Where is the best place to put the permissions checking logic in LiveView?

[codeanpeace]

@trisolaran

I can give you a heads up here: you can’t attach hooks in LiveComponents. That approach won’t work unfortunately

Ahh, that is unfortunate… Funnily enough, your profile picture just reminded where I likely got the idea from in the first place.

@trisolaran

live components can’t react to changes in URL parameters (they don’t implement the handle_params/3 callback) and can’t receive messages via handle_info/2. However you can use attach_hook/4 to get around these limitations.

So I’m guessing you’re speaking from hard earned experience!

@trisolaran

you can write for example a module with functions that perform your actions and take as parameter the user. These functions can then query bodyguard to do the auth check, and can be called from anywhere, LV or not. All the caller has to supply is the user.

Agreed, this is how it was addressed in the security considerations docs @wanton7 linked above.

Project.delete!(socket.assigns.current_user, project_id)

It could be nice to use function arity to support actions with or without a user parameter for permission checking since traditional controllers can be protected by plugs. Maybe something like this assuming there’s a Blog Context:

defmodule MyApp.Blog do
  def update_post(%User{} = user, post, post_params) do
    with :ok <- Bodyguard.permit(MyApp.Blog, :update_post, user, post),
      do: MyApp.Blog.update_post(post, post_params)
  end

  def update_post(%Post{} = post, attrs) do
    post
    |> Post.changeset(attrs)
    |> Repo.update()
  end
end

One consideration when relying solely on the LiveView handle_event callback would be that all operations would need to go through the LiveView. That would mean the LiveView can potentially get very cluttered with event callbacks. Take the out of the box form components generated by mix phx.gen.live for example, you would need to move all the calls to Context functions in the event callbacks to the parent LiveView.