Phase 5: Authorization and Policy Enforcement

[pcharbon70]

Summary

Implements Ash policy integration for UI resource access control and action authorization.

Section 5.1 - Policy Definitions

• Common policy checks (user_active, user_role, screen_owner, environment)
• UI.Screen policies (read, mount, create, update, destroy)
• UI.Element policies (visibility, modification)
• UI.Binding policies (evaluation, modification, data source access)
• Cross-resource policy checks

Section 5.2 - Runtime Authorization

• Mount authorization checking with redirect
• Action authorization before execution
• Data source read/write access checking
• Policy result caching with TTL
• Cache invalidation for user/resource changes
• User extraction from LiveView socket
• Authorization telemetry emission

Section 5.3 - Policy DSL Extensions

• visible_if/2 for element visibility policies
• editable_if/2 for element editability policies
• accessible_if/2 for resource access policies
• can_read_source/1 and can_write_source/1 for binding sources
• Policy builders (build_visibility_policy, build_editability_policy, etc.)
• all_of/1 and any_of/1 for combining policies
• not_/1 for negating policies
• time_policy/2 and environment_policy/1 helpers

Section 5.4 - Error Handling

• AuthorizationError exception with structured fields
• Error constructors (unauthenticated, forbidden, inactive)
• User-friendly message formatting
• Debug message formatting for logging
• HTTP status code mapping (401, 403)
• Translation support (English, Spanish, French, German)
• Custom error page per resource

Section 5.5 - Integration Tests

• Mount authorization integration scenarios
• Action authorization integration scenarios
• Data source authorization scenarios
• Policy caching scenarios
• End-to-end authorization flows
• Error integration scenarios
• Policy integration scenarios

Test plan

• All policy definition tests pass
• All runtime authorization tests pass
• All policy DSL tests pass
• All error handling tests pass
• Integration tests validate end-to-end scenarios