Hello all! Alex DeBrie thanks for the fantastic book. I've leveled up quite a bit in DynamoDB and NoSQL data modeling thanks to your work.
I'm implementing a basic RBAC model more or less straight from the book where the table has a SS attribute called 'admin_role' and I use an update operation to ADD user identifiers to the set to reflect the grant.
When I initialize the organization object in python I default the 'admin_role' object to an empty string set with `admin_role = set([""])`.
Then, when I add the first user to the role, I end up with an empty string plus the new userid I added. So it's something like `["", "userid"]`. I don't want an empty string in there because I have a ConditionExpression of `ConditionExpression=Attr('admin_role').contains(requester)`. I can check for the presence of an empty item in the string set and delete it if length of the string set is > 1 but this seems a bit hacky.
Is there standard pattern for dealing with this situation? Is there a recommended way to model RBAC in DynamoDB specifically for a SaaS app?
I'm implementing a basic RBAC model more or less straight from the book where the table has a SS attribute called 'admin_role' and I use an update operation to ADD user identifiers to the set to reflect the grant.
When I initialize the organization object in python I default the 'admin_role' object to an empty string set with `admin_role = set([""])`.
Then, when I add the first user to the role, I end up with an empty string plus the new userid I added. So it's something like `["", "userid"]`. I don't want an empty string in there because I have a ConditionExpression of `ConditionExpression=Attr('admin_role').contains(requester)`. I can check for the presence of an empty item in the string set and delete it if length of the string set is > 1 but this seems a bit hacky.
Is there standard pattern for dealing with this situation? Is there a recommended way to model RBAC in DynamoDB specifically for a SaaS app?
Hey Jared Trog ! Glad you're enjoying the book :)
I used to have the same problem, and it drove me crazy. I can't find the code example I want but I think you can do the following:
1) Don't initialize with a set with an empty string. When you add your first element to the set, you can use if_not_exists(#set, :set) to initialize the attribute.
2) When checking for existence, you can do an OR check to first check that the set exists and then check if it contains the requester.
I'm not 100% sure that step (1) will work so will need to try it. If it doesn't work, you'll just need to initialize like you're doing and leave the empty string in there. I don't think the empty string should change the logic?
I used to have the same problem, and it drove me crazy. I can't find the code example I want but I think you can do the following:
1) Don't initialize with a set with an empty string. When you add your first element to the set, you can use if_not_exists(#set, :set) to initialize the attribute.
2) When checking for existence, you can do an OR check to first check that the set exists and then check if it contains the requester.
I'm not 100% sure that step (1) will work so will need to try it. If it doesn't work, you'll just need to initialize like you're doing and leave the empty string in there. I don't think the empty string should change the logic?
