Hey, just joined! I was exploring if we could use ...
# permit-saas
s
Hey, just joined! I was exploring if we could use Permit.io for ReBAC in our app and was doing a POC when I ran into a 401 with the Python SDK and Cloud PDP. Turns out the SDK uses lowercase
bearer
in the auth header but Cloud PDP needs uppercase
Bearer
. PR: https://github.com/permitio/permit-python/pull/123 Issue: https://github.com/permitio/permit-python/issues/122 One line fix in 4 files, tested locally and it works. Not sure if this is the right channel for this, let me know if I should post it somewhere else!
a
Hi @Surendhar Sivaprahasam, I'm an AI assistant for Permit.io. I'll analyze available sources and get back to you shortly.
* Welcome! 👋 This is a great channel to share this. Thanks for identifying the issue and submitting the PR — that's really helpful! The Permit.io team monitors GitHub for SDK contributions, so your PR is in the right place. For ReBAC with Permit.io, once you get past this auth header issue, you can model relationships between resources. For example, you can set up resources, roles, and relations like this in Python:
Copy code
await permit.api.resource_relations.create(
    "file",
    {
        "key": "parent",
        "name": "Parent",
        "subject_resource": "folder",
    }
)
(1) And assign resource-level roles:
Copy code
await permit.api.role_assignments.assign(
    {
        "user": "<mailto:john@acme.com|john@acme.com>",
        "role": "viewer",
        "resource_instance": "file:2023_report",
    }
)
​*A quick note on Cloud PDP:*​ It's great for experimentation, but the documentation notes that for production deployments, the Docker Container PDP is recommended for better latency and availability. Also, the Cloud PDP is currently not compatible with ABAC or ReBAC policies. (2) , (3) So for your ReBAC POC, you'll likely want to run the container PDP locally:
Copy code
docker pull permitio/pdp-v2:latest
docker run -it -p 7766:7000 --env PDP_DEBUG=True --env PDP_API_KEY=<YOUR_API_KEY> permitio/pdp-v2:latest
(2) To help our engineers investigate the 401 issue you encountered, could you share: 1. Which Workspace / Project / Environment you're using 2. The SDK calls you were performing (code snippet or cURL) 3. Which PDP version you were running 4. Any relevant logs from your PDP
To learn more, see the sources I considered: [[1] Modeling Google Drive Permissions with ReBAC](https://docs.permit.io/modeling/google-drive) [[2] QuickStart - Add permissions to your Python app](https://docs.permit.io/sdk/python/quickstart_python_sync) [[3] Running a demo](https://docs.permit.io/overview/connecting-your-app)
o
Hi @Surendhar Sivaprahasam - good catch - we’ve released a new version of the cloud PDP recently, and this is a regression. @Omer Zuarets has already authored a PR on the CloudPDP side to fix this
We’ll also review your PR to make the SDK itself more RFC correct
s
Thanks @Or Weis for the quick response
Is it always recommended to use self-hosted container PDP for production?
a
Hey @Surendhar Sivaprahasam It very much depends on the use case and the requirements. This describes when it’s preferable to use each option.
s
Hey @Alon Boshi Thanks for the link! The comparison is helpful. One thing I'm concerned about with Cloud PDP is network latency. Is there any documented SLA/SLO or benchmarks I can reference? Also, which regions are supported?
a
Thanks for following up! @Surendhar Sivaprahasam Currently, the Cloud PDP is running in AWS us-east-2 (Ohio) . We don’t have publicly documented SLA/SLOs or latency benchmarks yet, but this is on our roadmap.
s
Thanks again! Really appreciate the quick and helpful responses
a
Anytime! Happy to help 🚀