Distributed keto "synchronization"

[igorshmukler]

Hello,

I am evaluating keto for my authorization needs. I have been following the project for a few weeks. Still don't have the full picture by a long shot.

Zanzibar relies on Spanner and its' time synchronization to apply ACLs in the correct order. Neither CockroachDB nor PostgreSQL have TrueTime-like API available. Is keto relying on snapshot reads for consistency?

Another question I have is about reverse lookups - finding all documents that a specific user is permitted to access. Is there an index for reverse lookups? Given that the platform must support extensive nesting, how did keto address performance issues for reverse lookups?

Realize that this might be covered extensively in some documents, and my questions are possibly redundant. In such a case, please point me to the appropriate resources.

Thank you

[vinckr]

Hello Igor,
thanks for reaching out.

Is keto relying on snapshot reads for consistency?

In this comment: #517 (comment) are some thoughts on how to solve this without spanner-like capabilities.

How did keto address performance issues for reverse lookups?

If you haven't already take a look at the Performance document.

Also pinging @zepatrik for comment in case I might have missed something.

[zepatrik]

The only link to add here is https://www.ory.sh/docs/keto/guides/list-api-display-objects#application-context
As you already imply, reverse lookups are not that easy to get right. That's why there is no native API for that yet. We have to evaluate whether we will add it later on based on use cases. See also related discussion #681.