ash_policy_authorizer v0.1.6 AshPolicyAuthorizer.Authorizer.Policy View Source

Link to this section Summary

Functions

A policy has a name, a condition, and a list of checks.

Link to this section Functions

Link to this macro

policy(opts \\ [])

View Source (macro)

A policy has a name, a condition, and a list of checks.

Checks apply logically in the order they are specified, from top to bottom. If no check explicitly authorizes the request, then the request is forbidden. This means that, if you want to "blacklist" instead of "whitelist", you likely want to add an authorize_if always() at the bottom of your policy, like so:

policy do
  forbid_if not_logged_in()
  forbid_if user_is_blacklisted()
  forbid_if user_is_in_blacklisted_group()

  authorize_if always()
end

Options

  • :name - Required. A short name or description for the policy, used when explaining authorization results

  • :condition - A check that must be true in order for this policy to apply.

If the policy does not apply, it is not run, and some other policy will need to authorize the request. If no policies apply, the request is forbidden. If multiple policies apply, they must each authorize the request.