Why not use {:error, :forbidden} ? about bodyguard

[schrockwell]

Hi @elieteyssedou! Please note that the result of the authorization check has no intrinsic meaning to the web layer – that's up to you. See the Controllers section of the readme for an example of how to return a 403 from {:error, :unauthorized}.

[elieteyssedou]

Hi @schrockwell,

Thank you for you reply. Yeah, I understand that, but it is strongly linked to the response you will send back in the web layer, don't you think ? Plus, I somewhere in my app I have an authentication mechanism including an {:error, :unauthorized} as it should be for authentication, I won't be able to match on that error for returning 401, because of default configuration of Bodyguard (that makes me match on :unauthorized error to send 403 Forbidden).
I had this exact problem and my only way to fix it properly was to render manually my 401 error when I had to... It means that depending of the execution (while testing authentication or testing authorization), {:error, :unauthorized} will cause 401 OR 403. So, you can't rely on {:error, :unauthorized} to be sure that a 401 or 403 will be rendered... It depends on where the match will take place.

I don't know if my explications are all clear ?

[schrockwell]

You are able to return any error reason directly from an authorize/3 callback, so you could explicitly return {:error, :forbidden} instead of false. Is that too much of a pain?

Alternatively, I could add a config option to make the default error customizable. For example:

config Bodyguard,
  default_ok: :ok,
  default_error: :unauthorized

[elieteyssedou]

Yeah, I think a default error customizable would be great ! It is not something mandatory and without it I would still use bodygard, but if I were able to configure this, it would remove my only frustration about this library.

I really like to use the booleans to authorize or not an action and be confident that it will be handled the right way by my controllers. :) I will may be use this feature that way : default_error: :bodyguard_unauthorized (or something very specific), to handle it properly.

What do you think ?

[schrockwell]

Published in 2.3.0! See the config section near the bottom of the README.

[elieteyssedou]

Oh nice, will update soon ! Thanks 🙏