Ash Framework module for finding out whether an actor is allowed to perform an action on a particular resource instance

auth.ex

defmodule Auth do
  require Ash.Query

  def can_on_instance?(resource, id, action_name, actor, api) do
    action = Ash.Resource.Info.action(resource, action_name)

    case action.type do
      :create ->
        false

      :read ->
        query =
          resource
          |> Ash.Query.for_read(action_name)

        strict_check(actor, id, query, api)

      :update ->
        changeset =
          struct(resource)
          |> Ash.Changeset.new(%{})
          |> Ash.Changeset.for_update(action_name)

        strict_check(actor, id, changeset, api)

      :destroy ->
        changeset =
          struct(resource)
          |> Ash.Changeset.new(%{})
          |> Ash.Changeset.for_destroy(action_name)

        strict_check(actor, id, changeset, api)
    end
  end

  def strict_check(actor, id, %{__struct__: Ash.Query} = query, api) do
    authorizer = %Ash.Policy.Authorizer{
      actor: actor,
      resource: query.resource,
      action: query.action
    }

    case Ash.Policy.Authorizer.strict_check(authorizer, %{
           api: api,
           query: query,
           changeset: nil
         }) do
      {:error, _error} ->
        false

      :authorized ->
        true

      {:filter, _, filter} ->
        query
        |> Ash.Query.filter(id == ^id)
        |> Ash.Query.filter(^filter)
        |> api.read_one(authorize?: false)
        |> case do
          {:ok, nil} -> false
          {:ok, _} -> true
          _ -> false
        end

      _ ->
        :maybe
    end
  end

  def strict_check(actor, id, %{__struct__: Ash.Changeset} = changeset, api) do
    authorizer = %Ash.Policy.Authorizer{
      actor: actor,
      resource: changeset.resource,
      action: changeset.action
    }

    case Ash.Policy.Authorizer.strict_check(authorizer, %{
           api: api,
           changeset: changeset,
           query: nil
         }) do
      {:error, _error} ->
        false

      :authorized ->
        true

      {:filter, _, filter} ->
        primary_read_action =
          Ash.Resource.Info.primary_action!(changeset.resource, :read)

        Ash.Query.for_read(changeset.resource, primary_read_action.name)
        |> Ash.Query.filter(id == ^id)
        |> Ash.Query.filter(^filter)
        |> api.read_one(authorize?: false)
        |> case do
          {:ok, nil} -> false
          {:ok, _} -> true
          _ -> false
        end

      _ ->
        false
    end
  end
end