Permit - an authorization library for Phoenix, LiveView and Ecto

This looks like a really great library for those outside of the Ash ecosystem. Congratulations!

Not quite; Ash has had it’s SAT solving policy authorizer which automatically constrains read and write queries to PostgreSQL (as well as any other supported DataLayer) for several years now.

I’ve seen a similar feature in the LetMe library by @woylie , named “scoped queries”

Very neat never the less!

We’ve taken a look at this some time ago, and it looks to me that scoped queries still require you to define Ecto queries manually - this is good from a specific standpoint, but the approach here is that most conditions should be convertible automatically.

Thank you for pointing us to this, James.

This escaped our attention somehow, and looks to be tightly coupled with Ash altogether, but we’ll update the documentation and other descriptions to take it into account.

Thank you for contributing!

Would you mind to also write few words how it compares to Janus ?

I think you have a copypasta in your README, there are 2 functions called show/2

I wrote Janus

On the surface, it looks like Permit and Janus are very similar! They both prefer plain Elixir and a single source of truth – the same authz rules are used for individual resources as well as scoped Ecto queries.

Permit seems much more feature-complete (Phoenix/LiveView integration) and has corporate backing, which makes it very attractive! I need to look at Permit more carefully, but I’d love to see if there’s anything novel in Janus that could be ported to Permit and potentially retire Janus if they’re as similar as I think they are.

Hi,

I just tried installing the latest versions of {:permit_ecto, “~> 0.2.0”} and {:permit_phoenix, “~> 0.1.0”} and am getting a dependency conflict:

Because permit_ecto >= 0.2.0 depends on permit ~> 0.2 and permit_phoenix >= 0.1.0 depends on permit ~> 0.1.3, permit_ecto >= 0.2.0 is incompatible with permit_phoenix >= 0.1.0.
And because your app depends on permit_ecto ~> 0.2.0, permit_phoenix >= 0.1.0 is forbidden.
So, because your app depends on permit_phoenix ~> 0.1.0, version solving failed.

Looks like permit_ecto just got bumped. Can I expect an update to permit_phoenix soon?

Thank you

I’ve started using permit_ecto and the accessible_by! function is working. E.g., it is restricting which schema objects a user can read but am having trouble when checking authorization.

Background
In my case a User Participates in Games. The participant table is a join of the game_id and user_id. In my Ecto schema, Game has a belongs_to :user for the owner and has_many :participants for the players.

What works
Authorization.accessible_by! and Authorization.read? agree if I make a permit read on the user_id field of the game. That is checking the read? authorization returns true for games returned with accessible_by!

    permit()
    |> read(Game, user_id: id)

What’s not working
When I set the read permit based on the participant association, Authorization.accessible_by! returns the correctly restricted list of games but the read? authorization returns false.

    permit()
    |> read(Game, participants: [user_id: id])

Should this work or should I be declaring permit.can some other way?

Hey!
I apologize for my lack of responses here for the past year - the good news is that there are much more resources dedicated to developing the library actively now; long story short, I’ll be more actively responding to any issues arising. @ketupia , thank you for your comment - I will check it out and let you know.

Recently, we’ve updated the libraries with several additions as well as creating the Permit.Absinthe proof-of-concept to add Permit-based authorization into GraphQL APIs.

Most notably, we’ve added Phoenix LiveView v1.0 and Streams support, and added a more convenient way to check permissions for dynamically given action names.

Changelogs:

https://github.com/curiosum-dev/permit/blob/master/CHANGELOG.md
https://github.com/curiosum-dev/permit_ecto/blob/master/CHANGELOG.md
https://github.com/curiosum-dev/permit_phoenix/blob/master/CHANGELOG.md

Read more: Permit Updates: Phoenix LiveView 1.0 and Absinthe Integration | Curiosum