Ensure actor can only create resource for themselves

You actually can do what you described, but there is a more expressive builtin for it.

change relate_actor(:user)

And what it could look like done manually:

change fn changeset, context -> 
  Ash.Changeset.force_change_attribute(changeset, :user_id, context.actor.id)
end

We should probably update those docs to remove :create from the example, could you open a PR or issue to track that?

D’oh, sorry, this was an RTFM failure (did not find relate_actor or realize that change takes a fun) that’s awesome.

Yep, I’m happy to open a PR to fix docs!

Oh wait I was a bit overzealous there.

First, I’ll add that yes my bad, change set_attribute(:user_id, actor(:id)) does work, I had a different error

Secondly, how would you ensure the actor matches the passed user id purely at the policy level? Is that just not possible right now?

Oh, it’s very much possible. There are various ways you could do it.

policy :create do
  authorize_if relating_to_actor(:user)
end

defmodule MyApp.Checks.SomeCustomCheck do
  use Ash.Policy.SimpleCheck

  def match?(actor, %{subject: changeset}, _) do
    # arbitrary logic here
  end
end

policy action_type(:create) do
  authorize_if MyApp.Checks.SomeCustomCheck
end

Ha, amazing. Ok, thank you. Need more careful RTFM on my side.