How authzed/spicedb works
SpiceDB is an authorization service: clients define a permission schema, write relationships, and ask whether a subject may perform an action on a resource. The README also documents caveated authorization and reverse-index queries; the tree exposes dedicated API, query, dispatch, and datastore subsystems for these capabilities. Sampled server and query-plan code supports the main service-to-evaluation path, while the README supplies the broader product workflow. Unsampled subsystem links are included only where their purpose is clear; exact internal wiring is not inferred.
Main entry points: server.go gRPC services · datastore.go Datastore interface · permissions.go Permission API · permissions_queryplan.go Query planning
Components 23
API and server
- Server assembly
pkg/cmd/server/server.go - gRPC services
internal/services/server.go - Permission API
internal/services/v1/permissions.go - Schema API
internal/services/v1/schema.go - Relationship API
internal/services/v1/relationships.go - Relationship watch
internal/services/v1/watch.go - HTTP gateway
internal/gateway/gateway.go
Authorization model
- Schema compiler
pkg/schemadsl/compiler/compiler.go - Schema typesystem
pkg/schema/typesystem.go - Caveat evaluation
pkg/caveats/eval.go
Permission evaluation
- Query planning
internal/services/v1/permissions_queryplan.go - Query engine
pkg/query/reader.go - Permission graph
internal/graph/check.go - Distributed dispatch
internal/dispatch/dispatch.go - Bulk checks
internal/services/v1/bulkcheck.go - Reverse lookups
internal/graph/lookupresources2.go
Relationship storage
- Data layer
pkg/datalayer/datalayer.go - Datastore interface
pkg/datastore/datastore.go - Datastore engines
pkg/cmd/datastore/engines.go - Memory datastore
internal/datastore/memdb/memdb.go
Operations
- Server CLI
pkg/cmd/serve.go
Other components
- Authorization client
- Relational database
Connections 26
- Authorization client → gRPC services: sends gRPC
- Server assembly → gRPC services: registers services
- Authorization client → HTTP gateway: sends HTTP
- Schema API → Schema compiler: compiles schema
- Schema compiler → Schema typesystem: builds typesystem
- gRPC services → Permission API: registers
- gRPC services → Schema API: registers
- gRPC services → Relationship API: registers
- gRPC services → Relationship watch: registers
- Permission API → Query planning: plans checks
- Query planning → Schema typesystem: loads schema
- Query planning → Query engine: builds query
- Query planning → Distributed dispatch: dispatches evaluation
- Query engine → Permission graph: evaluates permission
- Permission graph → Datastore interface: reads relationships
- Permission graph → Caveat evaluation: evaluates caveats
- Permission API → Bulk checks: supports bulk checks
- Permission API → Reverse lookups: serves reverse queries
- Relationship API → Data layer: writes relationships
- Schema API → Data layer: stores schema
- Data layer → Datastore interface: adapts access
- Datastore engines → Datastore interface: registers engines
- Datastore interface → Relational database: persists data
- Datastore engines → Memory datastore: selects engine
- Datastore interface → Memory datastore: uses implementation
- Server CLI → Server assembly: configures server