From 726f164b2806d596d79c8606fa5a2114e1f05b1e Mon Sep 17 00:00:00 2001 From: Moritz Date: Thu, 22 Jan 2026 23:12:33 +0100 Subject: [PATCH] Fix remaining runtime guard references in CODE_GUIDELINES Remove mentions of runtime guards - only compile-time config is used. Clarify that production safety comes from config defaults. --- CODE_GUIDELINES.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/CODE_GUIDELINES.md b/CODE_GUIDELINES.md index c87be41..fb7bc23 100644 --- a/CODE_GUIDELINES.md +++ b/CODE_GUIDELINES.md @@ -1672,7 +1672,7 @@ end - Allows CRUD operations without an actor in **test environment only** - Denies all operations without an actor in **production/dev** (fail-closed) -- Uses both compile-time and runtime guards to prevent accidental production use +- Uses compile-time config check to prevent accidental production use (release-safe) **Security Guards:** @@ -1720,8 +1720,8 @@ Ash.create!(Member, attrs, actor: system_actor) **Testing:** -- NoActor tests verify both compile-time and runtime guards -- Tests ensure NoActor returns `false` in non-test environments +- NoActor tests verify the compile-time config guard +- Production safety is guaranteed by config (only set in test.exs, defaults to false) - See `test/mv/authorization/checks/no_actor_test.exs` ### 5.2 Password Security