Post

ive decided to just do a thread about the why's and how's of permissioned data in contrail instead of a blog post, cause i'm lazy, so here it goes: 1/9

- that means there's a simple ACL with read/write access for everyone in a space & people can create, list, delete etc spaces using xrpc endpoints - similarly record CRUD is as close to the normal putRecord, deleteRecord, listRecords, getRecords, etc xrpcs as possible (just with an extra space uri)

- auth works using service auth tokens (like bluesky dms) and contrail instances publish a permission set with all the xrpc calls for convenience, so other apps can access the permissioned data a user has access to too

- once permissioned data actually lands, the contrail instance slowly moves stuff over, your app just keeps using contrail for reading/writing and those get directed to the correct place (if already migrated a users pds, otherwise your db)