<!--
This file was generated by Spark. Do not edit it by hand.
-->
# AshAuthzed

Standalone Ash Framework extension for Zanzibar / ReBAC authorization
backed by `Licet` (embedded Postgres/Ecto), `SpiceDB` / `Authzed` (HTTP via `Req`),
or `AshAuthzed.Adapters.Memory` (in-memory `Licet` engine).

## Usage

    defmodule MyApp.Accounts.User do
      use Ash.Resource,
        domain: MyApp.Accounts,
        data_layer: AshPostgres.DataLayer,
        authorizers: [Ash.Policy.Authorizer],
        extensions: [AshAuthzed]

      authzed do
        object_type "user_profile"
        adapter :licet
        adapter_opts [instance: MyApp.Licet]

        relation :owner, subject_type: "user", subject_id: :id
        relation :platform, static_subject: "platform:main"
        external_role :role, target: "platform:main", subject_type: "user", subject_id: :id

        conditional_wildcard :is_protected_admin,
          subject_type: "user",
          attribute: :role,
          in: [:admin, :super_admin]
      end

      policies do
        policy action(:read) do
          authorize_if rebac_can(:view)
        end

        policy action(:update_profile) do
          authorize_if rebac_can(:edit)
        end
      end
    end


## authzed
Configures Zanzibar / Authzed ReBAC tuple synchronization and policy checks.

### Nested DSLs
 * [relation](#authzed-relation)
 * [external_role](#authzed-external_role)
 * [conditional_wildcard](#authzed-conditional_wildcard)


### Options

| Name | Type | Default | Docs |
|------|------|---------|------|
| [`object_type`](#authzed-object_type){: #authzed-object_type .spark-required} | `String.t` |  | The Zanzibar definition name for this Ash resource (e.g. `"user_profile"`). |
| [`actor_type`](#authzed-actor_type){: #authzed-actor_type } | `String.t` | `"user"` | The Zanzibar definition name for actors (defaults to `"user"`). |
| [`id_attribute`](#authzed-id_attribute){: #authzed-id_attribute } | `atom` | `:id` | The primary key attribute on the resource used for object IDs. |
| [`adapter`](#authzed-adapter){: #authzed-adapter } | `atom` | `:licet` | The ReBAC adapter to use (`:licet`, `:spicedb_http`, `:memory`, or a custom module). |
| [`adapter_opts`](#authzed-adapter_opts){: #authzed-adapter_opts } | `keyword` | `[]` | Options forwarded to the configured adapter (e.g. `[instance: MyApp.Licet]`). |
| [`schema_path`](#authzed-schema_path){: #authzed-schema_path } | `String.t` |  | Path to the `.zed` or `.yaml` validation file used for compile-time schema drift verification. |
| [`from_zed`](#authzed-from_zed){: #authzed-from_zed } | `String.t \| boolean` | `false` | Path to the `.zed` schema (or `true` to use `schema_path`) to derive relations and policies directly from the Zed definition. Note: `from_zed` auto-derives single-subject relations (`:<relation>_id`); union or subject-set relations (`user \| group#member`) should be explicitly overridden in the `authzed` DSL block. |
| [`definition`](#authzed-definition){: #authzed-definition } | `String.t` |  | The definition name in the `.zed` schema to derive from (defaults to `object_type`). |
| [`derive_relations`](#authzed-derive_relations){: #authzed-derive_relations } | `boolean` | `true` | Whether to automatically derive AshAuthzed relations from the Zed definition. |
| [`derive_policies`](#authzed-derive_policies){: #authzed-derive_policies } | `boolean \| keyword \| map` | `false` | Whether to automatically derive Ash policies from Zed permissions. Can be `true` (standard mappings) or a custom keyword/map mapping (e.g. `[view: :read, edit: :update]`). |


### authzed.relation
```elixir
relation name
```


Declares a direct relationship tuple synced on create, update, and destroy.


### Arguments

| Name | Type | Default | Docs |
|------|------|---------|------|
| [`name`](#authzed-relation-name){: #authzed-relation-name .spark-required} | `atom` |  | The Zanzibar relation name on this object type. |
### Options

| Name | Type | Default | Docs |
|------|------|---------|------|
| [`subject_type`](#authzed-relation-subject_type){: #authzed-relation-subject_type } | `String.t` |  | The subject type (e.g. `"user"`). |
| [`subject_id`](#authzed-relation-subject_id){: #authzed-relation-subject_id } | `atom` |  | The resource attribute holding the subject ID (e.g. `:id` or `:owner_id`). |
| [`static_subject`](#authzed-relation-static_subject){: #authzed-relation-static_subject } | `String.t` |  | A static subject reference (`"type:id"`), such as `"platform:main"`. |


### Introspection

Target: `AshAuthzed.Relation`

### authzed.external_role
```elixir
external_role attribute
```


Syncs a resource attribute as a relation on the resource itself (`:self`) or an external target object.


### Arguments

| Name | Type | Default | Docs |
|------|------|---------|------|
| [`attribute`](#authzed-external_role-attribute){: #authzed-external_role-attribute .spark-required} | `atom` |  | The attribute on the resource holding the role or capability name. |
### Options

| Name | Type | Default | Docs |
|------|------|---------|------|
| [`target`](#authzed-external_role-target){: #authzed-external_role-target } | `String.t \| :self` | `:self` | The target object (`"type:id"`) on which the role relation is written, or `:self` (default) to target the resource instance itself (`"<object_type>:<id>"`). |
| [`subject_type`](#authzed-external_role-subject_type){: #authzed-external_role-subject_type } | `String.t` | `"user"` | The subject type. |
| [`subject_id`](#authzed-external_role-subject_id){: #authzed-external_role-subject_id } | `atom` | `:id` | The attribute holding the subject ID. |
| [`role_mapping`](#authzed-external_role-role_mapping){: #authzed-external_role-role_mapping } | `map` | `%{}` | Optional map translating attribute values to schema relation names (e.g. `%{user: "member"}`). |


### Introspection

Target: `AshAuthzed.ExternalRole`

### authzed.conditional_wildcard
```elixir
conditional_wildcard name
```


Syncs a wildcard tuple (`object:id#relation@subject_type:*`) when an attribute value matches.


### Arguments

| Name | Type | Default | Docs |
|------|------|---------|------|
| [`name`](#authzed-conditional_wildcard-name){: #authzed-conditional_wildcard-name .spark-required} | `atom` |  | The relation name on this object type. |
### Options

| Name | Type | Default | Docs |
|------|------|---------|------|
| [`attribute`](#authzed-conditional_wildcard-attribute){: #authzed-conditional_wildcard-attribute .spark-required} | `atom` |  | The attribute to inspect on the record. |
| [`in`](#authzed-conditional_wildcard-in){: #authzed-conditional_wildcard-in .spark-required} | `list(any)` |  | List of attribute values for which the wildcard tuple should exist. |
| [`subject_type`](#authzed-conditional_wildcard-subject_type){: #authzed-conditional_wildcard-subject_type } | `String.t` | `"user"` | The wildcard subject type (`"user"` -> `"user:*"`). |


### Introspection

Target: `AshAuthzed.ConditionalWildcard`


## rebac
Alias section for `authzed`.

### Nested DSLs
 * [relation](#rebac-relation)
 * [external_role](#rebac-external_role)
 * [conditional_wildcard](#rebac-conditional_wildcard)


### Options

| Name | Type | Default | Docs |
|------|------|---------|------|
| [`object_type`](#rebac-object_type){: #rebac-object_type .spark-required} | `String.t` |  | The Zanzibar definition name for this Ash resource (e.g. `"user_profile"`). |
| [`actor_type`](#rebac-actor_type){: #rebac-actor_type } | `String.t` | `"user"` | The Zanzibar definition name for actors (defaults to `"user"`). |
| [`id_attribute`](#rebac-id_attribute){: #rebac-id_attribute } | `atom` | `:id` | The primary key attribute on the resource used for object IDs. |
| [`adapter`](#rebac-adapter){: #rebac-adapter } | `atom` | `:licet` | The ReBAC adapter to use (`:licet`, `:spicedb_http`, `:memory`, or a custom module). |
| [`adapter_opts`](#rebac-adapter_opts){: #rebac-adapter_opts } | `keyword` | `[]` | Options forwarded to the configured adapter (e.g. `[instance: MyApp.Licet]`). |
| [`schema_path`](#rebac-schema_path){: #rebac-schema_path } | `String.t` |  | Path to the `.zed` or `.yaml` validation file used for compile-time schema drift verification. |
| [`from_zed`](#rebac-from_zed){: #rebac-from_zed } | `String.t \| boolean` | `false` | Path to the `.zed` schema (or `true` to use `schema_path`) to derive relations and policies directly from the Zed definition. Note: `from_zed` auto-derives single-subject relations (`:<relation>_id`); union or subject-set relations (`user \| group#member`) should be explicitly overridden in the `authzed` DSL block. |
| [`definition`](#rebac-definition){: #rebac-definition } | `String.t` |  | The definition name in the `.zed` schema to derive from (defaults to `object_type`). |
| [`derive_relations`](#rebac-derive_relations){: #rebac-derive_relations } | `boolean` | `true` | Whether to automatically derive AshAuthzed relations from the Zed definition. |
| [`derive_policies`](#rebac-derive_policies){: #rebac-derive_policies } | `boolean \| keyword \| map` | `false` | Whether to automatically derive Ash policies from Zed permissions. Can be `true` (standard mappings) or a custom keyword/map mapping (e.g. `[view: :read, edit: :update]`). |


### rebac.relation
```elixir
relation name
```


Declares a direct relationship tuple synced on create, update, and destroy.


### Arguments

| Name | Type | Default | Docs |
|------|------|---------|------|
| [`name`](#rebac-relation-name){: #rebac-relation-name .spark-required} | `atom` |  | The Zanzibar relation name on this object type. |
### Options

| Name | Type | Default | Docs |
|------|------|---------|------|
| [`subject_type`](#rebac-relation-subject_type){: #rebac-relation-subject_type } | `String.t` |  | The subject type (e.g. `"user"`). |
| [`subject_id`](#rebac-relation-subject_id){: #rebac-relation-subject_id } | `atom` |  | The resource attribute holding the subject ID (e.g. `:id` or `:owner_id`). |
| [`static_subject`](#rebac-relation-static_subject){: #rebac-relation-static_subject } | `String.t` |  | A static subject reference (`"type:id"`), such as `"platform:main"`. |


### Introspection

Target: `AshAuthzed.Relation`

### rebac.external_role
```elixir
external_role attribute
```


Syncs a resource attribute as a relation on the resource itself (`:self`) or an external target object.


### Arguments

| Name | Type | Default | Docs |
|------|------|---------|------|
| [`attribute`](#rebac-external_role-attribute){: #rebac-external_role-attribute .spark-required} | `atom` |  | The attribute on the resource holding the role or capability name. |
### Options

| Name | Type | Default | Docs |
|------|------|---------|------|
| [`target`](#rebac-external_role-target){: #rebac-external_role-target } | `String.t \| :self` | `:self` | The target object (`"type:id"`) on which the role relation is written, or `:self` (default) to target the resource instance itself (`"<object_type>:<id>"`). |
| [`subject_type`](#rebac-external_role-subject_type){: #rebac-external_role-subject_type } | `String.t` | `"user"` | The subject type. |
| [`subject_id`](#rebac-external_role-subject_id){: #rebac-external_role-subject_id } | `atom` | `:id` | The attribute holding the subject ID. |
| [`role_mapping`](#rebac-external_role-role_mapping){: #rebac-external_role-role_mapping } | `map` | `%{}` | Optional map translating attribute values to schema relation names (e.g. `%{user: "member"}`). |


### Introspection

Target: `AshAuthzed.ExternalRole`

### rebac.conditional_wildcard
```elixir
conditional_wildcard name
```


Syncs a wildcard tuple (`object:id#relation@subject_type:*`) when an attribute value matches.


### Arguments

| Name | Type | Default | Docs |
|------|------|---------|------|
| [`name`](#rebac-conditional_wildcard-name){: #rebac-conditional_wildcard-name .spark-required} | `atom` |  | The relation name on this object type. |
### Options

| Name | Type | Default | Docs |
|------|------|---------|------|
| [`attribute`](#rebac-conditional_wildcard-attribute){: #rebac-conditional_wildcard-attribute .spark-required} | `atom` |  | The attribute to inspect on the record. |
| [`in`](#rebac-conditional_wildcard-in){: #rebac-conditional_wildcard-in .spark-required} | `list(any)` |  | List of attribute values for which the wildcard tuple should exist. |
| [`subject_type`](#rebac-conditional_wildcard-subject_type){: #rebac-conditional_wildcard-subject_type } | `String.t` | `"user"` | The wildcard subject type (`"user"` -> `"user:*"`). |


### Introspection

Target: `AshAuthzed.ConditionalWildcard`


<style type="text/css">.spark-required::after { content: "*"; color: red !important; }</style>