I was reading the policies on authorizer app and something came into my mind when I read the validation part. Shouldn't we catch all on validation failure? I mean, when the first function clause doesn't match.
def validate(%Conn{private: %{session: session}} = context) when is_map(session) do
case session do
%{subject_id: id, subject_type: type} when is_binary(id) and type in @subject_types ->
Logger.debug("Policity #{__MODULE__} validated with success")
{:ok, context}
_any ->
Logger.error("Policy #{__MODULE__} failed on validation because session is invalid")
{:error, :unauthorized}
end
end
def validate(%Conn{private: %{session: _}}) do
Logger.error("Policy #{__MODULE__} failed on validation because session was not found")
{:error, :unauthorized}
end
The difference is that it returns a 50x instead of 403 because the process dies (right?)
I was reading the policies on authorizer app and something came into my mind when I read the validation part. Shouldn't we catch all on validation failure? I mean, when the first function clause doesn't match.
The difference is that it returns a 50x instead of 403 because the process dies (right?)