eacl

oblem-with-extern... IMO, if you need fine-grained permissions, EACL is currently best-in-class for the Clojure ecosystem. EACL is especially suited to Electric Clojure applications and can be used to populate menus in real-time. EACL would not have been possible to build solo in my spare time without modern AI models to rapidly implement specifications and test against human-written tests. Here is a ~7-minute screen recording of EACL used from an Electric Clojure application for real-time ReBAC queries: https://x.com/PetrusTheron/status/1996344248925294773

chema. I realized that if we modelled our AuthZ Relationships directly in Datomic, all our syncing problems would go away: you can simply tail the Datomic transactor queue and instantly create or delete Spice relationships in real-time. But once you do that, you might as well model the permission schema as well, and if you go one step further, you can implement the permission graph traversal directly in Clojure to avoid a network hop. And that is exactly what EACL is. EACL (Enterprise Access ControL) is an embedded authorization library that lives next to your data in Datomic and avoids an external network hop. EACL is suitable for small-to-medium scale, while giving you the option to migrate to SpiceDB in future when you need more scale and consistency semantics. EACL implements the SpiceDB gRPC API as an idiomatic Clojure protocol (`IAuthorization`), using Datomic as a backing graph store. So you can add sophisticated authorization to your Clojure project on day one and migrate to SpiceDB later. Internally, EACL recursively traverses the permission graph using direct index-based calls (via `datomic.api/index-range`) to efficiently answer `CheckPermission`, `LookupSubjects` and `LookupResources` queries. The goal for EACL is to provide best-in-class authorization for Clojure & Datomic applications with <10M entities. It is especially suited to Electric Clojure[^3]. EACL has been open-sourced under the AGPL, but we are likely to relicense it under a more permissive licence. EACL is used at CloudAfrica, a regional cloud host based in South Africa. [^1]: https://cloudafrica.net [^2]: https://authzed.com/spicedb [^3]: https://electric.hyperfiddle.net/