From spicedb-dev
Use when writing tests for SpiceDB authorization, generating test fixtures, designing positive/negative test scenarios, or verifying permission correctness - provides patterns for fixture generation, integration testing, and negative test coverage
npx claudepluginhub authzed/authzed-marketplace --plugin spicedb-devThis skill uses the workspace's default tool permissions.
This skill provides guidance on testing SpiceDB-based authorization systems, including test data fixture generation, test scenario design, and integration testing patterns.
Implements structured self-debugging workflow for AI agent failures: capture errors, diagnose patterns like loops or context overflow, apply contained recoveries, and generate introspection reports.
Monitors deployed URLs for regressions in HTTP status, console errors, performance metrics, content, network, and APIs after deploys, merges, or upgrades.
Provides React and Next.js patterns for component composition, compound components, state management, data fetching, performance optimization, forms, routing, and accessible UIs.
This skill provides guidance on testing SpiceDB-based authorization systems, including test data fixture generation, test scenario design, and integration testing patterns.
Testing authorization requires:
Good authorization tests cover both positive cases (access granted) and negative cases (access denied), and test edge cases like hierarchical inheritance and complex permission rules.
| Need to... | Read This |
|---|---|
| Find test scenario patterns | references/test-patterns.md |
| Generate fixture data | references/fixture-generators.md |
| See a complete Go test suite | examples/go_test.go |
| See SpiceDB assertion tests | examples/assertions.yaml |
| See load/perf testing | examples/load_test.py |
Fixtures establish the relationship graph for testing. Organize by scenario, using your schema's actual definition and relation names (not generic placeholders).
See references/fixture-generators.md for fixture structure patterns and helper
functions in Go, Python, and TypeScript.
Use /spicedb-dev:test-permissions to generate fixtures directly from a schema.
See references/test-patterns.md for the complete scenario library with 14 patterns covering:
direct access, role-based access, hierarchical inheritance, sharing (wildcard and domain),
complex multi-path, revocation, edge cases, caveated permissions, and CI integration patterns.
Integration tests verify authorization in the context of your application.
Pattern: Setup, execute, verify, cleanup.
See examples/go_test.go for a complete Go test suite demonstrating:
serve-testing isolation (unique preshared key per test)See references/fixture-generators.md for Go, Python, and TypeScript helper functions.
Use SpiceDB's built-in assertion testing (see examples/assertions.yaml for a
complete example). Run with zed validate assertions.yaml.
Supports three assertion types:
assertTrue -- must return HAS_PERMISSIONassertFalse -- must return NO_PERMISSIONassertCaveated -- caveat exists but context not fully provided; result is conditionalIf you find yourself:
references/test-patterns.mdreferences/fixture-generators.mdFullyConsistent in tests to avoid flakinessspicedb-schema-design skill for that/spicedb-dev:implement-spicedb-checks or /spicedb-dev:implement-spicedb-relationships for that/spicedb-dev:test-permissions for thatFor every positive test (access granted), write a corresponding negative test (access denied). Key denial patterns: no relationship, insufficient role, revoked access, cross-tenant isolation, hierarchical boundary.
See references/test-patterns.md for the full pattern library with 14 scenarios.
See examples/load_test.py for a load test with latency reporting. Targets:
CheckPermission <10ms (p95), WriteRelationships <50ms (p95), LookupResources <100ms (p95).
For detailed testing patterns:
references/test-patterns.md - Comprehensive test pattern libraryreferences/fixture-generators.md - Fixture generation utilitiesWorking test examples in examples/:
examples/go_test.go - Complete Go test suiteexamples/assertions.yaml - SpiceDB assertion testsexamples/load_test.py - Performance testing examplesWorkflow summary: Define test scenarios → Create fixtures → Write positive tests → Write negative tests (one per positive) → Add edge cases → Run with assertion file or integration test. Always fail-safe: deny by default, test denials as rigorously as grants.