Skip to content

Commit ea51c1f

Browse files
committed
feat: update docs for expiring relationships
1 parent f9c65d4 commit ea51c1f

File tree

3 files changed

+12
-25
lines changed

3 files changed

+12
-25
lines changed

pages/spicedb/concepts/_meta.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@
22
"zanzibar": "Google Zanzibar",
33
"schema": "Schema Language",
44
"relationships": "Writing Relationships",
5-
"caveats": "Writing Relationship with Caveats",
6-
"expiring-relationships": "Expiring Relationships",
5+
"caveats": "Writing Relationships with Caveats",
6+
"expiring-relationships": "Writing Relationships that Expire",
77
"commands": "SpiceDB Commands & Parameters",
88
"consistency": "Consistency",
99
"datastores": "Datastores",

pages/spicedb/concepts/commands.mdx

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -454,7 +454,6 @@ spicedb serve [flags]
454454
--dispatch-upstream-addr string upstream grpc address to dispatch to
455455
--dispatch-upstream-ca-path string local path to the TLS CA used when connecting to the dispatch cluster
456456
--dispatch-upstream-timeout duration maximum duration of a dispatch call an upstream cluster before it times out (default 1m0s)
457-
--enable-experimental-relationship-expiration enables experimental support for first-class relationship expiration
458457
--enable-experimental-watchable-schema-cache enables the experimental schema cache which makes use of the Watch API for automatic updates
459458
--enable-performance-insight-metrics enables performance insight metrics, which are used to track the latency of API calls by shape
460459
--enable-revision-heartbeat enables support for revision heartbeat, used to create a synthetic revision on an interval defined by the quantization window (postgres only) (default true)

pages/spicedb/concepts/expiring-relationships.mdx

Lines changed: 10 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,11 @@
11
import { Callout } from 'nextra/components';
2-
import YouTube from 'react-youtube';
32
import { InlinePlayground } from '@/components/playground';
43

5-
# Expiring Relationships
4+
# Writing Relationships that Expire
65

7-
<Callout type="info">
8-
Expiring Relationships is available from SpiceDB 1.40 onwards. Use the `--enable-experimental-relationship-expiration` flag when calling `spicedb serve` to enable it.
9-
</Callout>
6+
A common use case is granting a user access to a resource for a limited time.
107

11-
A common use case is to model relationships that expire after a certain time.
12-
This is useful for granting temporary access to a resource.
13-
14-
Before version 1.40, [caveats] were the recommended way to support time-bound permissions, but that has some limitations:
8+
Before SpiceDB v1.40, [caveats] were the recommended way to support time-bound permissions, but that has some limitations:
159

1610
[caveats]: caveats
1711

@@ -20,7 +14,7 @@ This is additional complexity for clients.
2014
- Expired caveats are not automatically garbage collected.
2115
This can lead to many caveated relationships in the system and increase the costs of loading and evaluating those into the runtime.
2216

23-
SpiceDB supports expiring relationships, which lets users define relationships that expire at a given time.
17+
After v1.4.0, and if you need to grant temporary access to a resource, you can do so by writing relationships that expire after a certain time.
2418

2519
The time must be specified in [RFC 3339 format].
2620

@@ -35,10 +29,6 @@ The time must be specified in [RFC 3339 format].
3529

3630
## Schema
3731

38-
Expiring relationships follow a similar use to caveated subject types.
39-
The novelty here is that users need to enable the feature using the `use` clause.
40-
This is to disambiguate a caveat named `expiration` from the new expiration feature.
41-
4232
To enable expiration in your schema, add a `use expiration` clause to the top of the file.
4333
Then the relations subject to expiration are marked using `<type> with expiration`:
4434

@@ -54,9 +44,7 @@ definition resource {
5444

5545
## API
5646

57-
The expiration of a relationship is [on a per-relationship basis](https://buf.build/authzed/api/docs/63b8911ef2871c56e5048d1f40a8473f98457ca9:authzed.api.v1#authzed.api.v1.Relationship)
58-
at write time, using `WriteRelationships` or `BulkImportRelationships` APIs.
59-
The expiration is denoted with the `OptionalExpiresAt` field in the relationship.
47+
To write a relationship that expires, use the `WriteRelationships` or `BulkImportRelationships` APIs, and set the `OptionalExpiresAt` field in the relationship:
6048

6149
```textproto
6250
WriteRelationshipsRequest {
@@ -86,7 +74,7 @@ WriteRelationshipsRequest {
8674

8775
## Playground
8876

89-
Set expirations on relationships in the Playground with the format `[expiration:2025-12-31T23:59:59Z]`:
77+
To write a relationship that expires, use the following format:
9078

9179
```yaml
9280
resource:r1#folder@folder:folder1[expiration:2025-12-31T23:59:59Z]
@@ -97,7 +85,7 @@ or specify expirations in the `Expiration` column in the Relationship grid edito
9785

9886
## zed
9987

100-
Use the `--expiration-time` flag to pass the expiration time of the relationship:
88+
To write a relationship that expires, use the `--expiration-time` flag:
10189

10290
```shell zed
10391
zed relationship create resource:r1 folder folder:folder1 --expiration-time "2025-12-31T23:59:59Z"
@@ -106,7 +94,7 @@ zed relationship create resource:r1 folder folder:folder1 --expiration-time "202
10694
## Garbage Collection
10795

10896
As soon as a relationship expires, it will no longer be used in permission checks.
109-
However, the row is not deleted right then, but rather is subject to garbage collection.
97+
However, the relationship is not deleted right then, but rather is subject to garbage collection.
11098

11199
Reclaiming expiring relationships is governed by the same mechanism (and flags) as the deletion of the history of
112100
relationship changes that powers SpiceDB's own MVCC (Multi-Version Concurrency Control) and heavily depends on
@@ -130,7 +118,7 @@ Relationships will be reclaimed after 24 hours by default.
130118
If you implemented expiration using caveats, this section describes migrating to the new expiration feature.
131119

132120
1. Rename your caveat if you had named it `expiration`
133-
2. Add the new subject type to your relation, and also add a combination where both are used:
121+
2. Add the new subject type to your relation, and also add a combination where both are used. For example:
134122

135123
```zed
136124
caveat ttl(timeout duration, now string, timeout_creation_timestamp string) {
@@ -165,7 +153,7 @@ This is needed because only one relationship is allowed for a resource/permissio
165153
4. Validate that the new expiration feature works as expected by not providing the context for evaluating the `ttl` caveat.
166154
5. Once validated, migrate completely to the new expiration feature by writing all relationships with only expiration
167155
and without caveat.
168-
6. Drop the caveat from your schema once the migration is completed
156+
6. Drop the caveat from your schema once the migration is completed:
169157

170158
```zed
171159
use expiration

0 commit comments

Comments
 (0)