`require_actor? true` in domain doesn't affect GraphQL mutations about ash_graphql HOT 3 CLOSED

In Ash, nil is a valid actor. Currently, require_actor?'s job is to require that all places pass the actor option, not to ensure that it is not nil. This is to prevent typos, basically. AshGraphql always sets the actor option, even if one was not provided to it (but it may be nil). A good argument could be made for that being not the best behavior, but it is currently the designed behavior.

Typically this would be implemented somewhere in the authentication flow, where if authentication fails or no authentication information is present you'd reject the user's request.

It is too late to change the semantics of require_actor?, unfortunately, but we could potentially add something like validate_actor/1 that gives you the actor and a chance to provide an arbitrary error message about why that actor is invalid.

Then you could accomplish what you want with something like this:

require_actor? true
validate_actor fn nil -> 
    {:error, "...."}
  %User{} = user ->
     {:ok, user}
end

from ash_graphql.

Thanks Zach. That's helpful to understand. You're right that my auth flow handles this, it was more of an interim state that felt off. But now I understand so all good.

I didn't have the AshGraphql plug in my pipeline at the time. Not sure if that changes anything.

from ash_graphql.

Shouldn't affect things. I'll close this for now, but if it looks like validate_actor or some similar set of behavior will help in other cases as well then we'll add it to the roadmap :)

from ash_graphql.