Oban on phoenix apps with scope contexts

[rhcarvalho]

@tfwright

Scopes are usually applied to user input at the edges (e.g. to request params) so unless you are allowing users to directly pass args into Oban jobs most likely those params should have already been scoped and so can be considered safe.

One counter argument to this is if user permissions change between scheduling the job and running the job, one probably wants to check authorization when the job starts (or the user could have been deleted, banned, etc).

Similar to how handle_event and others should check before performing an action, as the system may have changed since the mount.

Security considerations — Phoenix LiveView v1.2.5

Authorization rules generally happen on mount (for instance, is the user allowed to see this page?) and also on handle_event (is the user allowed to delete this item?).