I’m curious as to why did Bodyguard didn’t suit your needs. Can’t you call into the database from a policy module? For example:
def authorize(permission, %User{id: user_id}, _opts) do
role = App.Roles.get_by(Role, user_id: user_id, permission: permission)
# ...
end
Or something along those lines…
Well in my case my system far predates bodyguard. I did look at bodyguard when it was released but it was missing features I required so didn’t look further into it, I don’t remember what that was now as it was a while ago. So far I haven’t seen a system that allows the features that I require.
For note, my system easily can do hundreds if not thousands or even magnitudes more of permission checks on a single request in some instances, most systems I’ve seen absolutely crumble under such load (individual checks on students in a class and what access they are allowed on each and so forth).
Because bodyguard only provides an interface. I still need to fetch the permissions from somewhere and I still have to check for the permissions by myself inside a Policy. It seemed pointless to add a dependency that didn’t help at all.
My issue was the structure and storage of roles and permissions: should they hardcoded? stored in the db(like laravel’s Entrust)? How are people handling authorization in their apps?