moxley

moxley OP

Oh wait. False alarm. That doesn’t reproduce the error. I’ll keep digging into this.

0
Post #11
zachdaniel

zachdaniel

Creator of Ash

Did you have a chance to try the changes in main? We still really ought to reproduce as it would highlight a missing coverage area in field policies, but it would be a useful thing to know if the changes there resolve the issue. If they do, I’m not terribly worried about the impact of the issue as it’s essentially just a missing copy of the subject to the subject field.

0
Post #12
moxley

moxley OP

I just tried it on main. It raised the same error. Here’s the abbreviated Ash.Policy.Authorizer:

%Ash.Policy.Authorizer{
  actor: %GF.Members.Member2{},
  resource: GF.Members.Member2,
  query: nil,
  changeset: nil,
  action_input: nil,
  data: nil,
  action: %Ash.Resource.Actions.Read{ },
  domain: GF.Domain,
  scenarios: nil,
  real_scenarios: nil,
  check_scenarios: nil,
  subject: nil,
  for_fields: [:status],
  solver_statement: {:and, ...},
  context: %{},
  policies: [...],
  facts: %{
    false => false,
    true => true,
    {Ash.Policy.Check.ActorAttributeEquals,
     [
       attribute: :__struct__,
       value: GF.Members.Member2,
       ash_field_policy?: true,
       access_type: :filter
     ]} => true,
    {GF.Members.ActiveMemberPolicy,
     [role: :members, ash_field_policy?: true, access_type: :filter]} => false
  },
  data_facts: %{}
}

The actor doesn’t have read access to the member’s status attribute, and the status attribute is being referenced in that GraphQL argument.

During the test, the debug statement was executed 3 times, and the last time raised the error.

0
Post #13
zachdaniel

zachdaniel

Creator of Ash

Thank you, that authorizer dump is useful. So the problem wasn’t the copying from query → subject, it is that somehow all of query, changeset, and action_input keys are nil. That will effectively never work, something internally will always break if thats the case. I’m sure the answer lies in your stack trace somewhere, despite me not being able to reproduce this yet :cry:

0
Post #14
zachdaniel

zachdaniel

Creator of Ash

Alright, I was able to snag a few minutes tonight to hopefully resolve the issue, but I’m out of time. If you can find any way to reproduce this I could probably fix it in like 5 minutes flat, but my tests have been unsuccessful so far for some reason. It doesn’t seem like a complex case to reproduce but its just not happening for me for some reason.

0
Post #15
moxley

moxley OP

I created a PR that reproduces the error:

https://github.com/ash-project/ash_graphql/pull/309

0
Post #16
zachdaniel

zachdaniel

Creator of Ash

:fire: :fire: :fire: thank you. I will continue looking into this tonight or tomorrow at the latest.

0
Post #17
zachdaniel

zachdaniel

Creator of Ash

@moxley this is fixed in main of ash. Sure enough, there was a place deep down in the field policy evaluator that was not putting the query into the subject field :slight_smile:

EDIT: thanks again for your diligence w/ the bug report and the reproduction :person_bowing:

4
Post #18
— All posts loaded —