rapidfsub

rapidfsub

Empty update action with policies?

Here is a test code about my question.
https://github.com/rapidfsub/sonet/blob/develop/test/sonet_lib/ash/policies/common_test.exs#L92

And here is a resource code about my question.
https://github.com/rapidfsub/sonet/blob/develop/test/support/lib/sonet_lib/seven_eleven/product.ex

Brief overview about my test

  • resource: Store, Inventory, Product
  • actor: Customer
  • actions:
    Store.purchase calls Inventory.purchase thru manage_relationship.
    Inventory.purchase calls Product.purchase thru manage_relationship.
  • policies:
    Store.purchase checks open and close time.
    Inventory.purchase checks inventory count.
    Product.purchase checks customer’s age.

Question

Product.purchase update action is an empty action with policies.
Even if it does nothing, but I want to check policies always.

  1. With require_atomic? false in action, always check policies.
    Without it, never check policies. Is this intended behavior?

  2. Using require_atomic? false to force policy check is weird,
    and I found access_type :strict forces policy check.
    Empty action with access_type :filter skips policy check.
    Is this intended behavior?

+ small questions (not related to content)

  1. How can I auto generate postgres schema migration? Should I write it manually?

First Post!

zachdaniel

zachdaniel

Creator of Ash

1 & 2: atomic actions don’t bypass policies. Could you describe the specific behavior that you’re seeing? What specifically makes you say that it’s not checking policies?

  1. When you say auto generate postgres schema migration, what do you mean? You can generate migrations for resources with mix ash.codegen name_for_your_changes. Are you referring to something else there?

Most Liked

zachdaniel

zachdaniel

Creator of Ash

Okay, I’ve identified the issue. It’s a very specific edge case. Its “skipping” the policy check in the case that an atomic action would induce no changes, however it’s important to note that it only does that when it is explicitly requested that no fields be updated (regardless of their initial value). So a very rare case (to call an update action that statically will not update any fields).

Aside from it being rare, I would not classify this as a security vulnerability because you can already see the record (thats how you’d be updating it in this way), and if an update were to actually happen, it would have been prevented.

Still, its confusing and problematic behavior, especially because it “presents” as if policies are being skipped, which is not a good thing.

zachdaniel

zachdaniel

Creator of Ash

Fixed in ash_postgres version 2.4.10

zachdaniel

zachdaniel

Creator of Ash

Fixed in 2.4.11 of ash_postgres.

Last Post!

Where Next?

Popular in Questions Top

minhajuddin
I have seen a lot of code which picks the first element from a list using Enum.at(0) instead of List.first. Is there a reason why people ...
New
Emily
I have VueJS GUIs with the project generated using Webpack. I have Elixir modules that will need to be used by the VueJS GUIs. I forese...
New
PeterCarter
There are pre-rolled solutions for other frameworks that do work. However, Phoenix does not seem to have these. Have people had good expe...
New
Lily
In templates/appointment/index.html.eex: <%= for appointment <- @appointments do %> <tr> <td><%= appoi...
New
joeerl
Hello again - after a longish gap I’ve decided I really must dig into Elixir and see what’s been happening here - so I have a few questio...
New
fireproofsocks
Forgive me if this is obvious, but how does one delete a database record WITHOUT selecting it first? Ecto.Repo — Ecto v3.14.0 has exampl...
New
dblack
I’ve got an issue with an app and I’ve no idea of how to troubleshoot it. I’m hoping someone here might have seen something similar. I p...
New

Other popular topics Top

hariharasudhan94
Lets say I have map like this fetching from my database %{"_id" => #BSON.ObjectId<58eb1a7a9ad169198c3dXXXX>, "email" => ...
New
Brian
What is the proper way to load a module from a file in to IEX? In the python world, doing something like this pretty standard: from ....
New
lanycrost
Hi everyone! I need implement if…else if…else condition from my elixir code, and anymore of this control flow structures not work proper...
New
aadeshere1
I have a another noob question about loop. Since elixir is immutable, while loop is not directly possible. total = 10 while total != 0 ...
New
shijith.k
I am trying to start a new phoenix project with elixir 1.9, but mix phx.new does not work. It says that ** (Mix) The task "phx.new" could...
New
WestKeys
Currently suffering from paralysis by [HTTP client] analysis. This is rather unusual in Elixirland as there tends to be consensus on the ...
New

We're in Beta

About us Mission Statement