Forbid all but one field using field policies

Ash Forum Ash Questions / Help
,
1

Hello, I need to forbid Anonymous actor access to all fields but id and status . Basically it’s needed for some calulcations but we don’t want him to have access to any other data. So I’ve tried using policies like this:

  field_policies do
    field_policy :status do
      authorize_if always()
    end

    field_policy :* do
      forbid_if Checks.IsAnonymousActor
      authorize_if always()
    end
  end

But this seems to not be working, probably because for status filed Ash checks policies from both status and :* . Is there any way to achieve that?

2

All field policies that apply to a field must pass, so in that case yes both policies apply. You’d need to include a full list of all fields except for the one in question instead of using :*. I’m open to UX improvements there

3

Actually I’ve just came up with a solution

 field_policies do
    field_policy_bypass :status do
      authorize_if always()
    end

    field_policy :* do
      forbid_if Checks.IsAnonymousActor
      authorize_if always()
    end
  end
2 Likes
4

Clever using the bypass, I didn’t think of it.