AshCloak: decrypt_by_default Not Loading

Ash Forum Ash Questions / Help
, ,
1

I seem to have an issue decrypting resource fields with ash_cloak. In the database the field seems to encrypt fine and gets saved under the encrypted_data column, however trying to load the resource with Ash.get!(Session, id) throws:

[error] ** (RuntimeError) Invalid return from calculation, expected a value, got `%Ash.NotLoaded{}`

Here’s how I setup the resource:

defmodule PortalApi.Portal.Session do
  use Ash.Resource,
    extensions: [AshCloak],
    data_layer: AshPostgres.DataLayer

  cloak do
    vault(PortalApi.Vault)
    attributes(:data)
    decrypt_by_default(:data)
  end
  ...
  actions do
    read :read, primary?: true
    ...
  end

  attributes do
    ...
    attribute :data, :map do
      allow_nil? false
      default %{}
    end
    ...
  end
end
2

:thinking: interesting. This definitely seems like a bug. I’ll need to see more of a stacktrace. Please open an issue on ash_cloak and I will look into it as soon as I can. What could be happening is that the encrypt is encrypting %Ash.NotLoaded{} into your database somehow? Doesn’t make much sense actually. But it seems like it should be easy enough to reproduce. If you could put together a reproduction that would be great.

If you could create a reproduction project to isolate the behavior and provide that with the issue that would be amazing.

mix archive.install hex igniter_new

mix igniter.new reproduction --install ash,ash_cloak,ash_postgres

mix ash.gen.resource Reproduction.Example.Resource \
  --uuid-primary-key id \
  --extend postgres

There is no installer for ash_cloak currently so you’ll have to hand-modify the resource.

3

I was unable to reproduce the issue with a new project, everything works as expected. I then switched back to the original project it also started working as expected. Kind of strange. I’ll keep playing with it and try to get a consistent reproduction, until then it appears to be working as it should.

Thanks for your response!

4

Concerning, keep me posted if it comes up again :bowing_man: