vincentvanbush
Permit - an authorization library for Phoenix, LiveView and Ecto
Hello!
We’ve released Permit - a new open-source project at Curiosum aiming to make it easier to manage permission-based access control in Elixir applications, supporting Ecto, Phoenix and LiveView. Permit exposes a mostly plain-Elixir, DSL-free syntax to reduce developer confusion and avoid a steep learning curve.
Through Permit.Ecto, Permit is the first authorization library for Elixir to automatically convert authorization conditions to Ecto queries, as well as being the first to integrate seamlessly with Phoenix LiveView with Permit.Phoenix .
If you’re interested in securing your controllers and making resource loading and authorization easier, or you used to like cancancan popular with Rails developers, you might find Permit especially useful (it is very far from being a clone of anything, though). See README for usage examples.
Permit consists of three packages:
- permit v0.4.1 — Documentation - provides the basic syntax for authorization conditions in the app’s business domain
- permit_ecto v0.3.1 — Documentation - provides the means to automatically convert authorization conditions to Ecto queries
- permit_phoenix v0.5.1 — Documentation - plugs
PermitandPermit.Ectointo Phoenix controllers and LiveView to automatically preload and authorize records and construct Ecto queries based on authorization conditions and current execution context.
Links:
- Introduction article: Phoenix App Authorization with Permit Library Guide | Curiosum
- Repositories:
- GitHub - curiosum-dev/permit: An uniform authorization library for Elixir. Supports Plug and Phoenix LiveView, aims for much more. · GitHub
- GitHub - curiosum-dev/permit_ecto · GitHub
- GitHub - curiosum-dev/permit_phoenix: Phoenix, Plug and LiveView integrations for the Permit authorization library. · GitHub
- Elixir Meetup presentations: https://www.youtube.com/watch?v=hvUBR_4T76E, https://www.youtube.com/watch?v=qNl3fKpzQFY
Feel free to contribute and enjoy the usage!
Trending in Announcing
Other Trending Topics
Latest Phoenix Threads
Latest on Elixir Forum
Sponsor Spotlight
Catch errors, track performance, monitor hosts and more.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #channels
- #elixirconf
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixir-ls
- #phoenix_html
- #iex
- #blog-post
- #graphql
- #genstage
- #ai
- #elixirconf-us
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #metaprogramming
- #performance
- #security
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Practical resources that improve the lives of professional developers.
Develop your skills with books, videos, and courses.
Bringing learning, work and compliance together since 1987.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Most Liked
zachallaun
I wrote Janus
On the surface, it looks like Permit and Janus are very similar! They both prefer plain Elixir and a single source of truth – the same authz rules are used for individual resources as well as scoped Ecto queries.
Permit seems much more feature-complete (Phoenix/LiveView integration) and has corporate backing, which makes it very attractive! I need to look at Permit more carefully, but I’d love to see if there’s anything novel in Janus that could be ported to Permit and potentially retire Janus if they’re as similar as I think they are.
jimsynz
This looks like a really great library for those outside of the Ash ecosystem. Congratulations!
Not quite; Ash has had it’s SAT solving policy authorizer which automatically constrains read and write queries to PostgreSQL (as well as any other supported DataLayer) for several years now.
vincentvanbush
Hey!
I apologize for my lack of responses here for the past year - the good news is that there are much more resources dedicated to developing the library actively now; long story short, I’ll be more actively responding to any issues arising. @ketupia , thank you for your comment - I will check it out and let you know.
Recently, we’ve updated the libraries with several additions as well as creating the Permit.Absinthe proof-of-concept to add Permit-based authorization into GraphQL APIs.
Most notably, we’ve added Phoenix LiveView v1.0 and Streams support, and added a more convenient way to check permissions for dynamically given action names.
Changelogs:
https://github.com/curiosum-dev/permit/blob/master/CHANGELOG.md
https://github.com/curiosum-dev/permit_ecto/blob/master/CHANGELOG.md
https://github.com/curiosum-dev/permit_phoenix/blob/master/CHANGELOG.md
Read more: Permit Updates: Phoenix LiveView 1.0 and Absinthe Integration | Curiosum
Last Post!
vincentvanbush
Hi! I’ve written a new article about future ideas for the library - optimizations, new integrations and other improvements - in some cases, discussing what’s in and out of the project’s scope.
Future of Permit authorization library
The article discusses possibilities for integrating the Permit authorization library with the likes of Ash and Commanded, as well as feasible optimizations and improvements we’re exploring to put in the roadmap - including brainstorming about Postgres RLS.