral, thanks for informing, link slug should be “/use-cases” instead of “/example-use-cases”. We’re fixing it right now.

[long geode]

hi im ali
can i talk to anyone who has experience in handling permission and privilege management with premify ?
i mean permify by defualt is handling authorization with user id and entity id but i need to handle it by just entity types
i would appreciate a voice chat with anyone is experienced with this
tnx in-advance

[untold imp]

Hi @long geode, I’m not sure that i understand your ask here, can you elaborate a little

[west yew]

Hi is there a way to store a description to the action? We want to show the users a friendly name not the action name from the schema? We would have to store it externally and splice in for UI purposes.

[untold imp]

Hi @west yew, I'm not 100% sure I understand your question, but you can enter comments as action descriptions and retrieve them accordingly from a stored schema. Could that solve the issue?

[west yew]

for example a permission could be viewAudits but the description would be View Audits. Can you provide example of having it in a comment?

[untold imp]

@west yew Yes, example looks similar like this. Is that could solve the issue ?

[hushed ruin]

Hi @untold imp I am getting Error: unknown flag: --database-name when setting up on k8s
how can I pass the database name to permify

[vagrant lichen]

Hi @hushed ruin , this is a leftover flag from a previous version. Instead of using this flag, we now add the database name to the end of the database-uri. For example:

—database-uri postgres://postgres:secret@localhost:5432/db_name

[fathom coral]

Is there a way to run the Data Filtering in the permify-validate function? I know I can model out all the assertions individually but it would be nice to be able to say

assertions:
 - "which organization user:1 can view": ["O1","O2","O3"]

[untold imp]

Hi @fathom coral, we dont have that right now. Could you please open an issue, we can add this to our roadmap

[fathom coral]

Are there thoughts about adding a policy coverage to the permify validate capability? With any authorizations the permutations are immense but you should be able to see (due to being able to build the graph) if all the assertions cover all the graphs leaf nodes

Also, would be nifty to see an IDL parser for permify that would generate the entity/relation stubs for assertions to ensure that all of the paths are covered

[fathom coral]

on my list 😄

[fathom coral]

Another thought - are there plans to create a test framework that expands on what is already in validate that would allow those many permutations to be controllable instead of a new line for every scenario?

assertions:
  - "user:1 view thing:1": true

becomes very tedious when you have many user types (like, user, company, team, group) or actions (view, edit, manage, delete, etc) that doing a structure like this may lessen the overall burden of duplicating statements to change 1 piece of it

assertions:
  - entity: "user:1"
    checks:
      - "view" : true
      - "edit" : false
    subject: "thing:1"

[fathom coral]

Would also be nice to be able to pass in multiple entities on a subject or many subjects to an entity to reduce copy/pasta/modify (I am sitting at 60 assertions in our model atm, could be like 5 entries with multiple checks per entry)

[vagrant lichen]

Hey @fathom coral , thank you for your valuable feedback. We've created issues for each of these suggestions, and you're welcome to review them and follow the progress. Here are the links:

• https://github.com/Permify/permify/issues/422
• https://github.com/Permify/permify/issues/421
• https://github.com/Permify/permify/issues/420

[tacit mountain]

Hi, If I write same relationship tuple again to permify (API Endpoint ={{permify-host}}/v1/tenants/{{tenant_id}}/relationships/write)
It returns 400 Bad Request and below response

    "code": 3,
    "message": "ERROR_CODE_UNIQUE_CONSTRAINT",
    "details": []
}```
Is there a way to configure permify to make these writes idempotent? Thanks!

[vagrant lichen]

Write Relationships

[iron cove]

Hey all! Has anyone ever tried to deploy Permify on Render? Would absolutely love to hear any tips and tricks 🙂

[compact wigeon]

Permify Render Deployment

[tacit mountain]

Hi we are getting the following errors when checking the permissions - any idea?

{"code":13,"message":"ERROR: function max(xid8) does not exist (SQLSTATE 42883)","details":[]}`

[olive egret]

I thought that the Visualizer of NOT operator is not correct. Using the "RBAC" example from online playground, if you change the line 12 at part ...(member not agent) to ... (agent not member), the visualizer is not indicating correct logic behind this logic check. Is it normal or just me?

[true grotto]

Not Operator Visualizer Issue

[olive egret]

I'm reading the example of Google Docs Simplify at https://docs.permify.co/docs/getting-started/examples/google-docs. At the definition of group entity, i saw that the relation "manager" and "direct_member" use the group@.., is this recursive definition? Or just typo error on scheme? Thanks.

[steel girder]

Hey All, Looking for some discussion around

If in case the Authorization Model changes in the near future based on few requirement update, then the challenge which I could see here is, the RELATION gets removed/updated/added and hence the the Relationship Tuples may set Invalid in this case for existing data in RELATIONSHIP TUPLES?

Secondly, Is there a way to create REALTIONSHIP TUPLES automatically using the concept of Authorisation Model/Config BUT being sure that the Identities and objects are present to the Authorisation System. Trying to compare the real time use case of Google Drive Concept.

Thirdly, any articles relating to the Data in flow from an Authentication to Authorisation?

[vagrant lichen]

Hey All Looking for some discussion

[grave tendon]

Hello everyone, im just started to learn the Permify Tool and I want to implement it in my Angular/SpringBootJava Project. Someone have an example, media or videos related to implement Permify in those languajes and frameworks?
Thank you and have a good day!

[olive egret]

Team, can you share the progress of Mysql writedb implementation with us?

[true grotto]

Hey @olive egret

Yes absolutely we have Mysql support in our roadmap. But it’s unfortunately a low priority item. Yet we’re open to any collaboration and contribution to push it faster. So, if it’s a priority item for you feel free to schedule a call from here: https://meetings-eu1.hubspot.com/fred-dogan/customer-discovery

[true grotto]

Hey @grave tendon ,

Unfortunately we don’t have tutorials for those languages but feel free schedule an onboarding call from the link below. We would love to help you setting up Permify.

https://meetings-eu1.hubspot.com/fred-dogan/onboarding-call

[olive egret]

I found a bug on /healthz endpoint. I enable the preshared authn method, even after I passed the Authorization Bearer with preshared key, its still send error "ERROR_CODE_MISSING_BEARER_TOKEN"

On the normal api, such as List tenancy, it's work normally with Authorization Header

[vagrant lichen]

I found a bug on healthz endpoint I

[long geode]

hi
using this code
perm, err := permifyClient.Permission.Check(context.Background(), &v1.PermissionCheckRequest{
TenantId: "saas",
Metadata: &v1.PermissionCheckRequestMetadata{
Depth: 11,
SchemaVersion: "",
SnapToken: "",
},
Subject: &v1.Subject{
Type: "user",
Id: "3bf80393-d3c4-419b-bc0c-8e15f2299d99",
},
Entity: &v1.Entity{
Type: "be_auth_authorization",
Id: "be_auth_authorization",
},
Permission: "",
})

im getting this error
rpc error: code = InvalidArgument desc = invalid PermissionCheckRequest.Metadata: embedded message failed validation | caused by: invalid PermissionCheckRequestMetadata.Depth: value must be greater than or equal to 3

but im passing depth but it wont work

[vagrant lichen]

im getting this error

[median gust]

permify.co is causing and endless loop fyi @compact wigeon

[toxic herald]

Hi, I'm newbie using permify. I wonder how the permify can dynamically change the Schema. I mean, if I want to add new role or new action, then I cannot patch or update the existing one but need to create new one, right? there is any other solution?

seem, it is hard for end user who are non-tech, can customize the authorize.

[vagrant lichen]

Access Management Dashboard

[slate jewel]

Hello Folks

I need some help here. The "write" API for "Relationship" ( http://localhost:3476/v1/tenants/t1/relationships/write ) was working perfectly fine on Postman. But now, I am suddenly getting an error and I can't figure out what could the problem be.

{
"code": 5,
"message": "Not Found",
"details": []
}

I know for sure that I ran "Read" and "Delete" operations on "Relationship" API and I got the above error. After this, it stopped working even for "Authorization schemas".

Has anybody got this problem before?

[slate jewel]

Hello Folks

I got a question with respect to scale. We are planning to use Permify across 10 universities in India and some of the biggest brands ( https://www.manipalgroup.com/memg.html , https://www.spjimr.org/, etc) .

We are talking about hundred thousand students every year along with about 5000 faculties and other admin personals.

Do we have performance/scale metrics so far? If so, can you please share your findings.

[true grotto]

Permify performance and scalability

[strong zealot]

Hey i'm looking to integrate Permify into my app built on Azure but found the docs missing (https://docs.permify.co/docs/installation/azure). Do y'all have updated docs for Azure?

[ornate kiln]

HI All
i am facing a bad gateway error under permission check
Pls help me out with this
This is the API-https://loadtest.permify.co/v1/tenants/t1/permissions/check

[untold imp]

Hi @ornate kiln, this is our own test link and it's quite normal for you to encounter a bad gateway error when you try to access it.

[ornate kiln]

Hi @untold imp ,
Thanks for the response
I got it from Permify official documentation

[ornate kiln]

This is my schema i have created tuple for this ,you can see them both ,now i need a syntax to check the created tuple ,Please help

[untold imp]

Playground Enforcement

[ornate kiln]

For example:
"entity user {}

entity folder{
relation owner @user @organization#employee @organization#admin
relation roles @organization

action create_folder = owner 
action view_folder = roles.founder or roles.employee or roles.admin 
action edit_folder = create_folder or roles.admin

}
entity organization {

relation employee @user
relation founder @user
relation admin @user

}
"
i need to check whether the Founder, employee or amin have the acces to use the View_Folder
in check

[rocky crest]

👋 Hello, I have a question about the two-phase commit approach (https://docs.permify.co/docs/api-overview/relationship/write-relationships#two-phase-commit-approach), is it really a good practice to call an external API in a transaction? Isn't there a risk to increase contention on the DB?

[vagrant lichen]

Database Transactions & API Calls: Exploring Options

[thick abyss]

👋

[junior mauve]

Hi everyone. I was wondering where can I find the pricing plans and differences between paid and free plans. Thanks!

I was also wondering if it's possible to install the playground offline/on-premise.

[true grotto]

Hey @junior mauve ,

Thanks for the questions simply you can use our open-source system for free by managing the infrastructure yourself.

Also, we offer on-premise setup with enterprise support, additional tools and dashboards.

Like thread detection, more advanced version of playground, governance dashboard as an control plane for bigger engineering teams.

Would love to discuss more about your needs, we can schedule a call from this link if you have few minutes coming weeks:

https://meetings-eu1.hubspot.com/fred-dogan/call-with-an-expert

[dawn trench]

Are there any course (paid/free) to use it for production environments with best practices for NodeJS?

[terse carbon]

When will you have a managed cloud version and what do you think pricing will look like?

[true grotto]

Hey @dawn trench ,
I’m not sure if I understood correctly. Are you looking for tutorial or courses to implement Permify with NodeJS?

[dawn trench]

I am looking for indepth guide to implement it in production environments.

[true grotto]

Understood, so we don’t have a course or tutorial specifically created for NodeJS but we have documentation around how to deploy on different cloud providers: https://docs.permify.co/docs/installation

Also, if we can understand your use case and requirements better, we can point you to the right best practices.

So feel free to schedule a first free call with one of our experts: https://meetings-eu1.hubspot.com/fred-dogan/call-with-an-expert

[dawn trench]

Sure thanks

[storm yew]

Is the second docker command here a typo with -p 8080:8080?

[untold imp]

Potential Typo in Docs

[grave tendon]

Hello everyone, someone have documentation of how implement Permify with Spring Boot?

[true grotto]

Unfortunately we don’t have a documentation for spring boot. But Permify can be implemented with anything as a container app/service.

You can find more details over here: https://docs.permify.co/docs/installation

[long geode]

hi every one im using attrs this is my schma :

entity user {
    attribute is_admin  boolean
    attribute is_user  boolean   

}

entity be_auth_user {
 
       
    relation account_owner @user


    action generate_admin_token = account_owner and account_owner.is_admin

}

entity be_vehicle_vehicle {
   relation vehicle_owner @user

   action delete_vehicle = vehicle_owner or vehicle_owner.is_admin
}

in permify playground its working and completly understands my logic but when i tried it in my local permify it returns this error :
{
"code": 2,
"message": "36:68: undefined relation reference",
"details": []
}

the error is about using attrs in Hierarchical atributes is it possible to do this with permify if its not possible so why play ground understands this code but locally i cant do this

[untold imp]

Cross Attribute Call

[wicked haven]

This function cannot be found in playground

[true grotto]

@wicked haven We just updated our playground yesterday. You can just use the Enforcement section with following the same steps as in the Validation section in our docs

For refrence: https://docs.permify.co/docs/getting-started/testing/

[wicked haven]

😄

[jovial lion]

Wanted to ask; would it be safe to rely on the Postgres schema as part of setting up RLS? Are there others [in here] doing the same? I wonder if it would make sense to mimic the api as PL/SQL in order to simplify the policy rules. Right now I just do basic selects 🤔

[vagrant lichen]

Postgres RLS

[nova vortex]

@untold imp ooo umm hahaha sorry this is probs a bit of a stupid question, but what's the difference between authentication and authorization here i have always used them interchangeably i did not know there was a difference lol

[rocky crest]

What are the differences between spicedb and permify? Both projects seems so similar in features and roadmap, why would I use one or the other?

[main jackal]

Hi everyone, since 0.7.0 was posted yesterday, is there a list of breaking changes anywhere?

[plain sail]

Hello I came across this permify issue and would like to contribute
https://github.com/Permify/permify/issues/838

[untold imp]

Contribution

[fallow laurel]

Question on retrieving lists. Given a complex operating model for an enterprise application, how does one leverage this approach when filtering lists? For example, owner, editor, commenter, etc have access to millions of datapoints. How would one incorporate this offering into the filtering logic for displaying rows of data in a webapp? I get the individual check use case, but I want to understand how this is viable when your domain is millions of records.

[untold imp]

Question on retrieving lists

[sullen token]

Hi, all. I have a rather typical use case that I'm trying to wrap my head around in Permify (maybe because I need to figure it out in my head a bit more). Would love some input.

Basically, I have a SAAS application, where each user can have a predefined role in their tenant. I want the roles to have the same effect between tenants (f.ex, admins on a tenant can rename their tenancy). However, I need to add sub-objects underneath that tenant, whose access is controlled by RBAC as well.

I assume this is a fairly typical layout for permissions in SaaS applications. Is there any documentation for how to implement this (sanely) in Permify?

[tame yoke]

Hi, which endpoint can I use to edit an existing attribute's value? Would be really helpful if someone could share a sample cURL as well

[vagrant lichen]

Update attribute

[untold imp]

Use Case

[terse linden]

Hello, it is possible apply filter and order command in a resource list? For example, I would like to retrive a resource based on a attribute (e.g., name)?

[untold imp]

Retrieve resources based on attribute

[peak elk]

Hello, we are trying permify. I was concerned with schema changes, is there a way to perform migration on permify ? (Migration like on relational db for example)

[untold imp]

Schema Migration

[jovial lion]

heads up; i believe this repo is missing the v1 tag (only has v1.0.0): https://github.com/Permify/permify-validate-action

[indigo walrus]

Hey all. I have put together a very simple POC using supabase/gotrue as the auth layer. I'm now wanting to look at permissions and came across permify.

Looking at the docs: https://docs.permify.co/docs/api-overview/schema/write-schema/

client.schema.write({
    tenantId: "t1",
    schema: `
    ...
    `
}).then((response) => {
    // handle response
})

It's awesome that multitenancy is supported out of the box. As my saas requires that. However, in my poc I'm able to create roles and resources, then a policy is created when a combination exists. Which I'm then able to match permissions against and finally match a role to a user.

How would this be handled with Permify? Do I have to create the schema (from my db) every time I make a subtle change and apply it to Permify? Or am I able to do fine tune changes, say create/delete a user, create/delete a resource, create/delete a relation? etc

My use case is that the resources will be fixed to the User. It's really the Roles, Permissions and Users will be handled by them and the "Admin" will be determining access via the (poc) GUI.

Thanks!

[untold imp]

simple Permify POC

[long geode]

hi everyone in play ground there is a copy button that when i click gives me a formated version of my schema that i can pass to permify
there is any golang code that does this formating for me?

[vagrant lichen]

Schema Formatting

[craggy viper]

Hello. Are there no options at all for auditing in the OSS version?

[craggy viper]

Is there any sort of feature-set comparision to SpiceDB around? I see Permify has a bunch of different APIs for asking different types of queries, one of which I think SpiceDB may lack. However I can't tell if Permify supports a caveats/conditions equivalent (woops I see this now it's the attributes)?

[modest zealot]

hi, a general architectural question. Where would you put the call to permify to check if a user has permissions:

1. in a gateway before the request gets to the target service
2. in an endpoint of the target service, close to where the action itself happens

[celest canopy]

Is there any recommended general pattern for having a global "singleton" entity that represents the entire system? For example if I want certain users to have super-admin, they would have that role on the singleton root entity, and then that would propagate to all entities in the whole system.

Should I just create a root entity type and create a single instance with a simple ID like "root:1"? And then all other entities should descend from that one entity?

[celest canopy]

Or should this be implemented more like a super admin role that can be granted to a user?

[untold imp]

Enforcement Question

[vagrant lichen]

Global Roles

[celest canopy]

What's the difference / which is preferred, why? Or is there another even better way?

entity user {}

entity group {
  relation member @user
}

entity document {
  relation editor @user @group#member
  permission edit = editor
}

entity user {}

entity group {
  relation member @user
}

entity document {
  relation editor @user
  relation editorGroup @group

  permission edit = editor or editorGroup.member
}

Is there any way to do something like:

entity user {}

entity group {
  relation member @user
}

entity document {
  relation editor @user @group
  permission edit = editor or editor.member
}

[queen crown]

For me, the 2nd will be better approach. Its quite clear about relationship between document vs user and user vs group

[untold imp]

What's the difference / which is

[queen crown]

Im assume that Permify is statefull, even its storage can be database, is that correct? Can I get concepts/ examples of performance tests of Permify

[gusty barn]

I have been looking into Permify a lot recently, however the main use case I have for it right now is in ruby, and I'd have to write an API client for it in ruby anyways, so I thought I'd see if anybody had started a ruby client yet? If so, I'd love to contribute. And if not, I would consider creating one.

[open dust]

Hello everyone! I'm currently working with the check API in Permify and received a response that includes check_count. Could anyone explain the significance of check_count in this context?

[untold imp]

Ruby Client

Check Count

[untold imp]

Performance Tests

[sinful hinge]

Hi! I maintain an open source near real-time integration engine which also allows denormalization of permissions from zanzibar type systems (also ingestion from various sources), I wonder if there is any interest in permify for that use case? if so, if there is any developer that could answer some questions I have regarding best practice to read and write large amount of data from permify?

[queen crown]

Can u post ur oss link git for everyone to overview

[tranquil wigeon]

Hi guys, I am so interested in permify. I am reading about it and looks super cool. I have the following question because i could not find it in the documentation.
Lets say I spin up a permify server who expose some apis, administrative & the role check one. How can I protect the server to allow to some services use the administrative one and another services to use only the check permission ones? is it possible?

[untold imp]

Hi guys, I am so interested in permify.

Hi! I maintain an open source near real-

[tranquil wigeon]

Hey guys, I am playing around with permify. I have a problem with the playground. If I put incorrect data, it success so it is so hard to understand if i am doing something wrong. There is another user facing the same behavior https://play.permify.co/?s=gc2RPvd3v1w0Pavdqysm3. Am i using it wrong? or is it a know issue?

[untold imp]

Hey guys, I am playing around with

[long geode]

hi everyone
how can i set preshered key for permfy on client side it just has addres and cert:
permifyClient, err := permify.NewClient(
permify.Config{
Endpoint: config.Host + ":" + config.Port,

    },
    grpc.WithTransportCredentials(insecure.NewCredentials()),
)

[left oyster]

@untold imp
Allow me propose a feature here, currently LookupEntity doesn't support cursor pagination, and even it has streaming rpc method, it still can't satisfy the classic use case in Zanzibar.
I suggest implementing the cursor token for LookupEntity like AuthZed does for LookupResources.

[untold imp]

cursor pagination feature request

[vivid heath]

I'm looking to use Permify on the backend and something like (https://casl.js.org/v4/en/package/casl-react) to be able to conditionally render certain ui elements based on which permissions a user has, so I'm looking for a way to say give me a list of resources that user:x has permissions to, and include which permissions they have on that resource

What would be the best way to go about doing this

[untold imp]

CASL. Isomorphic Authorization JavaScrip...

[willow beacon]

Hello everyone!

I've used OpenFGA in another project, and am pretty pleased with how it works.

However, I'm working on another project that has a very restricted production environment - I can only run Python code (no arbitrary docker containers!) so I need an alternative to OpenFGA.

Does Permify support running in-process (am I using that term right? Perhaps I mean "running as a library")
I.e. Is there a way to run Permify within an existing Python application?

Thanks in advance for your time!!

[untold imp]

Permify As An Library

[rare vapor]

Hey, is there a list of the available 'enterprise integrations' somewhere?

[untold imp]

Hey, is there a list of the available '

[signal ivy]

Hi folks, does someone know if latest versions of postgres are supported by the system?

[untold imp]

Hi folks, does someone know if latest

[broken trench]

hello, I have a Nodejs appA running on Postgres with dbA using prisma , I want to use Permify , so I declared a schema.perm and created Permify container with dbB with auto_migrate TRUE , The problem is that when i open the dbB , it is empty,
Questions:

• What is the auto_migrate for ?
• Looks like to me that i should call schema endpoint to setup schema from appA , is it correct ?
  Thanks.

[untold imp]

hello, I have a Nodejs appA running on

[magic heron]

I've enabled the preshared keys authn method, but it seems to let any call through regardless when calling through http. Is that a currently known issue? I can add a check for the auth in nginx if I have to, but it's not the preferred solution ofc

[magic heron]

If you overwrite the schema for a tenant, does it wipe out the existing data?

[untold imp]

I've enabled the preshared keys authn

If you overwrite the schema for a tenant

[signal ivy]

Hi folks, I've released a plugin for Permify for JetBrains IDEs: https://plugins.jetbrains.com/plugin/24624-permify . It's still barebones but a cool side-project I've been working on, maybe I'll add more features in the future. Give it a test 🙂

[untold imp]

Permify - IntelliJ IDEs Plugin | Marketp...

[magic heron]

Hello again, just wanted to share this project that I've been working on. It's a Permify API wrapper for C# projects, since there isn't an official SDK yet. I didn't auto-generate it, so its usage patterns are a little different from the official SDKs. Check it out here: https://github.com/Precisamento/Precisamento.Permify

[untold imp]

GitHub - Precisamento/Precisamento.Permi...

[verbal vector]

Hi everyone, I'd like to hear from fellow engineers whether they've had successful authorization implementations with Permify and managed to go live in production with no issues. Did you face any limitations or issues? Is it production ready?

[heady reef]

We're still in the pre-prod phase, overall using Permify is pretty nice experience.

Deployments were rather easy, setting up the proper configs for prod - not so much.

In some scenarios the SDK was limiting us and we were not able to check multiple resources in a batch. We had to tweak our setup so we check them on demand.

The graph viz tool didn't work out well for our schema, so we're not using it.

Very useful bit was the CI permission checker that runs all tests against each branch.

Another a bit hidden, but quite useful feature is the multi-tenancy, which works out of the box.

[untold imp]

We're still in the pre-prod phase,

[austere pendant]

Hi This is Kavya Rishi
I would like to contribute to the open source repo of Permify
I would like to know how to proceed with that

[true grotto]

Hey @austere pendant , I’m sharing our contribution guide with you. https://github.com/Permify/permify/blob/master/CONTRIBUTING.md

You can also check our good first issue tags in our open-source repository.

Or alternatively you can check missing SDKs we would love to get extra help on that 😊

[austere pendant]

there are no existing Good First issue

[peak elk]

Hello
We are using permify in production, is there an admin dashboard / studio / way to understand why a check succeeded or failed (for example, explain which part of the graph granted the allow access for a check, and same for denied)

Something finding why a check failed is hard to debug for big schema

Our schema represent a drive like permission schema mixed with a org / group schema
If you are member of a group, the group have access to a folder, you have access to all the files in folder and sub folder etc

Understanding why a check fail can be hard

[untold imp]

Access check reasoning

[gloomy ether]

Goodday, is there a guide on installing Permify on Linux environment, i have checked the docs and i can only see docker local setup. I am planning to self host it on one of my linux servers

[jovial lion]

would be great to get releases from the typescript/javascript libraries!

[untold imp]

would be great to get releases from the

[azure dune]

I have set up on my local for only test purpose

- Set up postgres db
- Add Db details in GetDefaultConfig 
- build the project 
- and run ./permify serve 

[odd ether]

I have set up on my local for only test

[azure dune]

Hi All, This is Ankit , I was exploring Permify and I found some issues in api-reference docs , Should I create issues and then create Merge request to fix or I can directly create Merge request

[true grotto]

Hey @austere pendant , a new good first issue came up. You can take a look at this at here: https://github.com/Permify/permify/issues/1390

[austere pendant]

Cool I will look it up

[tacit mountain]

Hey all, I created some tree-sitter grammars for those of us that use Neovim and Zed (or other IDE's / text editors that use tree-sitter grammars) for perm files when working with the Permify schemas. I still need to figure out how to get my syntax highlighting with my nvim setup but it's working in Zed. (though it requires some manual installation until the PR to the Zed extension repo is approved and merged). I'm open to feedback and suggestions/improvements.
https://github.com/theoriginalstove/tree-sitter-perm - tree-sitter grammar
https://github.com/theoriginalstove/perm - Zed editor extension

[untold imp]

Treesitter for grammar files

[austere pendant]

@true grotto Hi
I am ready to take up this task
https://github.com/Permify/permify/issues/1390
can you assign it to me ?

[azure dune]

Hi I was going through lookup code for this issue
https://github.com/Permify/permify/issues/1366
and I would like to take it but before this I have proposed two approaches can someone pls review and let me know if I am not missing something and which approach should we go ahead

[untold imp]

Option for an array of permissions to Lo...

[jovial lion]

I'm attempting to spin up permify as part of a github action workflow to run tests against it. I currently start it via the service directive; but this is somewhat clunky since i can't pass a command (serve) to it (only via --entrypoint which runs the entire directive as a string (permify serve). Also, there's the case of creating the postgres database. Can't help but feel there's space for an action here that optionally connects to postgres and creates the db, as well as runs various commands before serve (migrate?)

[jovial lion]

another option could be to make permiy serve the default entrypoint / command for the dockerfile? It would be similar to how for instance redis or postgres works (default directive = server)

[jovial lion]

will open a PR as a way to discuss.

[jovial lion]

https://github.com/Permify/permify/pull/1442

[jovial lion]

also! another question - why not generate libraries based on grpc instead of openapi? they should be more efficient

[odd ether]

also! another question - why not

[odd ether]

I'm attempting to spin up permify as

[azure dune]

Hi I was adding support for list of permissions in lokkup entity and I ahve done the changes and tested also , on my local test cases are passing but on pipeline one test case is failing
https://github.com/Permify/permify/actions/runs/10408248848/job/28825276797?pr=1465
When I run on local its working fine , can someone pls help how to debug or reproduce it

[odd ether]

feat: add support for list of permission...

[fleet basin]

Hi, how to get access to public roadmap ?

[untold imp]

Hi, how to get access to public roadmap

[mental cloud]

Just a random question for the community? What is the biggest challenge as a developer you would love to solve soon?

[hallow zephyr]

Hi, at first I want to thank you for this great project. I have had a quick look at it and it looks really good.

But I have a quick question. What are the future plans for it. As this project is relatively young, are there any plans to commercialize it in the future, or will it stay open source?

[untold imp]

Hi, at first I want to thank you for

[fresh needle]

Hi, good afternoon,

My name is Juan, and I'm part of the development team at Coordinate. We are currently exploring tools that will enable us to implement access control on our platform. Our requirements involve using RBAC, ReBAC, and ABAC, and we believe your solution could be a great fit for us.

I'm still learning about these systems and don't consider myself an expert yet. From what I understand, we can use Docker to run the API in a development environment. However, I would like to know how this setup translates to a production environment. Could you provide some insights into best practices for running your solution in production?

Additionally, I have a question regarding our use case with ABAC. We need to allow our users to create custom rules for certain entities. These rules would follow a hierarchical structure, where the base schemas are provided by us, and the user-generated rules are layered on bottom. Is there a way to combine these schemas for validation purposes, or would we need to implement custom logic to determine which schema to use?

Thank you for your time, and I look forward to your guidance 😊

[untold imp]

Hi, good afternoon,

[fleet basin]

Hi,

I tried to update permify-node but I got this error after updating
"
Error: Cannot find module '@buf/permifyco_permify.grpc_node/base/v1/service_pb'
Require stack:

• /iam-service/node_modules/@permify/permify-node/dist/src/grpc/index.js
• /iam-service/node_modules/@permify/permify-node/dist/src/index.js
• /iam-service/dist/permify/permify.service.js
• /iam-service/dist/authorization/authorization.service.js
• /iam-service/dist/apikey/apikey.service.js
• /iam-service/dist/apikey/apikey.module.js
• /iam-service/dist/app.module.js
• /iam-service/dist/main.js
  "

I only get the error when I install the library with npm, I tried to compile it and replace the dist downloaded with npm with the one by compiling the github project and I don't have the problem.

so maybe the dist folder in npm is incorrect, can you build it again?

[odd ether]

Hi,

[rain ledge]

Hello everyone! I have a question regarding integrating Permify into a business system.

Taking the Google Docs example from the Permify documentation (Google Docs Demo), the demo sets up entities like organization, group, and document. In my own business system, should I also create database tables for organization, group, and document? Additionally, should I provide CRUD operations for these entities to be handled by the frontend?

[untold imp]

Hello everyone! I have a question

[real frigate]

This channel is connected to Olvy. Messages you send here will be added as feedback to the permify Olvy workspace.

[frank tiger]

Hey all, new to Permify. Does Permify send logs and metrics to a file that I can tail to send it to our inhouse observability tools?

[lunar zealot]

Hello everyone, does permify support other databases than MySQL and Postgres. Like say SQLite ?

[untold imp]

Hello everyone, does permify support

[formal fog]

Hi everyone, I have few questions regarding the open-source version

1. Is there a way to evaluate multiple check access control request at once? Mostly for same user.
2. Is there a way to do partial schema update by sending the new schema instead of sending the diff and permify calculates the diff for us? Alternatively is there a way to calculate the diff for the current version using some playground or api.
3. When partial updates api deletes something from schema that already has data associated, will the associated data also gets deleted? Is this process async or takes a lot of time?
4. What's the suggested way to update schemas in production or migrate from old schema to new schema? What's the suggested method of maintaining the same schema in staging and prod without manual intervention?
5. Is there any documentation to deploy permify on AWS lambda?

[lilac ridge]

Hello. Permify does not work on Fly.io. I deployed with this fly.toml

app = 'mypermify-app'
primary_region = 'lax'

[build]
  image = "registry.fly.io/mypermify-app:latest"
  # Note this is just ghcr.io/permify/permify:latest pushed to the fly registry

[env]
  PERMIFY_DATABASE_ENGINE = "postgres"
  # Secret set for PERMIFY_DATABASE_URI

[[vm]]
  memory = '1gb'
  cpu_kind = 'shared'
  cpus = 1

I removed the public IP addresses and allocated a private one: fly ips allocate-v6 --private
I then wrote schema with the write API. I verified it showed up in my postgres database. But when I run

curl -X "POST" "http://mypermify-app.internal:3476/tenants/t1/schemas/read" \
     -H 'Content-Type: application/json; charset=utf-8' \
     -d $'{
  "metadata": {
    "schema_version": "ct75gopunmgc5jt71p6g"
  }
}'

I get a 404 and a log ERROR: Failed to extract ServerMetadata from context

[outer dragon]

hi

[serene eagle]

Hello,

I’m a software engineer currently evaluating permify to determine if it fits the needs of our project. I have a couple of questions to better understand how it works:

1. Is there any difference in the architecture between the paid and free versions?
2. Is it possible to sort the resources a user has access to based on specific attributes, such as name or creation date?

[vagrant lichen]

Hello,

[stoic yacht]

Hi there,
I’m playing with Permify and came across the tenant concept.
I see each tenant is currently bounded to a version of a schema, is it there a way to assign multiple tenants (possible 1000s of) to the same schema?

[vagrant lichen]

Hi everyone, I have few questions

Hello. Permify does not work on Fly.io.

[rancid tusk]

I am interested in a shared schema for all my tenants (b2b saas application). It kinda sucks having to create a schema per tenant when the schema would be exactly the same. What I want is permission checks & queries on the datastore to be scoped to just a single tenants data to keep query performance optimal. In one part of my application we already have a flattened list of permission for entities to principals (users or groups).

[rancid tusk]

Has anyone undertaken any research into the code changes required to configure a global schema for all tenants?

[cyan otter]

Hi there, I'm keen to know more about the speed and scalability comparison between permify's Lookup Entity (Data Filtering) API and openFGA's ListObjects API used for reverse lookup. Any pointers?

[cyan otter]

Found this document that does a comparison of the internal workings. https://permify.notion.site/Cache-Differences-Between-Permify-and-OpenFGA-3e32552227a94b069a6bfdd556e3b1ea

If there is inaccuracy still (based on the 10s cache mechanism) with the OpenFGA mechanism, then it seems Lookup Entity by Permify is a better option, as long as space for storing the cache is manageable over time (delete old cache on a frequent basis).

[sharp bloom]

Made a little PR here to improve the OTEL experience when using the HTTP API

https://github.com/Permify/permify/pull/2048

[sharp bloom]

Merged now

[cyan otter]

anyone tried appending the permify docs to cursor composer? it seems it only processes one page at a time due to the structure of the docs website. What docs url would you recommend?

[torpid marten]

What databases do Permify support apart from Postgres? I was thinking about using SurrealDB but think I will have to implement the driver myself if there isn't any

[agile oyster]

From what I understand from the docs, Postgres is the only one supported, might be wrong though.
https://docs.permify.co/setting-up/configuration#database-database-configurations

I didn't find a way to create DB drivers

[torpid marten]

Creating drivers seems to be on the internal/storage folder in the permify repo from what I could see

[nova aurora]

Is Permify able to be used as a truly open-source solution, or is the "Free" version mainly just meant as a temporary stepping stone?

[neon robin]

Hi there,

We are currently exploring Permify and are particularly interested in the cloud features (environments, data sync). We were able to create an account for the console, but upon accessing it, we’re unable to do much beyond the initial setup. Is there something we might have overlooked?

We would love to discuss this further in an online meeting, but we couldn’t find a working Calendly link on the website.

[cyan ferry]

Hi,

I am from SSOJet.com and I want to submit a startup deal at permify. Can anyone help me in this?

[tall bronze]

Hello I am evaluating fga services for my company. Our software is built in .net. Are there any plans for an official .net sdk? I noticed that the unofficial library hasn't had any activity in several years so it makes me hesitant to pursue permify.

[odd ether]

Hello I am evaluating fga services for

Is Permify able to be used as a truly

[tall bronze]

I'd love to schedule a call to learn more about pricing and enterprise options but the calendly link on your website is broken. Can someone help me get something scheduled?

[odd ether]

I'd love to schedule a call to learn

Hi there,

[rose aurora]

I was looking throught the docs for search with permission that auth0 provide here (https://docs.fga.dev/integration/advanced/search-with-permissions) and one of the options that have is to build a local index with your tuple expanded. I know that permify offer a watch API here (https://docs.permify.co/api-reference/watch/watch-changes) but still unsure the premise is that i need to make an additional call to FGA service to expand the tuple and then replicate this in local index (which i also assume from the former article to mean your database). wondering thoughts on option3 from that article and potential patterns I can look into with permify. thanks

[torpid marten]

Is contributing extra database adapters accepted?

[arctic dagger]

I noticed on your GitHub page it states "permify-python: gRPC and REST available", but the current PyPI package (v1.0.2) only seems to have REST support via the Configuration(host=...) class. Am I missing something?

[cinder breach]

Interested in the quiet Permify license change from 3 months ago to AGPL 3.0 and how you interpret the new license (how litigious are you?)

Meaning, is is fine to host and utilize Permify for authorization in a SaaS platform (so long as we’re not re-selling hosting Permify or a modified Permify for folks)? I ask because Minio is of a much different opinion.

[odd ether]

Hi @cinder breach, you can host and use Permify in your SaaS platform to handle authorization without releasing your own app's code, as long as you don't sell or redistribute Permify itself. The AGPL only requires you to share your changes if you modify Permify and let users interact with it over a network. Unmodified Permify powering your platform internally is completely fine.

[noble spear]

Thanks a lot for clearly stating your interpretation on this matter, worth a lot!

[frank crown]

Is there any tutorial video, where show's how I can setup the Permify fully?

[odd ether]

Is there any tutorial video, where show'

[foggy hill]

hi guys, I have a doubt. every time I run docker-compose down, the schema disappears. so when I check permissions, it says 'no schema defined'. why is this happening, and how can I solve it?

[odd ether]

Schema Persistence Issue

[primal cobalt]

Hi, are there any examples of integration with MySQL by generating a local cache?

Specifically, we manage a SaaS product and need to filter data in lists.

I found a page in the documentation on this topic, but I can't find it anymore.

[icy seal]

Hello, do we know when the use of attributes across entities will be available in an official version ?

[lavish drift]

I am doing an evaluation of some open source authz servers based on zanzibar. How does Permify different from SpiceDB when it comes to global authorization? I will have Services deployed in multiple georgraphical locations but want 1 Authz service. SpiceDB requires Spanner / CockroachDB, how is this hanlded by Permify?

[fallow meadow]

Hello, is permify still alive? The calendly link doesn't work, none of the js/ts/node SDKs work. We really like this project and would like to use it but it looks stale

[vagrant lichen]

Hello, is permify still alive? The

[jovial canopy]

Hi folks. I am seeing an issue in python client.

The pydantic model generated for the attribute do not have the data field. it only has the type field

[jovial canopy]

This is the payload I am using { "metadata": { "schema_version": "" }, "tuples": [], "attributes": [ { "entity": { "type": "report", "id": "1" }, "attribute": "admin_group", "value": { "@type": "type.googleapis.com/base.v1.StringValue", "data": "admin123" } }, { "entity": { "type": "report", "id": "1" }, "attribute": "editor_group", "value": { "@type": "type.googleapis.com/base.v1.StringValue", "data": "editor123" } }, { "entity": { "type": "report", "id": "1" }, "attribute": "viewer_group", "value": { "@type": "type.googleapis.com/base.v1.StringValue", "data": "viewer123" } } ] }

When this is loaded via python sdk it comes as DataWriteBody(metadata=DataWriteRequestMetadata(schema_version=''), tuples=[], attributes=[Attribute(entity=Entity(type='report', id='1'), attribute='admin_group', value=Any(type='type.googleapis.com/base.v1.StringValue', additional_properties={})), Attribute(entity=Entity(type='report', id='1'), attribute='editor_group', value=Any(type='type.googleapis.com/base.v1.StringValue', additional_properties={})), Attribute(entity=Entity(type='report', id='1'), attribute='viewer_group', value=Any(type='type.googleapis.com/base.v1.StringValue', additional_properties={}))])

[vagrant lichen]

When this is loaded via python sdk it

[devout mural]

@odd ether nice to meet you. thanks for constructing good server like this. I want to be a member of this server. Best Regards.

[hollow thunder]

Hello! Not sure if this is the right place for this, but in case we have any Permify x Railway users in here, we've set up a fairly basic template for it:
https://railway.com/deploy/permify

[ember basalt]

@hollow thunder thanks for doing this! really appreciate it. Two asks (no good deed goes unpunished 🙂 ):

• do you have any interest in submitting a PR adding a page for deploying to Railway, similar to https://docs.permify.co/setting-up/installation/fly ? You can add the page here: https://github.com/Permify/permify/tree/master/docs/setting-up/installation .
• do you know how we can get the FusionAuth community edition added to Railway? https://fusionauth.io/docs/get-started/download-and-install/docker is the install docs.

[hollow thunder]

Haha, sure thing! I'll take a look

[hollow thunder]

Here's the PR for the Railway deployment guide:
https://github.com/Permify/permify/pull/2738

[odd ether]

@hollow thunder thank you for the contrinbution! just merged the changes in our docs and will be up to date shortly

[hollow thunder]

Happy to help!

I'll try to look into the FusionAuth matter soonish as well

[hollow thunder]

FusionAuth on Railway:
https://railway.com/deploy/fusionauth

[ember basalt]

Deploy FusionAuth

[ember basalt]

hey folks, we're planning on building some retrieval-augmented generation (RAG) related features that tie into Permify (building on https://docs.permify.co/use-cases/llm-authorization ). An example app, maybe some tooling. Had some questions (in-thread).

[stone ridge]

Hi I am curious, why did you choose Permify over other solutions like OpenFGA or SpiceDB? Could you share your considerations?

[austere barn]

Hey, I love opensource projects and found your project cool and I want to start contributing, but all issues seems like old, does the issues that you want to solve is inside the team that you guys dont post? because I would love to help

[ember basalt]

Thanks @austere barn ! the github issues are the best place to look for contribution options.

We always appreciate folks triaging bugs that have been filed: https://github.com/Permify/permify/issues?q=is%3Aissue state%3Aopen label%3Abug or looking at improving our documentation: https://github.com/Permify/permify/issues?q=is%3Aissue state%3Aopen label%3Adocumentation

[bleak quiver]

@ember basalt I can see that you do not offer Permify hosted anymore (at least from your website). I was interested in the Sync feature (though for self hosted scenarios). Is that something that is being worked on?

[ember basalt]

hi @bleak quiver , we actually do offer hosted high availability permify instances, but this hosting is bundled with the FusionAuth enterprise plan (along with support and an SLA). Happy to connect you with someone to chat about that if you'd like.

what page did you look at that said we didn't offer it?

As far as the sync feature, we are evaluating what to do with that codebase, but no firm plans have been made.

Given you are looking at implementing a sync in a self-hosted scenario, what is currently written probably wouldn't be that helpful. I'd suggest working from the public docs: https://fusionauth.io/permify-docs/integrations/data-sync and creating this yourself. If you'd like to do that and open-source it, it'd be a great thing to share with the community 🙂 .

Or am I missing something that you are looking for?

[true grotto]

Hey @everyone ,

I found a great and detailed piece about authorizations in micro-service infrastructure.

https://www.alexanderlolis.com/authorization-in-a-microservices-world

[rich smelt]

Hey, I tried to support Permify with a short linkedIn post. Hope that it could help others find you more easily.

https://www.linkedin.com/posts/amirhe_opa-authorization-react-activity-6937648343120547840-3pKG?utm_source=linkedin_share&utm_medium=member_desktop_web

[true grotto]

That’s awesome @rich smelt 🚀🚀🚀🚀

[amber topaz]

Wow. I just started reading up on what permify is all about and I must say it's incredible

I would love to get up to speed and contribute in whatever way I can

[true grotto]

Awesome @amber topaz! We'll be launching an open-source version of Permify in following week. Would love to have your feedback and contributions 🙂

[amber topaz]

Alright. Will be anticipating it👍🏽

[loud nova]

I would like to collaborate too!😃

[true grotto]

Awesome would love to see you as well @loud nova , I'll let you know!

[loud nova]

Thanks @true grotto !

[unreal wedge]

I also want to contribute as a frontend developer.

[true grotto]

@unreal wedge absolutely 🚀🚀