AshCredo.Check.Warning.AuthorizeFalse (ash_credo v0.17.1)

Basics

This check has a base priority of high and works with any version of Elixir.

Explanation

Passing authorize?: false bypasses Ash authorization entirely, which makes it easy to skip policy checks by accident. Prefer passing the caller's actor, so policies stay enforced. Only when no user is acting, such as in background jobs or seeds, use a named system actor with a bypass policy, which keeps the bypass explicit and auditable.

# Bad - skips all authorization
Ash.read!(query, authorize?: false)

# Good - authorizes as the logged-in user
Ash.read!(query, actor: current_user)

# Good when no user is acting - uses a named system actor
Ash.read!(query, actor: %{system: :my_context})

# In resource policies:
bypass expr(not is_nil(^actor(:system))) do
  authorize_if always()
end

Code inside action changes or validations sometimes needs to read related data. There, use scope: context to inherit the caller's authorization context:

Ash.get!(Resource, id, scope: context)

By default, the check flags authorize?: false anywhere it appears as a literal: Ash API calls, action DSL definitions, variable assignments, and wrapper functions. Set include_non_ash_calls: false to restrict detection to Ash API calls and action DSL definitions.

The check excludes test directories by default, since bypassing authorization in test setup and factories is usually intentional. Override excluded_paths to scope the check differently.

In either mode, the check is purely syntactic: it cannot follow values through variables, config lookups, or function return values.

Check-Specific Parameters

Use the following parameters to configure this check:

:include_non_ash_calls

When true (the default), flags authorize?: false anywhere it appears in the source. When false, only checks Ash API calls and action DSL definitions.

This parameter defaults to true.

:excluded_paths

Paths or regexes to exclude from this check. Defaults to the test directories, since authorize?: false is intentional in test setup.

This parameter defaults to [~r/\/test\//, "test"].

General Parameters

Like with all checks, general params can be applied.

Parameters can be configured via the .credo.exs config file.