permit! not raising a Bodyguard.NotAuthorizedError

[Mohamad El-Husseini]

I'm getting a different error than what I expect when I use permit!:

defmodule MyAppWeb.Admin.LinkController do
  action_fallback MyAppWeb.FallbackController
  plug :set_and_authorize_post when not action in [:scrape]

  def set_and_authorize_post(%{params: %{"post_id" => post_id}} = conn, _) do
    post = Media.get_post!(post_id)
    Bodyguard.permit!(MyApp.Media, :manage_links, conn.assigns.current_user, post)
    assign(conn, :post, post)
  end

The error is:

protocol Enumerable not implemented for %MyApp.Media.Post{__meta__: #Ecto.Schema.Metadata<:loaded, "posts">, ...

[Mohamad El-Husseini]

To get around this issue, I'm doing this:

  def set_and_authorize_post(%{params: %{"post_id" => post_id}} = conn, _) do
    post = Media.get_post!(post_id)
    case Bodyguard.permit?(MyApp.Media, :manage_links, conn.assigns.current_user, post) do
      true ->
        assign(conn, :post, post)
      false ->
        conn
        |> put_status(403)
        |> render(MyAppWeb.ErrorView, "403.html")
        |> halt()
    end
  end

[Rockwell Schrock]

Good catch. The problem was that permit! was expecting that post argument to be an options keyword list (something like [post: post], which is an old library requirement that I must have not removed from that function.

Anyway, I've published a fix. Please update your Bodyguard dependency to v2.2 using mix deps.update bodyguard.

[Mohamad El-Husseini]

That update solved it. Thanks.