Yes, the Context functions act as a back-stop, so this is really only a front-end consideration. It’s probably only something I’d want to do if a lot of writes were being initiated from handle_event, not just for a generated delete button.
I was imagining some sort of flag or hook to use to require all events in a LiveView address the question of authentication. This way, unauthenticated users would automatically be directed to the login page on handle_event functions that aren’t explicitly exempted from the requirement.
Here’s a possible way I came up with:
defmodule AppWeb.SecureLiveView do
use AppWeb, :live_view
@doc """
Enforces authentication for all events by default.
Events in the exempt_events option are not checked for authentication.
"""
defmacro __using__(opts) do
exempt_events = Keyword.get(opts, :exempt_events, [])
quote do
use AppWeb, :live_view
@exempt_events_list unquote(exempt_events)
@before_compile AppWeb.SecureLiveView
end
end
defmacro __before_compile__(env) do
module = env.module
if Module.defines?(module, {:handle_event, 3}) do
# Extract the function definition and handle different AST formats
function_def = Module.get_definition(module, {:handle_event, 3})
{args, body} = extract_args_and_body(function_def)
# Generate the wrapper function's AST
wrapper_def = quote do
def __original_handle_event__(unquote_splicing(args)) do
unquote(body)
end
end
quote do
# Inject the wrapper definition
unquote(wrapper_def)
Module.delete_definition(__MODULE__, {:handle_event, 3})
# Redefine handle_event with auth check
# Ideally, break this out into a function in UserAuth
def handle_event(event, params, socket) do
if event in @exempt_events_list or socket.assigns[:current_scope] do
# Call our stored implementation
__original_handle_event__(event, params, socket)
else
{:noreply,
socket
|> Phoenix.LiveView.put_flash(:error, "You must re-authenticate to access this page.")
|> Phoenix.LiveView.redirect(to: ~p"/users/log-in")}
end
end
end
else
# No handle_event defined
end
end
# Helper function to extract args and body from different AST formats
defp extract_args_and_body({:v1, :def, _meta, [{_head_meta, args, [], body}]}) do
{args, body}
end
# Fallback for older Elixir versions
defp extract_args_and_body({:def, _meta, [{:handle_event, _fun_meta, args}, body]}) do
{args, body}
end
end
Then in the view to be locked down, use this customized LiveView and enumerate the events that don’t go through the logic to force authentication:
defmodule AppWeb.ThingLive.Index do
use AppWeb.SecureLiveView, exempt_events: ["flag", "feedback"]
#...
end
Also, as an aside, if anyone sees a way to simplify this macro a bit, please share! I found it more difficult than I’d expected to intercept a function from the using module and then conditionally delegate back to it.
