From 6f11f1d94bfc1d6ef9fa547a8adb26f65b1f797f Mon Sep 17 00:00:00 2001
From: ecordell <cordell.evan@gmail.com>
Date: Mon, 19 Oct 2026 08:53:39 -0400
Subject: [PATCH] Fix example and lots-of-data scripts

lots-of-data.yaml wrote 1003 updates per call, above the SpiceDB limit
of 1000. Write the three parent relationships and the 1000 tokens as
separate calls. The data volume does not change.

The checkbulk script in example.yaml expected permissions that the
data does not give: one check raced the write and delete scripts, and
the others used the reader relation where the data needs view or edit.
Check view and edit on the seeded firstdoc relationships instead.
---
 scripts/example.yaml      | 12 ++++++++----
 scripts/lots-of-data.yaml |  3 +++
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/scripts/example.yaml b/scripts/example.yaml
index ec76ed3..6233df4 100644
--- a/scripts/example.yaml
+++ b/scripts/example.yaml
@@ -72,12 +72,16 @@ weight: 30
 steps:
   - op: "CheckBulkPermissions"
     checks:
-      - resource: "{{ .Prefix }}resource:seconddoc"
+      - resource: "{{ .Prefix }}resource:firstdoc"
+        subject: "{{ .Prefix }}user:tom"
+        permission: "view"
+      - resource: "{{ .Prefix }}resource:firstdoc"
         subject: "{{ .Prefix }}user:fred"
-        permission: "reader"
+        permission: "view"
       - resource: "{{ .Prefix }}resource:firstdoc"
         subject: "{{ .Prefix }}user:tom"
-        permission: "reader"
+        permission: "edit"
       - resource: "{{ .Prefix }}resource:firstdoc"
         subject: "{{ .Prefix }}user:fred"
-        permission: "reader"
+        permission: "edit"
+        expectNoPermission: true
diff --git a/scripts/lots-of-data.yaml b/scripts/lots-of-data.yaml
index b9a24e0..b27e4e7 100644
--- a/scripts/lots-of-data.yaml
+++ b/scripts/lots-of-data.yaml
@@ -16,6 +16,9 @@ steps:
     resource: {{ $.Prefix }}tenant:ps_{{ $j }}
     subject: {{ $.Prefix }}client:client_{{ $j }}#token
     relation: writer
+# SpiceDB accepts at most 1000 updates per write, so the tokens go in their own write.
+- op: WriteRelationships
+  updates:
 {{- range $i := enumerate 1000 }}
   - op: TOUCH
     resource: {{ $.Prefix }}client:client_{{ $j }}