rapidfsub
Here is a test code about my question.
https://github.com/rapidfsub/sonet/blob/develop/test/sonet_lib/ash/policies/common_test.exs#L92
And here is a resource code about my question.
https://github.com/rapidfsub/sonet/blob/develop/test/support/lib/sonet_lib/seven_eleven/product.ex
Brief overview about my test
- resource: Store, Inventory, Product
- actor: Customer
- actions:
Store.purchasecallsInventory.purchasethrumanage_relationship.
Inventory.purchasecallsProduct.purchasethrumanage_relationship. - policies:
Store.purchasechecks open and close time.
Inventory.purchasechecks inventory count.
Product.purchasechecks customer’s age.
Question
Product.purchase update action is an empty action with policies.
Even if it does nothing, but I want to check policies always.
-
With
require_atomic? falsein action, always check policies.
Without it, never check policies. Is this intended behavior? -
Using
require_atomic? falseto force policy check is weird,
and I foundaccess_type :strictforces policy check.
Empty action withaccess_type :filterskips policy check.
Is this intended behavior?
+ small questions (not related to content)
- How can I auto generate
postgres schemamigration? Should I write it manually?
Where Next?
Trending in Questions
Other Trending Topics
Latest Ash Threads
Latest on Elixir Forum
Sponsor Spotlight
At WyeWorks, we believe great software is built by combining technical excellence with genuine human connection
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #library
- #deployment
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #podcasts
- #javascript
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #ai
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #blog-post
- #elixirconf-us
- #elixir-ls
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #elixirconf-eu
- #api
- #forms
- #security
- #metaprogramming
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Elixir, Erlang & BEAM conferences from Code Sync - join us in 2026!
Master modern tools, write cleaner code, and tackle real-world challenges.
Bringing learning, work and compliance together since 1987.
Producing high quality Elixir screencasts since 2017.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
First Post!- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
zachdaniel
1 & 2: atomic actions don’t bypass policies. Could you describe the specific behavior that you’re seeing? What specifically makes you say that it’s not checking policies?
mix ash.codegen name_for_your_changes. Are you referring to something else there?Most Liked
zachdaniel
Okay, I’ve identified the issue. It’s a very specific edge case. Its “skipping” the policy check in the case that an atomic action would induce no changes, however it’s important to note that it only does that when it is explicitly requested that no fields be updated (regardless of their initial value). So a very rare case (to call an update action that statically will not update any fields).
Aside from it being rare, I would not classify this as a security vulnerability because you can already see the record (thats how you’d be updating it in this way), and if an update were to actually happen, it would have been prevented.
Still, its confusing and problematic behavior, especially because it “presents” as if policies are being skipped, which is not a good thing.
zachdaniel
Fixed in
ash_postgresversion2.4.10zachdaniel
Fixed in
2.4.11ofash_postgres.Last Post!
zachdaniel
CVE has been created here: Empty, atomic, non-bulk actions, policy bypass for side-effects vulnerability. · Advisory · ash-project/ash_postgres · GitHub