AshAuthzed

Standalone Ash Framework extension for Zanzibar / ReBAC authorization backed by Licet (embedded Postgres/Ecto), SpiceDB / Authzed (HTTP via Req), or AshAuthzed.Adapters.Memory (in-memory Licet engine).

Usage

defmodule MyApp.Accounts.User do
  use Ash.Resource,
    domain: MyApp.Accounts,
    data_layer: AshPostgres.DataLayer,
    authorizers: [Ash.Policy.Authorizer],
    extensions: [AshAuthzed]

  authzed do
    object_type "user_profile"
    adapter :licet
    adapter_opts [instance: MyApp.Licet]

    relation :owner, subject_type: "user", subject_id: :id
    relation :platform, static_subject: "platform:main"
    external_role :role, target: "platform:main", subject_type: "user", subject_id: :id

    conditional_wildcard :is_protected_admin,
      subject_type: "user",
      attribute: :role,
      in: [:admin, :super_admin]
  end

  policies do
    policy action(:read) do
      authorize_if rebac_can(:view)
    end

    policy action(:update_profile) do
      authorize_if rebac_can(:edit)
    end
  end
end

authzed

Configures Zanzibar / Authzed ReBAC tuple synchronization and policy checks.

Options

Name	Type	Default	Docs
`object_type`	`String.t`		The Zanzibar definition name for this Ash resource (e.g. `"user_profile"`).
`actor_type`	`String.t`	`"user"`	The Zanzibar definition name for actors (defaults to `"user"`).
`id_attribute`	`atom`	`:id`	The primary key attribute on the resource used for object IDs.
`adapter`	`atom`	`:licet`	The ReBAC adapter to use (`:licet`, `:spicedb_http`, `:memory`, or a custom module).
`adapter_opts`	`keyword`	`[]`	Options forwarded to the configured adapter (e.g. `[instance: MyApp.Licet]`).
`schema_path`	`String.t`		Path to the `.zed` or `.yaml` validation file used for compile-time schema drift verification.
`from_zed`	`String.t \| boolean`	`false`	Path to the `.zed` schema (or `true` to use `schema_path`) to derive relations and policies directly from the Zed definition. Note: `from_zed` auto-derives single-subject relations (`:<relation>_id`); union or subject-set relations (`user \| group#member`) should be explicitly overridden in the `authzed` DSL block.
`definition`	`String.t`		The definition name in the `.zed` schema to derive from (defaults to `object_type`).
`derive_relations`	`boolean`	`true`	Whether to automatically derive AshAuthzed relations from the Zed definition.
`derive_policies`	`boolean \| keyword \| map`	`false`	Whether to automatically derive Ash policies from Zed permissions. Can be `true` (standard mappings) or a custom keyword/map mapping (e.g. `[view: :read, edit: :update]`).

authzed.relation

relation name

Declares a direct relationship tuple synced on create, update, and destroy.

Arguments

Name	Type	Default	Docs
`name`	`atom`		The Zanzibar relation name on this object type.

Options

Name	Type	Docs
`subject_type`	`String.t`	The subject type (e.g. `"user"`).
`subject_id`	`atom`	The resource attribute holding the subject ID (e.g. `:id` or `:owner_id`).
`static_subject`	`String.t`	A static subject reference (`"type:id"`), such as `"platform:main"`.

Introspection

Target: AshAuthzed.Relation

authzed.external_role

external_role attribute

Syncs a resource attribute as a relation on the resource itself (:self) or an external target object.

Arguments

Name	Type	Default	Docs
`attribute`	`atom`		The attribute on the resource holding the role or capability name.

Options

Name	Type	Default	Docs
`target`	`String.t \| :self`	`:self`	The target object (`"type:id"`) on which the role relation is written, or `:self` (default) to target the resource instance itself (`"<object_type>:<id>"`).
`subject_type`	`String.t`	`"user"`	The subject type.
`subject_id`	`atom`	`:id`	The attribute holding the subject ID.
`role_mapping`	`map`	`%{}`	Optional map translating attribute values to schema relation names (e.g. `%{user: "member"}`).

Introspection

Target: AshAuthzed.ExternalRole

authzed.conditional_wildcard

conditional_wildcard name

Syncs a wildcard tuple (object:id#relation@subject_type:*) when an attribute value matches.

Arguments

Name	Type	Default	Docs
`name`	`atom`		The relation name on this object type.

Options

Name	Type	Default	Docs
`attribute`	`atom`		The attribute to inspect on the record.
`in`	`list(any)`		List of attribute values for which the wildcard tuple should exist.
`subject_type`	`String.t`	`"user"`	The wildcard subject type (`"user"` -> `"user:*"`).

Introspection

Target: AshAuthzed.ConditionalWildcard

rebac

Alias section for authzed.

Nested DSLs

relation
external_role
conditional_wildcard

Options

Name	Type	Default	Docs
`object_type`	`String.t`		The Zanzibar definition name for this Ash resource (e.g. `"user_profile"`).
`actor_type`	`String.t`	`"user"`	The Zanzibar definition name for actors (defaults to `"user"`).
`id_attribute`	`atom`	`:id`	The primary key attribute on the resource used for object IDs.
`adapter`	`atom`	`:licet`	The ReBAC adapter to use (`:licet`, `:spicedb_http`, `:memory`, or a custom module).
`adapter_opts`	`keyword`	`[]`	Options forwarded to the configured adapter (e.g. `[instance: MyApp.Licet]`).
`schema_path`	`String.t`		Path to the `.zed` or `.yaml` validation file used for compile-time schema drift verification.
`from_zed`	`String.t \| boolean`	`false`	Path to the `.zed` schema (or `true` to use `schema_path`) to derive relations and policies directly from the Zed definition. Note: `from_zed` auto-derives single-subject relations (`:<relation>_id`); union or subject-set relations (`user \| group#member`) should be explicitly overridden in the `authzed` DSL block.
`definition`	`String.t`		The definition name in the `.zed` schema to derive from (defaults to `object_type`).
`derive_relations`	`boolean`	`true`	Whether to automatically derive AshAuthzed relations from the Zed definition.
`derive_policies`	`boolean \| keyword \| map`	`false`	Whether to automatically derive Ash policies from Zed permissions. Can be `true` (standard mappings) or a custom keyword/map mapping (e.g. `[view: :read, edit: :update]`).

rebac.relation

relation name

Declares a direct relationship tuple synced on create, update, and destroy.

Arguments

Name	Type	Default	Docs
`name`	`atom`		The Zanzibar relation name on this object type.

Options

Name	Type	Docs
`subject_type`	`String.t`	The subject type (e.g. `"user"`).
`subject_id`	`atom`	The resource attribute holding the subject ID (e.g. `:id` or `:owner_id`).
`static_subject`	`String.t`	A static subject reference (`"type:id"`), such as `"platform:main"`.

Introspection

Target: AshAuthzed.Relation

rebac.external_role

external_role attribute

Syncs a resource attribute as a relation on the resource itself (:self) or an external target object.

Arguments

Name	Type	Default	Docs
`attribute`	`atom`		The attribute on the resource holding the role or capability name.

Options

Name	Type	Default	Docs
`target`	`String.t \| :self`	`:self`	The target object (`"type:id"`) on which the role relation is written, or `:self` (default) to target the resource instance itself (`"<object_type>:<id>"`).
`subject_type`	`String.t`	`"user"`	The subject type.
`subject_id`	`atom`	`:id`	The attribute holding the subject ID.
`role_mapping`	`map`	`%{}`	Optional map translating attribute values to schema relation names (e.g. `%{user: "member"}`).

Introspection

Target: AshAuthzed.ExternalRole

rebac.conditional_wildcard

conditional_wildcard name

Syncs a wildcard tuple (object:id#relation@subject_type:*) when an attribute value matches.

Arguments

Name	Type	Default	Docs
`name`	`atom`		The relation name on this object type.

Options

Name	Type	Default	Docs
`attribute`	`atom`		The attribute to inspect on the record.
`in`	`list(any)`		List of attribute values for which the wildcard tuple should exist.
`subject_type`	`String.t`	`"user"`	The wildcard subject type (`"user"` -> `"user:*"`).

Introspection

Target: AshAuthzed.ConditionalWildcard

← Previous Page Getting Started

Next Page → Changelog