Conceptual Question according Relations

[pommelinho]

Hey!

I have a rather more conceptual question according storing relations in Ory Keto.
Let's say we have the following example:
We have users which are members of a certain Team. User or Users of Team can be granted access to specific files.

files:file1#access@user2
files:file1#access@teams:team1#member
teams:team1#member@user1

So the example above would mean that user2 and user1 have access to file1.

Let's say now in my web app there is a page where all the users for a certain team are listed. To get them i have a REST request which gives me all the users for a certain team. In my ER and thus in my relational database the relation between team and user would be saved by a foreign key in the user data (i.e. teamId). However this relation is now also stored in Keto by teams:team1#member which i need to build the relationship file access userset.

My question is now: In these cases would you additionally store the relation "member of a team" in the application backend (i.e. relational database) or is it then sufficicent to just store it in or Keto?
For me this question is interesting as moving to keto could mean that a lot of relations are moved from the relational database of my app to keto ?!

[zepatrik]

So as Keto is using a database as well, the data are backed up in the same way as they would be in your application. If you can, I would recommend you use Keto as the only source of truth and don't replicate the data. If on the other hand you need the data a lot and don't want to add the network latency, the solution would be the watch API. Maybe you can give more insight on why exactly you need to replicate the data in your application?
One other possibility would be to connect to Keto's database and get the data from there. That is however quite a hacky solution.

[pommelinho]

Thanks for your response.

Currently we would simply store relations and thus handling ACLs in our backend/database. Do you think it still makes sense to use Ory Keto although only one applications is using the relations?

[zepatrik]

If your ACL structure is fixed forever and has a very basic structure, it is probably not worth it. But if you plan on adding features later on, you would have to implement and test them yourself. Keto on the other hand probably just need a few more lines of config to add a new feature (depending on the feature of course).
If it is very simple now you could also design it in a way to later enable simple migration/translation to Keto.