Thanks, I’m moving slowly but it works. I have set the policies to allow users to read their own inventories only.
I removed the default :create action on the inventory and defined it like this, with the relationships:
actions do
defaults([:read, :update, :destroy])
create :create do
accept([:title])
argument(:owner, :uuid, allow_nil?: false)
change(manage_relationship(:owner, :owner, type: :append))
end
end
relationships do
belongs_to :owner, User do
api(Accounts)
allow_nil?(false)
end
end
Because an inventory always need to belong to a user.
And now I can pass the user.id as :owner to my action, from the controller:
def create(conn, params) do
user = auth_actor(conn)
params =
params
|> Map.delete("owner")
|> Map.put(:owner, user.id)
Inventory
|> Ash.Changeset.for_create(:create, params, actor: user)
|> Inventories.create()
|> on_ok do
inventory ->
conn |> put_status(201) |> render("inventory.json", %{inventory: inventory})
end
end
def show(conn, %{"id" => id}) do
id
|> Inventory.get_by_id(actor: auth_actor(conn))
|> on_ok do
inventory ->
conn |> put_status(200) |> render("inventory.json", %{inventory: inventory})
end
end
Finally I can define my policies in the Inventory resource like this:
policies do
policy action_type(:read) do
authorize_if(relates_to_actor_via(:owner))
end
policy action_type(:create) do
authorize_if(always())
end
end
For it to work I had to add the following to my User resource:
actions do
defaults([:read])
end
I guess it’s because the policy checker needs to read from the user resource. Which I do not understand because I pass the actor in Inventory.get_by_id(actor: auth_actor(conn)) and I believe that authorize_if(relates_to_actor_via(:owner)) should only compare the id from the inventory resource to that actor id. But I believe it is because the :owner relationship could point to a FK that is not on the primary key of the user, and that field could not be loaded by default in the actor.
@zachdaniel I’ll answer to this topic as a discover log of your framework. Do not feel obligated to answer. I hope it can help some people following the same path. Though I have a question: with that setup, I get a Ash.Error.Query.NotFound error when the actor is not the actual owner. Is it possible to get a policy error? Because I want users to be able to authorize other users to read and/or change an inventory, via a new resource (called Allowance or something). So I really need to know from the client app if the inventory exists or not when not authorized.
Thank you a lot for your support so far.
Edit: the formatting has a lot of parentheses because for some reason my VSCode adds them. It looks like ElixirLS is always compiling. I found a github issue about this. At some point I stopped fighting and learnt to love the parens 
Edit: I tried with this but nobody can access the resource:
policy action_type(:read) do
forbid_unless(relates_to_actor_via(:owner))
end
But I do get a Forbidden error though.
I modified the relates_to_actor_via function to make it print some debug and raise. It does not seem to be called when used by forbid_unless!
