AshAuthzed.SyncChange (ash_authzed v0.2.0)

Copy Markdown View Source

Synchronizes Ash resource lifecycle changes to Zanzibar/ReBAC relationship tuples.

Supports:

  • Single-record actions via change/3 (after_action/2)
  • Atomic single updates via atomic/3
  • Bulk creates, updates, and destroys via batch_change/3 + after_batch/3 (executes a single batched write_tuples/2 call per chunk)

Summary

Functions

build_operations(resource, action_type, old_record, new_record)

Computes the list of {:create | :delete, tuple_string} operations for a transition from old_record to new_record on resource for action_type (:create, :update, :destroy).

operations_for_records(records, opts \\ [])

Generates deduplicated tuple operations for a list of Ash resource structs.

Functions

build_operations(resource, action_type, old_record, new_record)

@spec build_operations(Ash.Resource.t(), atom(), map() | nil, map()) :: [
  AshAuthzed.Adapter.operation()
]

Computes the list of {:create | :delete, tuple_string} operations for a transition from old_record to new_record on resource for action_type (:create, :update, :destroy).

operations_for_records(records, opts \\ [])

@spec operations_for_records([struct()], keyword()) :: [
  AshAuthzed.Adapter.operation()
]

Generates deduplicated tuple operations for a list of Ash resource structs.

If reconcile?: true is passed (default), it treats records as an atomic update with %Ash.Changeset.OriginalDataNotAvailable{} so any stale external_role tuples are idempotently deleted alongside creating current tuples.