ash
ash copied to clipboard
Ash should raise an error if an actor template expands to not loaded
If a policy references a field on actor that is not loaded, it might incorrectly succeed:
policy action_type(:create) do
forbid_if expr(^actor(:journals_at_limit?) == true)
authorize_if always()
end
In the above example, the :journals_at_limit? is a calculated field that evaluates to true, yet the action succeeds.
Expected behavior: an error should be raised if the field is not loaded.
I will adjust this in the near future. However, remember to test your policies with realistic conditions folks! 😄