I was thinking about starting a new topic, but this one has a lot of the context.
For creates, I just pass in %{context: %{resource: <probably-a-belongs-to-resource>}}
This works as I wanted. (I’ll have to see precisely how this plays out with APIs, but that’s not today’s problem.)
As per our Discord conversation, I was able to make an excellent filter check that can dip into related access lists on a resource. This works great for reads and updates.
I blindly tossed the check onto a create action though and was greeted with the following error:
** (Ash.Error.Forbidden)
Bread Crumbs:
> Exception raised in: MyApp.Resource.create
Forbidden Error
* Cannot use a filter to authorize a create.
The actual error message is quite informative and also, duh!
Okay, fine. What I want to do is effectively run the filter query on the related resource. “Do I have management permission to the context resource?” Is there some way to utilize the filter check against the context resource inside the check?
I have a kinda crappy hack around this right now but… I’m trying to find a way to just use the check inside another check or move the expression in the check into some shared space. (It’s hard to understand, at my current state what expr/1 is applied to or how. I haven’t dug into that yet.)
