Show HN: EACL – ReBAC Authorization in Clojure and Datomic Based on SpiceDB

Hi HN, Petrus here from Cape Town, South Africa. I spent the better half of 2024 integrating our Clojure-based cloud provisioning platform at CloudAfrica with SpiceDB, a scalable ReBAC based authorization system based on Zanzibar, Google's globally-consistent authorization system.

The problem with any external authorization system is modelling & synchronization: SpiceDB has a text-based schema DSL to define Relations & Permissions and it models Relationships as 3-tuples of `[subject relation resource]`.

However, in Datomic we had attributes like `:account/owner`, `:server/account`, `:vpc/account` and `:vpc/viewers`. Figuring out which Relationships to create or delete in SpiceDB when anything changed became a diffing + batched sync problem, especially with an impedance mismatch between our data and our permission schema.

I realized that if we modelled our AuthZ Relationships directly in Datomic, all our syncing problems would go away: you can simply tail the Datomic transactor queue and instantly create or delete Spice relationships in real-time. But once you do that, you might as well model the permission schema as well, and if you go one step further, you can implement the permission graph traversal directly in Clojure to avoid a network hop. And that is exactly what EACL became.

EACL (Enterprise Access ControL) is an embedded authorization library that lives next to your data in Datomic and avoids an external network I/O hop. EACL is suitable for small-to-medium scale, while giving you the option to migrate to SpiceDB in future when you need more scale and consistency semantics.

EACL implements the SpiceDB gRPC API as an idiomatic Clojure protocol (`IAuthorization`), using Datomic as a backing graph store. So you can easily add sophisticated authorization to your Clojure project and sync to Spice later.

Internally, EACL uses direct `datomic.api/index-range` queries to efficiently traverse the permission graph. The goal for EACL is to provide best-in-class authorization for Clojure & Datomic for <10M entities.

EACL has been open-sourced under AGPL, but we are likely to relicense it under a more permissive licence. EACL is used at CloudAfrica, a regional cloud host based in South Africa (https://cloudafrica.net).