Moritz
3d46ba655f
- Actor.permission_set_name(actor) returns role's permission set (supports nil role load). - Actor.admin?(actor) returns true for system user or admin permission set. - ActorIsAdmin policy check delegates to Actor.admin?/1.
17 lines
521 B
Elixir
17 lines
521 B
Elixir
defmodule Mv.Authorization.Checks.ActorIsAdmin do
|
|
@moduledoc """
|
|
Policy check: true when the actor's role has permission_set_name "admin".
|
|
|
|
Used to restrict actions (e.g. User.update_user for member link/unlink) to admins only.
|
|
Delegates to `Mv.Authorization.Actor.admin?/1` for consistency.
|
|
"""
|
|
use Ash.Policy.SimpleCheck
|
|
|
|
alias Mv.Authorization.Actor
|
|
|
|
@impl true
|
|
def describe(_opts), do: "actor has admin permission set"
|
|
|
|
@impl true
|
|
def match?(actor, _context, _opts), do: Actor.admin?(actor)
|
|
end
|