Plug for current user

[lastday4you]

I was try to build a plug that check if a resorce.user_id is == to current_user_id but i can’t find a way to get the resource before the action get called

[OvermindDL1]

@lastday4you

I was try to build a plug that check if a resorce.user_id is == to current_user_id but i can’t find a way to get the resource before the action get called

Well where does resorce come from? Is it the session, a cookie, or a parameter, or…?

[lastday4you]

is like I want to show a post but before i allow to show the post or not i have to know if post.user_id equal current_user.id. i had found some people use Repo.one from the plug and send it down through plug.assigns but it is a good practice?

[idi527]

I would put this check and any other Repo calls into the “context.”

[lastday4you]

I am a little bit confused can you give me a small example

[idi527]

I do it like this currently

Should user permissions / data correctness logic live in my Ecto validations or Context logic?

I’m trying to do it like you describe in approach B. I define “policies” for protected resources and call them from the context. @spec create_transaction(map, by: %User{}) :: {:ok, %Transaction{}} | {:error, Ecto.Changeset.t} | no_return def create_transaction(attrs, by: %User{id: uid} = user) do Policy.authorize!(:create_transaction, user) %Transaction{user_id: uid} |> Transaction.changeset(attrs) |> Repo.insert() end and then in ledger/policy.ex I have something like this defmodule…

Trying to mimic http://trailblazer.to/