# `AshGrant.Preparations.ApplyMasking`
[🔗](https://github.com/jhlee111/ash_grant/blob/v0.14.1/lib/ash_grant/preparations/apply_masking.ex#L1)

Ash Resource Preparation that applies field masking to read results.

When a field group defines `mask` and `mask_with`, this preparation replaces
visible field values with masked versions for actors whose field group level
specifies masking for those fields.

Masking follows allow-wins semantics: if any of the actor's field groups
provides unmasked access to a field, the field is not masked.

## How It Works

1. The preparation adds an `after_action` hook to the query
2. After records are fetched (but before field restriction), the hook:
   - Resolves the actor's field groups from permissions
   - Determines which fields should be masked (allow-wins)
   - Replaces visible field values with masked values
3. Ash's `restrict_field_access` then runs, hiding truly forbidden fields

# `init`

# `supports`

---

*Consult [api-reference.md](api-reference.md) for complete listing*