Establish a default-deny Ash policy baseline #12

New issue

Open

opened 2026-09-26 13:58:31 +00:00 by belvedere · 0 comments

belvedere commented

2026-09-26 13:58:31 +00:00

Collaborator

Objective: New resources are closed by default, so a forgotten policy fails closed rather
than leaking another user's data.

Files:

Create: lib/first_thousand_words/policies.ex (shared policy helpers)
Modify: each domain (authorization do ... end)

Steps:

For Study resources: by_default :deny; per-user state readable only when
actor.id == resource.user_id.
For Lexicon reference data: allow :read for any authenticated actor; deny writes to
non-admins.
Add a test that a second user cannot read or review the first user's cards.

Verify: the cross-user test fails loudly if a policy is removed. Do not ship Study
resources without this issue.

Refs: config/config.exs already sets Ash policy defaults — read those before writing policies.

**Objective:** New resources are closed by default, so a forgotten policy fails closed rather than leaking another user's data. **Files:** - Create: `lib/first_thousand_words/policies.ex` (shared policy helpers) - Modify: each domain (`authorization do ... end`) **Steps:** 1. For `Study` resources: `by_default :deny`; per-user state readable only when `actor.id == resource.user_id`. 2. For `Lexicon` reference data: allow `:read` for any authenticated actor; deny writes to non-admins. 3. Add a test that a second user cannot read or review the first user's cards. **Verify:** the cross-user test fails loudly if a policy is removed. **Do not** ship Study resources without this issue. **Refs:** `config/config.exs` already sets Ash policy defaults — read those before writing policies.

belvedere added this to the M1 — Ash foundations, auth & app shell milestone

2026-09-26 13:58:31 +00:00

belvedere added the

labels

2026-09-26 13:58:31 +00:00

belvedere referenced this issue