I’m running into a policy and AshGraphql problem, and it seems like a bug.

Here’s my GraphQL query:

query GetEvent2($id: ID!) {
  getEvent2(id: $id) {
    id
  }
}

It’s returning the following response:

%{"data" => %{"getEvent2" => nil}}

Here’s the policy debug log:

[debug] Successful authorization: GF.Events.Event2.read

Generated Filter:
invites.member_id == "BKDK97081LAQXMUJR"
Policy Breakdown
  member2: %{id: "BKDK97081LAQXMUJR"}

  Policy | 🔎:

    condition: action == :read

    authorize if: invites.member_id == "BKDK97081LAQXMUJR" | ✓ | 🔎

And here’s the policy definition:

    policy action :read do
      # authorize_if expr(is_public)
      # authorize_if expr(^actor(:status) == :active)
      authorize_if expr(invites.member_id == ^actor(:id))
    end

The primary resource is Event2, which has_many Invites. Each Invite has a member_id. The actor is a Member whose ID matches member_id.

If I use straight Ash.get!(Event2, event_id, actor: actor), that returns Event2 data.

If I uncomment those two other authorize_if lines, then modify the test setup to use either of them, the query returns the expected response data. It’s just that last authorize_if that seems to be tripping things up. What is different about it? Is it because it goes throug a has_many relationship?

I also tried opening up the :read policy on the Invite resource, to allow anyone to read that, and that didn’t help.