ZenStack Github Copilot Integration

[jiashengguo]

We plan to integrate ZenStack with the GitHub copilot to assist you with the ZModel schema. To ensure it’s as helpful as possible, we’d love to hear your feedback. Feel free to share your thoughts, including but not limited to the following questions:

• What challenges do you commonly face when working with the ZModel schema?
• What specific assistance would you expect Copilot to provide?
• Anything else you would like to suggest?

[HungryDogStudios]

For me Access policy writing is still a little bit cumbersome and can be hard to test with fast iteration.
I think the tools and capabilities that have been made are really awesome and I'd like to see it continue to develop.
So if Co-pilot can help me write and test access policies somehow, I'd be very happy.
I think validation can also fall into the same motivation, but I haven't used it so much.

[alex-zwingli]

• Help writing access policies: Describe the type of policy, then it suggests how to write it
• Help verifying access: Describe what is trying to be done, then it returns if it will be approved or denied
• Peer review: Review my current policies and suggest how they could be better such as consolidating statement to be DRY, find gaps, etc.
• Validator helper: Suggests validators for fields without additional prompt, or suggest validators based on specific prompts
• Discover tips: There are still features in Zenstack that I'm not fully using, so it would be great to get some ideas of what else I could implement.

[simoami]

My opinion is that it's not easy to suggest policies without knowing your access policy model: RBAC ABAC, ACL...etc, as well as your data structure defining it and whether you have multi-tenancy and teams and memberships in your setup.

For example, roles can be attached directly to the User model, to a Membership (userId, tenantId) model or to a TeamMembership (userId, teamId) model . Roles can be defined as enums (e.g. admin, member) or further broken down into permissions/privileges (e.g. org:manage, member:read). All these variations would make it challenging to produce proper output in my opinion without further instructions to copilot.