Spark DSL transformer that auto-generates policies when default_policies is enabled.

This transformer runs at compile time and automatically generates the standard AshGrant policy configuration, reducing boilerplate for common use cases.

Configuration

Enable in your resource's ash_grant block:

ash_grant do
  resolver MyApp.PermissionResolver
  default_policies true  # or :all, :read, :write
end

Options

Generated Policies

When default_policies: true or :all:

policies do
  policy action_type(:read) do
    authorize_if AshGrant.filter_check()
  end

  policy action_type([:create, :update, :destroy]) do
    authorize_if AshGrant.check()
  end

  policy action_type(:action) do
    authorize_if AshGrant.check()
  end
end

Implementation Details

This transformer:

• Runs before Ash.Policy.Authorizer to inject policies
• Uses Spark.Dsl.Transformer.add_entity/3 to add policy entities
• Sets appropriate access_type (:filter for read, :strict for write)

See Also

• AshGrant.Check - SimpleCheck for write actions
• AshGrant.FilterCheck - FilterCheck for read actions
• AshGrant.Info.default_policies/1 - Query the setting at runtime