Uh, cleared on each? What if you have two concurrent requests coming in? Doesn’t that mean that one could potentially get the others permissions or get no permissions or some combination thereof?
OvermindDL1
bjunc
I created a library a little while back called Access Decision Manager. I think it might do what you’re looking for. It’s based on logic by the same name in PHP’s Symfony framework. Quick examples:
granted?(viewer, "CREATE_FOO", some_entity) # true / false
This uses a “voter” system that allows for per-entity permissions. You can also use it for simpler scenarios like this:
granted?(viewer, "ROLE_SUPER_ADMIN")
This is where the “subject” and “entity” are the same (eg. you want to know if the viewer has the super admin role).
We’re currently using this in production, in both Guardian plugs, as well as Absinthe resolvers. Slightly paired back resolver example:
def update(%{input: %{id: floor_plan_id}}, %{context: %{viewer: viewer}}) do
case FloorPlan.get(floor_plan_id) do
%FloorPlan{} = floor_plan ->
if granted?(viewer, "EDIT_FLOOR_PLAN", floor_plan.project) do
# ... update floor plan
else
{:error, message: "Permission denied.", code: 403}
end
nil ->
{:error, message: "Floor Plan doesn't exist.", code: 404}
end
end
2