Ash loses actor while loading with `lazy?: true`

Hi, we’ve recently encountered a problem with Ash in our project (we’re using version 2.21.15). Basically, we have the following resources in our system:

MyApp.Product which has the following relationship with MyApp.ProductVariant resource

    has_many :active_product_variants, MyApp.ProductVariant do
      filter is_active: [eq: true]
      sort :order_weight
    end

And in MyApp.ProductVariant we have a manual relationship called with StripeProudct (it is a product variant, but it’s a stripe resource that we access via stripe API) in this way:

    has_one :stripe_product, MyApp.Stripe.Product do
      api MyApp.Stripe
      allow_nil? true
      destination_attribute :id
      validate_destination_attribute? false
      manual __MODULE__.Relationships.StripeProduct
    end


  defmodule Relationships.StripeProduct do
    @moduledoc false

    use Ash.Resource.ManualRelationship

    @impl true
    def load(records, _opts, context) do
      stripe_product_ids =
        records
        |> Enum.map(& &1.stripe_product_id)
        |> Enum.uniq()

      with {:ok, products} <-
             MyApp.Stripe.Product
             |> Ash.Query.for_read(:get_many, %{ids: stripe_product_ids}, actor: context.actor)
             |> MyApp.Stripe.read() do
        {:ok,
         Map.new(products, fn %MyApp.Stripe.Product{id: "retail_" <> id} = product ->
           {id, product}
         end)}
      end
    end
  end

In our app, we have the following piece of code that loads product variants for a list of products:

MyApp.load(products, [active_product_variants: :stripe_product],
           actor: actor,
           lazy?: true
         )

And that’s where the fun begins… For some reason, context.actor in Relationships.StripeProduct.load/3 is always equal to nil despite having a proper value when executing MyApp.load/3, which causes Ash.Error.Forbidden every time

What’s more interesting when I delete lazy?: true like this:

MyApp.load(products, [active_product_variants: :stripe_product],
           actor: actor
         )

Everything is working fine.
Do you have any ideas about what’s happening?

This is almost certainly a bug. Taking a look now.

can you try ash main and see if you have the same issue? Thanks.

Hey, we’re currently migrating to Ash 3.0, which takes some time in our case (it’s a rather big project), so I won’t be able to run it on the main soon. I’m not sure when the migration will be done, but I’ll let you know ASAP if this is still an issue.

Anyways I was wondering if this is something that could be fixed as a part of Ash 2.0 support you’ve mentioned here Ash Framework 3.0

Ah, so backporting this would be potentially difficult, it depends a lot on what else has changed since then. I will look into it because it is security related, but I will likely not have time to back port this until late next week.

1 Like

What kind of time frame are you looking at for upgrading? There is ~2 months of guaranteed security bug fixes back ported to Ash 2.x, and although the original phrasing was “at least 6 months”, we will likely make it “exactly 6 months”, as the time spent to back port fixes rises exponentially as new changes are added.

We’ll probably finish the upgrade by the end of August (hopefully earlier). It’s not that necessary for us since we just disabled the lazy? option, so I guess it can wait till the update

1 Like