Forbidden Error when trying to sort on aggregate while an actor is required

Ash Forum Ash Questions / Help
, ,
1

I found a couple of posts that were so close to describing what I’m seeing:

However, those both resulted in fixes and my bug is still unfixed. Let me describe my setup in brief.

defmodule MyApp.People.Person do
  use Ash.Resource # other setup stuff ...

  actions do
    read :list do
      prepare build(load: [:date_of_latest_activity])
    end
  end
  
  aggregates do
    first :date_of_latest_activity, :activities, :date do
      sort date: :desc
      public? true
    end
  end
end

Through my domain, I can call MyApp.People.list_people!(actor: current_user) just fine. date_of_latest_activity is loaded perfectly. I can even call MyApp.People.list_people!(actor: current_user, query: Ash.Query.sort(MyApp.People.Person, sorter)) where sorter is something on the Person itself (like [name: :asc] or [birthdate: :desc]).

However, when I try sorting by date_of_latest_activity

MyApp.People.list_people!(
  actor: current_user,
  query: Ash.Query.sort(MyApp.People.Person, [date_of_latest_activity: :asc])
)

I get the following error:

** (Ash.Error.Forbidden)
Bread Crumbs:
  > Exception raised in: MyApp.People.Person.list

Forbidden Error

* The domain MyApp.People requires that an actor is provided at all times and none was provided.
  (ash 3.4.63) lib/ash/error/forbidden/domain_requires_actor.ex:4: Ash.Error.Forbidden.DomainRequiresActor.exception/1

I even tried throwing in an authorize? false to the aggregate but it still errors out.

Any ideas?

2

I have some ideas, not sure if anygood. :cowboy_hat_face:
Domain Authorization Configuration
Ash.Domain.Dsl.authorization.require_actor?

Requires that an actor is set for all requests.
Important: nil is still a valid actor, so this won’t prevent providing actor: nil. It only requires that the option itself is provided.

Also by dsl-ash-domain/authorization would mean you have in your domain

authorization do
  require_actor? true
end

Right? Unless it’s a bug. If you do have
(What happens if you remove it or make explicit require_actor? false?)
then I suspect, since it “requires actor for all requests”, that the call Ash.Query.sort(MyApp.People.Person, ...) is missing that. Not sure about query functions accepting actor but I know for_read does.

Also not sure if aggregates support sorting by them. I suppose they should. So another maybe useful inquiry would be if you do this through a custom aggregate like the example

User
|> Ash.Query.aggregate(
  :count_of_posts,
  :count,
  :posts,
  query: [
    filter: [published: published?]
  ]
)

Only put your stuff in.

Related to that, are you able to share the repo where the issue is? Or reproduce an issue in a new repo? That’s the best approach for debugging. :bug:

1 Like
3

This is definitely a bug. Can you: 1 make sure to try the latest ash version? Also try main if you can. 2 if the issue persists please put together reproduction and I will look ASAP

4

Thank you for the response. You are correct that I am always requiring an actor with that authorization block. Before opening this post, I did actually try passing a second actor: current_user into the Ash.Query.sort call but that didn’t work and I couldn’t find any mention of being able to do that in the documentation.

Also based on the documentation, you should be able to sort an aggregate. In fact, sortable? defaults to true according to the docs.

I’ll have more info in my response to @zachdaniel.

1 Like
5

Thanks. I was already on the latest ash version (3.4.63) before opening this. I’ve also tried main with no luck (some result of Forbidden). I will try to get together a reproduction repo later today.

1 Like
6

Thank you! It will likely be a pretty straightforward fix, somewhere while processing a sort the actor is being lost when building the aggregate query.

7

I looked into it. Here’s the PR. :eyes:
The issue was again the double default arguments.
IMO a function should support only the last default argument, two is one too many. :japanese_ogre:
Also, after I added %{} another read later failed because actor was not passed. I only passed the actor now, but there are other opts arguments, not sure should I put them also. Comment in the PR. :pray:

1 Like
8

Amazing, thank you so much!

1 Like
9

Well, unfortunately, the bug is still active after this fix was merged. I have created a repo that reproduces the bug here: GitHub - geolessel/ash-bug-repo.

Let me know if there is anything else I can help with.

1 Like
10

Hello! Thanks for the reproduction! Please open an issue on ash with a link to that reproduction and I will fix in the next couple of days. Thank you :bowing_man:

1 Like
11

Done, friend! Thanks.

12

Okay, so my fix was in aggregate_field_with_related_filters while there is also query_aggregate_from_resource_aggregate which your call uses and which was also missing the actor pass. :sweat_smile: I think that’s all of them.

2 Likes
13

That fixed it in my reproduction repo, thanks! I’ve yet to try it in my main project repo (and might not be able to for a bit) but I’ll assume it is fixed there as well.