Auto generated `reset_password_with_token` not loading user
Hi everyone! I’m trying to expose the auto-generated
reset_password_with_token
reset_password_with_token
action via Ash GraphQL, but I keep getting a
not_found
not_found
error no matter what I try.
Here’s my setup (auto generated):
update :reset_password_with_token do argument :reset_token, :string do allow_nil? false sensitive? true end argument :password, :string do description "The proposed password for the user, in plain text." allow_nil? false constraints min_length: 8 sensitive? true end argument :password_confirmation, :string do description "The proposed password for the user (again), in plain text." allow_nil? false sensitive? true end # validates the provided reset token validate AshAuthentication.Strategy.Password.ResetTokenValidation # validates that the password matches the confirmation validate AshAuthentication.Strategy.Password.PasswordConfirmationValidation # Hashes the provided password change AshAuthentication.Strategy.Password.HashPasswordChange # Generates an authentication token for the user change AshAuthentication.GenerateTokenChangeend
update :reset_password_with_token do argument :reset_token, :string do allow_nil? false sensitive? true end argument :password, :string do description "The proposed password for the user, in plain text." allow_nil? false constraints min_length: 8 sensitive? true end argument :password_confirmation, :string do description "The proposed password for the user (again), in plain text." allow_nil? false sensitive? true end # validates the provided reset token validate AshAuthentication.Strategy.Password.ResetTokenValidation # validates that the password matches the confirmation validate AshAuthentication.Strategy.Password.PasswordConfirmationValidation # Hashes the provided password change AshAuthentication.Strategy.Password.HashPasswordChange # Generates an authentication token for the user change AshAuthentication.GenerateTokenChangeend
GraphQL block:
mutations doupdate :reset_password_with_token, :reset_password_with_token do identity :unique_emailendaction :request_password_reset_token, :request_password_reset_token
mutations doupdate :reset_password_with_token, :reset_password_with_token do identity :unique_emailendaction :request_password_reset_token, :request_password_reset_token
I also tried without the identity block and passing the token in headers - no luck. Shouldn’t the token automatically load the user? Or am I missing a step? Would really appreciate help from anyone who’s done this before!
Solution
seems like:
bypass action(:read) do authorize_if expr(id == ^actor(:id))end
bypass action(:read) do authorize_if expr(id == ^actor(:id))end
is the issue after switching it to
authorize_if always()
authorize_if always()
it works now. I wonder how can I prevent users from reading the info of other users?
The Elixir backend framework for unparalleled productivity. Declarative tools that let you stop wasting time. Use with Phoenix LiveView or build APIs in minutes for your front-end of choice.