Hello everyone,

I’m running into an issue with the load callback in a calculation module, specifically regarding domain-level authorization.

I have a resource set up like this:

calculations do
  calculate :total_seconds, :integer, Zoe.Calculations.TotalCourseSeconds, public?: true
end`

This resource belongs to the following domain:

domain: Zoe.Learning`

Inside the Zoe.Calculations.TotalCourseSeconds calculation module, I’m loading a relationship:

load(_, _, _), do: [:lessons]

When I try to run a query that loads this calculation:

courses = Zoe.Learning.read_courses!(load: [:total_seconds], scope: socket.assigns.scope)

I get the following error:

* The domain Zoe.Learning requires that authorization is run, but authorize?: false was given. (ash 3.5.43) lib/ash/error/forbidden/domain_requires_authorization.ex:4: Ash.Error.Forbidden.DomainRequiresAuthorization.exception/1 (ash 3.5.43) lib/ash/actions/helpers.ex:377: Ash.Actions.Helpers.add_authorize?/3 (ash 3.5.43) lib/ash/actions/helpers.ex:315: Ash.Actions.Helpers.set_opts/3

However, I’ve noticed that if I change the authorization block in the Learning domain from this:

authorization do
  authorize :always
end

to this:

authorization do
  authorize :by_default
end

…it works perfectly, and I can load the calculation without any errors.

This leads to my question: What are the differences between :always and :by_default in this context? Why does the internal query generated by the calculation’s load callback seem to fail with :always but succeed with :by_default?

Thanks in advance for any insights!