Ash Elixir•2y ago

Policy vs FieldPolicy

I haven't used FieldPolicy before, but lets say I have a :role attribute that I want to control changes to. I.e: :god should be able to create users with all roles, :admin should only be able to create :admin and :user, and :user should not be able to create any roles - but still able to edit their own account i.e: change their email etc. Would a field policy be the place for that these days?

16 Replies

ZachDaniel•2y ago

field policies are only for reading, not for modifying So you'd use policies in your case

kernelOP•2y ago

👍🏿 cheers 🙂

ZachDaniel•2y ago

We may extend field policies into writing as well, but it will require new kinds of checks and that kind of thing

kernelOP•2y ago

so field policies are specifically for the field to be populated in the struct? i.e: only supervisors can see a certain attribute

ZachDaniel•2y ago

yep, exactly when a field policy fails, its value is replaced with %Ash.ForbiddenField{}

kernelOP•2y ago

I'm going to get GPT to read the docs and add an ELI5 section at the top of each section 🤣

ZachDaniel•2y ago

and hidden in APIs accordingly lol, honestly not a bad idea dude

kernelOP•2y ago

prompt: "Assume I'm an idiot" 🤣

ZachDaniel•2y ago

😆 GPT behind the scenes: "way ahead of you" I really want to get back to do a documentation push, bt I need to finish the other features I'm working on first Probably another month or two, but maybe more

kernelOP•2y ago

Field policies in Ash Framework authorize field access. All fields need a policy if any is defined; use :* for a catch-all. Primary keys are always readable. Ash.Policy.Authorizer mandates policies for all actions; use an "allow-all" policy for exceptions. Field policies can't refer to related entities, except with exists. Forbidden fields return as %Ash.ForbiddenField{} and evaluate to nil in filters.

Field policies in Ash Framework authorize field access. All fields need a policy if any is defined; use :* for a catch-all. Primary keys are always readable. Ash.Policy.Authorizer mandates policies for all actions; use an "allow-all" policy for exceptions. Field policies can't refer to related entities, except with exists. Forbidden fields return as %Ash.ForbiddenField{} and evaluate to nil in filters.

not bad tbh pretty much lol

kernelOP•2y ago

ZachDaniel•2y ago

its a bit terse, and I'd probably add the addendum about only being used for reads but it is a good start

kernelOP•2y ago

yup I asked it to be terse haha

kernelOP•2y ago

before asking it to be terse

ZachDaniel•2y ago

We should make a bot that makes ELI5 PRs to repos 😆

kernelOP•2y ago

maintainers would love us!

Gaming

Programming

Policy vs FieldPolicy

Did you find this page helpful?