Understanding authorize :always vs :by_default in a Domain with Calculations

Questions & Help Questions
,
1

Hello everyone,

I’m running into an issue with the load callback in a calculation module, specifically regarding domain-level authorization.

I have a resource set up like this:

calculations do
  calculate :total_seconds, :integer, Zoe.Calculations.TotalCourseSeconds, public?: true
end`

This resource belongs to the following domain:

domain: Zoe.Learning`

Inside the Zoe.Calculations.TotalCourseSeconds calculation module, I’m loading a relationship:

load(_, _, _), do: [:lessons]

When I try to run a query that loads this calculation:

courses = Zoe.Learning.read_courses!(load: [:total_seconds], scope: socket.assigns.scope)

I get the following error:

* The domain Zoe.Learning requires that authorization is run, but authorize?: false was given. (ash 3.5.43) lib/ash/error/forbidden/domain_requires_authorization.ex:4: Ash.Error.Forbidden.DomainRequiresAuthorization.exception/1 (ash 3.5.43) lib/ash/actions/helpers.ex:377: Ash.Actions.Helpers.add_authorize?/3 (ash 3.5.43) lib/ash/actions/helpers.ex:315: Ash.Actions.Helpers.set_opts/3

However, I’ve noticed that if I change the authorization block in the Learning domain from this:

authorization do
  authorize :always
end

to this:

authorization do
  authorize :by_default
end

…it works perfectly, and I can load the calculation without any errors.

This leads to my question: What are the differences between :always and :by_default in this context? Why does the internal query generated by the calculation’s load callback seem to fail with :always but succeed with :by_default?

Thanks in advance for any insights!

2

:always ensures that you can’t set authorize?: false, so all actions in that domain must be authorized. :by_default sets authorize?: true by default, but allows you to explicitly set it to false if needed.

FWIW, by preference is to use:

authorization do
  authorize :by_default
  require_actor? true
end

I find that leads to the fewest surprises/debugging, and is safe by default.