feat: Add support for `self` keyword in schema for referencing a resource as a subject #2785

tstirrat15 · 2025-12-19T20:52:15Z

Reverts #1515
Fixes #338
Continues #1511

Description

The reason we reverted #1511 is that we'd break schemas where folks were using self as an actual relation name. We now have a mechanism to work around that, which is use directives. This updates the code from #1511 to introduce a use self directive which enables this feature at the schema level, disallows the use of self as a normal relation name, and then compiles accordingly.

TODO

Figure out where this code moved: https://github.com/authzed/spicedb/pull/1511/changes#diff-b443ad8517c2657f0460e20d33e05f0f0f2a746c059f0e7db67f79f6ba16af7b
Implement parser flag
Ensure it works with composable schemas
Update the integration test

Changes

Will annotate. See commits after the first one for the changes required for the use directive.

Testing

Review. See that tests pass.

codecov · 2025-12-19T22:46:34Z

Codecov Report

❌ Patch coverage is 1.85185% with 159 lines in your changes missing coverage. Please review.
✅ Project coverage is 39.56%. Comparing base (5243b57) to head (1307604).

Files with missing lines	Patch %	Lines
pkg/query/self.go	0.00%	41 Missing ⚠️
internal/graph/expand.go	0.00%	19 Missing ⚠️
internal/graph/check.go	0.00%	15 Missing ⚠️
internal/graph/lookupresources2.go	0.00%	15 Missing ⚠️
internal/graph/lookupsubjects.go	0.00%	15 Missing ⚠️
pkg/schemadsl/parser/parser.go	0.00%	9 Missing ⚠️
pkg/schema/reachabilitygraphbuilder.go	11.12%	8 Missing ⚠️
pkg/schema/reachabilitygraph.go	0.00%	6 Missing ⚠️
pkg/schema/v2/operations.go	0.00%	5 Missing ⚠️
pkg/schemadsl/lexer/flags.go	0.00%	5 Missing ⚠️
... and 8 more

❌ Your project check has failed because the head coverage (39.56%) is below the target coverage (75.00%). You can increase the head coverage or adjust the target coverage.

❗ There is a different number of reports uploaded between BASE (5243b57) and HEAD (1307604). Click for more details.

HEAD has 27 uploads less than BASE

Flag BASE (5243b57) HEAD (1307604)

50 23

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #2785       +/-   ##
===========================================
- Coverage   78.50%   39.56%   -38.94%     
===========================================
  Files         458      414       -44     
  Lines       44253    40864     -3389     
===========================================
- Hits        34736    16163    -18573     
- Misses       6698    22828    +16130     
+ Partials     2819     1873      -946

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

tstirrat15

See comments

tstirrat15 · 2026-01-07T16:06:40Z

internal/graph/lookupresources2.go

+			case core.ReachabilityEntrypoint_SELF_ENTRYPOINT:
+				containingRelation := entrypoint.ContainingRelationOrPermission()


I don't completely understand this part of the implementation. Where is the self logic here? Or is it actually implemented elsewhere?

tstirrat15 · 2026-01-07T16:11:04Z

internal/services/integrationtesting/testconfigs/self.yaml

+  }
+
+  definition resource {
+    relation viewer: user#me_or_related | user


Should we refactor this to use an arrow, or is there something important about this being a userset?

tstirrat15 · 2026-01-07T16:12:10Z

pkg/composableschemadsl/compiler/compiler_test.go

+			withTenantPrefix,
+			`definition expressioned {


Why don't these need the use flags?

tstirrat15 · 2026-01-07T16:13:39Z

pkg/composableschemadsl/lexer/flaggablelexer.go


 	// Look for `use somefeature`
-	if nextToken.Kind == TokenTypeIdentifier {
+	if nextToken.Kind == TokenTypeIdentifier || nextToken.Kind == TokenTypeKeyword {


Why was this necessary? Is it because we've already reserved self?

We'll probably refactor this when we go and collapse composableschemadsl and schemadsl.

tstirrat15 · 2026-01-07T16:14:10Z

pkg/composableschemadsl/lexer/flags.go


+		return lexeme, false
+	},
+	// TODO add typechecking flag?


tstirrat15 · 2026-01-07T16:17:42Z

pkg/composableschemadsl/parser/parser.go

+	if !p.isKeyword("self") {
+		return nil, false


This seems like it's not necessary based on how this function is invoked. Is it worth keeping just so that the caller doesn't have to know that?

tstirrat15 · 2026-01-07T16:17:56Z

pkg/composableschemadsl/parser/parser.go

+
+	node := p.startNode(dslshape.NodeTypeSelfExpression)
+	p.consumeKeyword("self")
+	defer p.mustFinishNode()


Nit, move up

tstirrat15 · 2026-01-07T16:18:19Z

pkg/query/build_tree.go

+	case *schema.SelfReference:
+		return NewEmptyFixedIterator(), nil // TODO is this ok?


tstirrat15 · 2026-01-07T18:58:23Z

internal/services/integrationtesting/testconfigs/self.yaml

Need to update this - we're not actually checking the self relation because we're not asserting that a user is me_or_related to themselves.

…urce as a subject This backs out commit b8d86c4.

barakmich · 2026-01-07T22:15:01Z

pkg/query/self.go

+		}
+	}
+	// Return the empty set if none of the resources matches
+	return func(yield func(Path, error) bool) {}, nil


There's a helper for this (EmptyPathSeq()) but I went to find it and found more copies of this; so this is fine and I'll do a chore on it.

barakmich

Looks good from my end -- I checked pkg/query and pkg/schema/v2 thoroughly, and gave the parser a glance from my recollection of it

tstirrat15 · 2026-01-08T00:56:36Z

For anyone following along:

The integration tests are broken because the expected relations portion of the integration test harness makes an assumption that it can calculate all accessibility information based on the test relations defined in the validation file. That no longer holds for self-defined permissions, because they're fully synthetic and aren't represented by a relation.

Barak and I talked about how we might fix it both in the short term and the long term; I'd like to revisit that conversation on Monday and figure out whether we want to just get this PR through or come up with a better way of structuring the integration tests.

github-actions bot added area/schema Affects the Schema Language area/tooling Affects the dev or user toolchain (e.g. tests, ci, build tools) labels Dec 19, 2025

tstirrat15 force-pushed the reopen-self-relation-implementation branch from 68afbcc to 88b7ebc Compare December 19, 2025 22:43

tstirrat15 force-pushed the reopen-self-relation-implementation branch from 88b7ebc to 9885a51 Compare December 20, 2025 00:01

github-actions bot added the area/dispatch Affects dispatching of requests label Dec 20, 2025

miparnisari force-pushed the reopen-self-relation-implementation branch 6 times, most recently from 4fdb542 to 1230ce6 Compare December 31, 2025 06:02

tstirrat15 commented Jan 7, 2026

View reviewed changes

tstirrat15 marked this pull request as ready for review January 7, 2026 20:38

tstirrat15 requested a review from a team as a code owner January 7, 2026 20:38

tstirrat15 and others added 6 commits January 7, 2026 13:38

feat: Add support for self keyword in schema for referencing a reso…

bfc2c99

…urce as a subject This backs out commit b8d86c4.

chore: reimplement reachability bits

260cf7c

test: fix tests

aba5f72

chore: add flags

bc451e9

Update test

7081954

Fix self logic in query package

1307604

tstirrat15 force-pushed the reopen-self-relation-implementation branch from 4fcd516 to 1307604 Compare January 7, 2026 20:38

barakmich reviewed Jan 7, 2026

View reviewed changes

barakmich approved these changes Jan 7, 2026

View reviewed changes

tstirrat15 marked this pull request as draft January 8, 2026 04:59

		case core.ReachabilityEntrypoint_SELF_ENTRYPOINT:
		containingRelation := entrypoint.ContainingRelationOrPermission()

		case *schema.SelfReference:
		return NewEmptyFixedIterator(), nil // TODO is this ok?

feat: Add support for self keyword in schema for referencing a resource as a subject #2785

Are you sure you want to change the base?

feat: Add support for self keyword in schema for referencing a resource as a subject #2785

Uh oh!

Conversation

tstirrat15 commented Dec 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

TODO

Changes

Testing

Uh oh!

codecov bot commented Dec 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

tstirrat15 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

barakmich Jan 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

barakmich left a comment

Choose a reason for hiding this comment

Uh oh!

tstirrat15 commented Jan 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

feat: Add support for `self` keyword in schema for referencing a resource as a subject #2785

feat: Add support for `self` keyword in schema for referencing a resource as a subject #2785

tstirrat15 commented Dec 19, 2025 •

edited

Loading

codecov bot commented Dec 19, 2025 •

edited

Loading

barakmich Jan 7, 2026 •

edited

Loading