26 replies

Advice for policy simplicity

Hey, I'm just getting into policies and wanted some advice on how to make this easy to work with.

So I want all code interface actions to permit calling any function from the application itself or IEx. But I want all external callers to be verified for access. Is this a good start?

elixir 
  policies do
    default_access_type :strict

    policy actor_present() do
      authorize_if actor_attribute_equals(:admin?, true)
    end

    policy actor_absent() do
      authorize_if always()
    end
  end

elixir 
  policies do
    default_access_type :strict

    policy actor_present() do
      authorize_if actor_attribute_equals(:admin?, true)
    end

    policy actor_absent() do
      authorize_if always()
    end
  end

If I understand it correctly, this means that if an actor is absent or authorize? is false, the caller is authorized. If an actor is present we check if they are an admin. The Admin UI always disables authorization I think, and if I don't give any extra arguments in my code interface functions then they will go through too.

Is this a good design? What is the performance impact? Or would it better to make separate actions that are only exposed externally and not in the code interface and authorize only those?

Solution

This option:

define :foo, default_options: [authorize?: false]

define :foo, default_options: [authorize?: false]

Jump to solution

Ash Framework•9mo ago•

26 replies

Sienhopist

Advice for policy simplicity

elixir 
  policies do
    default_access_type :strict

    policy actor_present() do
      authorize_if actor_attribute_equals(:admin?, true)
    end

    policy actor_absent() do
      authorize_if always()
    end
  end

elixir 
  policies do
    default_access_type :strict

    policy actor_present() do
      authorize_if actor_attribute_equals(:admin?, true)
    end

    policy actor_absent() do
      authorize_if always()
    end
  end

Solution

This option:

define :foo, default_options: [authorize?: false]

define :foo, default_options: [authorize?: false]

Jump to solution

Advice for policy simplicity

Advice for policy simplicity

Similar Threads

Similar Threads

Similar Threads