My approach would be to broadcast a message via PubSub whenever permissions are changed. Then you have a handle_info hook (see attach_hook in the docs) that automatically updates the current_scope assign. Of course you can add any other checks or even redirect away from the LiveView if the permissions don’t allow the user to access it any more.

When you navigate to another liveview you probably run the same on_mount again so depending on your use case that might already be enough.

Also, nothing in phoenix or liveview is “reactive”. If you assign something during an on_mount there isnt some kind of magic dependency tracking going on.

This might seem bothersome but it makes it MUCH simpler to reason about complex systems if they work predictably like this.

If you compare this to a typical SPA like ember.js where you have an authentication service that could change at any time and then, maybe, some reactivity will trigger on the page, but sometimes it won’t because the reactivity gods didn’t bless you. It’s horrible.

Ideally you want to check the permissions transactionally while performing the user action. This is briefly mentioned in the docs (last paragraph).

If you don’t do this you will expose yourself to weird orderings which can be a security problem. Although unfortunately many databases will expose you to weird orderings anyway (skill issue on their part).