AshCredo.Check.Warning.AuthorizerWithoutPolicies (ash_credo v0.17.1)

Basics

This check has a base priority of high and works with any version of Elixir.

Explanation

A resource that declares Ash.Policy.Authorizer but defines no policies denies all actions by default. An empty policies block has the same effect. This is almost always unintentional.

Either add policies:

policies do
  policy action_type(:read) do
    authorize_if actor_attribute_equals(:active, true)
  end
end

Or remove the authorizer if you don't need authorization yet.

The check uses Ash's runtime introspection (Ash.Resource.Info.authorizers/1 and Ash.Policy.Info.policies/1) to read the fully resolved authorizer and policy lists, so it correctly handles authorizers added by extensions and policies declared in Spark.Dsl.Fragment modules - cases an AST scanner cannot see.

Requirements

Compile your project before running mix credo. If Ash is not available in the VM running Credo, the check is a no-op and emits a single diagnostic.

Check-Specific Parameters

There are no specific parameters for this check.

General Parameters

Like with all checks, general params can be applied.

Parameters can be configured via the .credo.exs config file.