memory-bank/components/spicedb.md
The SpiceDB component in Gitpod provides authorization and permission management using the SpiceDB authorization system. It defines the relationship-based access control (ReBAC) schema that governs permissions across the Gitpod platform, enabling fine-grained access control for users, organizations, projects, workspaces, and other resources.
The primary purposes of the SpiceDB component are:
The SpiceDB component consists of:
The component follows the SpiceDB authorization model, which is based on the Google Zanzibar paper. It uses a relationship-based approach where permissions are derived from relationships between entities.
The schema defines various permissions for each entity type:
read_info: View user informationwrite_info: Edit user informationdelete: Delete user accountmake_admin: Make a user an adminadmin_control: Administrative control over usersread_ssh: View SSH keyswrite_ssh: Manage SSH keysread_tokens: View access tokenswrite_tokens: Manage access tokensread_env_var: View environment variableswrite_env_var: Manage environment variableswrite_temporary_token: Create temporary tokenscode_sync: Synchronize coderead_info: View organization informationwrite_info: Edit organization informationdelete: Delete organizationread_settings: View organization settingswrite_settings: Edit organization settingsread_env_var: View organization environment variableswrite_env_var: Manage organization environment variablesread_audit_logs: View audit logsread_members: View organization membersinvite_members: Invite new memberswrite_members: Manage organization membersleave: Leave the organizationcreate_project: Create new projectsread_git_provider: View Git provider informationwrite_git_provider: Manage Git provider settingsread_billing: View billing informationwrite_billing: Manage billing settingsread_prebuild: View prebuildscreate_workspace: Create workspacesread_sessions: View user sessionswrite_billing_admin: Administrative billing controlread_info: View project informationwrite_info: Edit project informationdelete: Delete projectread_env_var: View project environment variableswrite_env_var: Manage project environment variablesread_prebuild: View project prebuildswrite_prebuild: Manage project prebuildsaccess: Access the workspacestart: Start the workspacestop: Stop the workspacedelete: Delete the workspaceread_info: View workspace informationcreate_snapshot: Create workspace snapshotsadmin_control: Administrative control over workspacesThe SpiceDB component's core configuration is its schema, defined in components/spicedb/schema/schema.yaml. This YAML file is central to Gitpod's authorization model and specifies:
user, organization, project, workspace).organization has an owner which is a user; a project belongs to an org).permission write_settings = owner + installation->admin for an organization).New permissions (like the maintenance permission for organizations) are added by modifying this schema file. Other components, such as the server component, then use a SpiceDB client to check these permissions at runtime to authorize operations.
The SpiceDB component integrates with:
// Check if a user can access a workspace
allowed, err := client.CheckPermission(ctx, "workspace:workspace_1", "access", "user:user_1")
// Add a user as a member of an organization
err := client.WriteRelationships(ctx, []spicedb.Relationship{
{
Resource: "organization:org_1",
Relation: "member",
Subject: "user:user_1",
},
})
The component implements several security measures:
None specified in the component's build configuration.