Fork me on GitHub
#datomic
<
2022-09-06
>
Ben Grabow18:09:03

I am considering the suitability of Datomic Cloud for my org, and I am faced with the challenge of managing data ownership of many entities and attributes. We have several teams, each of which has their own domain of system ownership, and it makes sense to me that our system would somehow enforce the ownership of attributes such that only certain teams or processes are allowed to write to those attributes. I think what I'm looking for is essentially an ACL (access control list). Is this a good idea? What approaches are available for implementing this? Ideally I would implement this in the database itself, rather than in code that wraps the transact function, so that I could say definitively that the system behaves this way without a way to get around it.

1
JohnJ18:09:08

unless you really want to write a lot of code, postgres gives you all of this for free

Ben Grabow19:09:09

Postgres is off the table for now for other reasons. I'm most interested in how others have tackled this problem in Datomic Cloud (or in Datomic On-Prem if there's a significant difference).

JohnJ20:09:01

maybe others know better but I can see only two options, use custom transaction functions (what you are asking for)(https://docs.datomic.com/cloud/transactions/transaction-functions.html#custom) which can affect performance heavily or write your own abstraction at the application layer.

Ben Grabow20:09:03

I suppose a restatement of my problem in more general terms is: "How do you keep track of what part of your system is doing what, when you have a large system and a large organization managing that system, and each part of the system has unconstrained write access to a shared datomic instance?"

Ben Grabow20:09:18

With datomic on-prem I would have guessed the answer is "have a separate datomic instance for each domain of ownership. Constrain writes to a single instance at a time, and join reads across instances" but my understanding is this "join reads across instances" is not supported by Datomic Cloud.

JohnJ20:09:20

sounds like what you need is event sourcing

Ben Grabow20:09:17

I should clarify that the problem is not just about tracking what happened in the past, but about establishing certainty around what the system will do in the future.

Ben Grabow20:09:23

I don't think event sourcing really addresses either the historical or the forward-looking aspects of this problem.

JohnJ20:09:23

you changed the original goal then came back to the original goal, don't know

JohnJ20:09:08

anyway, datomic is a dumb database, in the sense that the smarts are mostly done using something else or writing the code in the app layer

Jarrod Taylor (Clojure team)22:09:29

@UANMXF34G Keeping track of vs enforcing can be a pretty large gap. For the former you can https://docs.datomic.com/cloud/transactions/transaction-processing.html#reified-transactions to capture arbitrary information. I have seen this used to store a variety of data about who performed a transaction (user|system|etc) as well as why a transaction was made. A Datomic cloud system can also support connections to multiple databases if that better addresses your problem.

Kris C05:09:11

This presentation might contain the info you need: https://youtu.be/7lm3K8zVOdY

Ben Grabow18:09:17

@U0508JRJC Thanks for your response! It's news to me that Datomic Cloud can support connections to multiple DBs. Can you help me locate more information about that? The info I had found indicated that Datomic Cloud queries could only run against one database. https://forum.datomic.com/t/joining-across-databases-in-datomic-cloud/1632/2

Jarrod Taylor (Clojure team)18:09:12

You can for sure def connections to multiple DBs and query each as needed. You cannot join across multiple DBs.

Ben Grabow19:09:52

Hmm, yes that would be a significant downgrade in power for what I have in mind.