Hi there,

As the title suggests, I’m trying to use Ash and Flop together for some lovely table-magic. Hopefully this is a reasonable question to ask in this topic.

My resource is set up with:

• Attribute based multi-tenancy
• Policies to enforce read-permissions

I’d like to use Flop / Flop Phoenix to give the user an interactive grid they can use to sift through the dataset, but I want to ensure that:
a) Data isn’t exposed across tenants
b) Users can only see records that they are allowed to see (based on the Ash Policy)
c) In the future I can make use of Ash calculated fields, etc.

What I’d like to be able to say is something like the following, but that’s obviously mixing Ash.Query and Ecto.Query types.

Customers.Customer
|> Ash.Query.for_read(:read, %{}, actor: socket.assigns.current_user)
|> Ash.Query.set_tenant(socket.assigns.current_tenant)
|> Flop.validate_and_run(params, for: Customers.Customer)

The best I’ve been able to do is the following, but I don’t like that I could easily miss the multi-tenancy filter, and my read-level policies aren’t being followed:

{:ok, query} = Customers.Customer
# specifying actor and authorize?=true doesn't do anything here
|> Ash.Query.for_read(:read)
# have to manually add tenant filter here.  set_tenant has no effect.
|> Ash.Query.filter(tenant_id == ^socket.assigns.current_tenant.id)
# Get an Ecto.Query which includes at least some of my filters
|> Ash.Query.data_layer_query()

customers = Flop.validate_and_run(query, params, for: Customers.Customer)

I assume I’m missing something obvious here and would appreciate a nudge in the right direction.

Thank you so much!