View Source Ash.Policy.Info (ash v2.14.17)

An authorization extension for ash resources.

For more information, see Ash.Policy.Authorizer

Summary

Functions

A utility to determine if an actor is or may be authorized for a given action/query/changeset.

A utility to determine if an actor is or may be authorized for a given action.

Gets the field policies relevant to a given field

Whether or not Ash policy authorizer is configured to log policy breakdowns

Whether or not Ash policy authorizer is configured to log successful policy breakdowns

Whether or not Ash policy authorizer is configured to show policy breakdowns in error messages

A utility to determine if a given query/changeset would pass authorization.

Types

@type can_option() :: {:api, module()} | {:maybe_is, boolean() | :maybe}
@type can_option?() :: {:api, module()} | {:maybe_is, boolean()}
@type request() :: Ash.Engine.Request.t()

Functions

Link to this function

can(resource, action_or_query_or_changeset, actor, opts \\ [])

View Source
This function is deprecated. Please use `YourApi.can` instead..
@spec can(
  Ash.Resource.t(),
  atom() | Ash.Resource.Actions.action() | Ash.Query.t() | Ash.Changeset.t(),
  map() | nil,
  [can_option()]
) :: boolean() | :maybe

A utility to determine if an actor is or may be authorized for a given action/query/changeset.

This only runs the "strict check" portion of policies, meaning that it can return :maybe in some cases. If you have access_type :runtime in any of your policies, then you may get :maybe from this function. To customize what is returned in the case of :maybe you can provide the maybe_is option, i.e maybe_is: true. This makes sense when you want to a show a button, but only if the user may be able to perform the action.

For read actions, an important thing to factor in here is that typically policies just end up filtering the action. This means that even if you try to read something you can't read, your read action will succeed but nothing will be returned, and this function would return true.

Link to this function

can?(resource, action_or_query_or_changeset, actor, opts \\ [])

View Source
This function is deprecated. Please use `YourApi.can?` instead..

A utility to determine if an actor is or may be authorized for a given action.

A shortcut for calling can/4 but with the maybe_is option defaulting to false, so this should always return a boolean.

See the documentation of can/4 for more.

Link to this function

default_access_type(resource)

View Source
Link to this function

describe_resource(resource)

View Source
Link to this function

field_policies(resource)

View Source
Link to this function

field_policies_for_field(resource, field)

View Source

Gets the field policies relevant to a given field

Whether or not Ash policy authorizer is configured to log policy breakdowns

Link to this function

log_successful_policy_breakdowns()

View Source

Whether or not Ash policy authorizer is configured to log successful policy breakdowns

Link to this function

show_policy_breakdowns?()

View Source

Whether or not Ash policy authorizer is configured to show policy breakdowns in error messages

Link to this function

strict_check(actor, query, api)

View Source

A utility to determine if a given query/changeset would pass authorization.

This is still experimental.