fix: authorize seeding at request time, not build time (#1022)

* fix: authorize seeding at request time, not build time

Part of #1020.

The seed mutations are exposed in the GraphQL schema unconditionally. A
validation already rejected them when ENABLE_SEED_FROM_PROD was off, but
resource validations only run for create/update/destroy actions, not for
generic actions. seed_all maps to the generic :time_range action, which
therefore ran: it invoked the feeds create action, read every feed, and only
failed partway through on a nested create -- or, with no feeds present,
returned {:ok, []} having refused nothing.

A policy covers every action type, so seeding is now refused up front. The
check reads the flag through Application.get_env/3, so it follows the app
serving the request; config.exs is evaluated at boot, since the server runs
under Mix rather than as a release.

Ash.bulk_create/4 in Seed.Changes.SeedResource passes authorize?: false, so
the target resources' own policies never run. Seed is the only place this
can be gated.

The seed page moves from getStaticProps to getServerSideProps for the same
reason: whether it existed was decided by the app the artifact was built in,
and one artifact is promoted across all three. Hiding it is presentation
only -- the policy is what refuses the work.

Tests cover both action types with seeding disabled and enabled. Verified
the generic-action gap is real: with the policy removed, :time_range returns
{:ok, []} instead of Forbidden.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: set the seed flag in runtime.exs so authorization survives a release

Under Mix, config.exs is re-evaluated at boot, so Application.get_env/3
already reported the serving app's ENABLE_SEED_FROM_PROD. Under a release it
would not: config.exs is frozen into the artifact and only runtime.exs runs
at startup, so the authorization check would have read the value from
whichever environment built the artifact -- the exact failure this change
exists to prevent, and a live risk if the app is ever packaged as a release
(a Dockerfile deploy on fly.io would be).

Setting the key in runtime.exs makes the request-time reads correct under
both models. config.exs keeps its copy for the Application.compile_env/3
calls that decide whether the seed actions are compiled in at all.

Under a release the two copies disagreeing becomes a boot-time error rather
than a silent authorization, which is the outcome worth having until the
compile-time gating is removed altogether.

Raised by CodeRabbit on #1022.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: rainhead

server/config/runtime.exs

@@ -23,6 +23,16 @@ end
 
 config :orcasite, :prod_host, System.get_env("PROD_HOST_URL", "live.orcasound.net")
 
+# Also set in config.exs, which Application.compile_env/3 reads to decide whether
+# the seed actions are compiled in at all. Repeating it here is redundant while
+# the server runs under Mix, since config.exs is re-evaluated at boot -- but it
+# would not be under a release, where config.exs is frozen into the artifact and
+# only runtime.exs runs at startup. Orcasite.Radio.Checks.SeedFromProdEnabled and
+# the validation in Orcasite.Radio.Seed authorize on this value, so it has to
+# describe the app serving the request under either model.
+config :orcasite,
+  enable_seed_from_prod: System.get_env("ENABLE_SEED_FROM_PROD", "false") == "true"
+
 if config_env() == :prod do
   database_url =
     System.get_env("DATABASE_URL") ||

server/lib/orcasite/radio/checks/seed_from_prod_enabled.ex

@@ -0,0 +1,24 @@
+defmodule Orcasite.Radio.Checks.SeedFromProdEnabled do
+  @moduledoc """
+  Passes only where seeding from prod is turned on for the running app.
+
+  Read at request time rather than compile time. Deploys build one artifact and
+  promote it across apps, so a compile-time answer describes the app the
+  artifact was built in rather than the app serving the request.
+
+  The value is set in `config/runtime.exs`, which runs at boot under both Mix
+  and a release. `config.exs` sets it too, for the `Application.compile_env/3`
+  calls that decide whether the seed actions exist at all -- but that copy is
+  frozen into the artifact under a release, so it must not be what authorizes a
+  request.
+  """
+  use Ash.Policy.SimpleCheck
+
+  @impl true
+  def describe(_opts), do: "seeding from prod is enabled for this environment"
+
+  @impl true
+  def match?(_actor, _context, _opts) do
+    Application.get_env(:orcasite, :enable_seed_from_prod, false) == true
+  end
+end

server/lib/orcasite/radio/seed.ex

@@ -1,12 +1,28 @@
 defmodule Orcasite.Radio.Seed do
   use Ash.Resource,
     domain: Orcasite.Radio,
+    authorizers: [Ash.Policy.Authorizer],
     extensions: [AshGraphql.Resource, AshOban]
 
   resource do
     description "Non-persisted resource to seed records from specific time ranges from Orcasite prod"
   end
 
+  # These mutations are exposed in the GraphQL schema unconditionally, and the
+  # changes behind them call Ash.bulk_create/4 with authorize?: false, so the
+  # target resources' own policies never run. This is the only place seeding can
+  # be gated, and without it the seed mutations are reachable by anyone.
+  #
+  # Checked at request time so the answer follows the app serving the request
+  # rather than the app the artifact was built in. The compile-time flags
+  # elsewhere decide whether the seed actions exist at all; this decides whether
+  # they may be invoked here and now.
+  policies do
+    policy always() do
+      authorize_if Orcasite.Radio.Checks.SeedFromProdEnabled
+    end
+  end
+
   attributes do
     uuid_primary_key :id
 

server/test/orcasite/radio/seed_test.exs

@@ -0,0 +1,79 @@
+defmodule Orcasite.Radio.SeedTest do
+  @moduledoc """
+  Tests for https://github.com/orcasound/orcasite/issues/1020.
+
+  The seed mutations are exposed in the GraphQL schema unconditionally. A
+  validation in `Orcasite.Radio.Seed` already rejects them when
+  `ENABLE_SEED_FROM_PROD` is off, but resource validations only run for
+  create/update/destroy actions -- not for generic actions. `seed_all` maps to
+  the generic `:time_range` action, so it reached its `run` block and did work
+  before failing partway through on a nested create.
+
+  A policy now covers every action type, so seeding is refused up front.
+  """
+
+  use Orcasite.DataCase, async: false
+
+  alias Orcasite.Radio.Seed
+
+  setup do
+    original = Application.get_env(:orcasite, :enable_seed_from_prod, false)
+    on_exit(fn -> Application.put_env(:orcasite, :enable_seed_from_prod, original) end)
+    :ok
+  end
+
+  defp set_seeding(enabled?), do: Application.put_env(:orcasite, :enable_seed_from_prod, enabled?)
+
+  describe "with seeding disabled" do
+    setup do
+      set_seeding(false)
+      :ok
+    end
+
+    test "the generic time_range action is forbidden outright" do
+      assert {:error, %Ash.Error.Forbidden{}} = run_time_range()
+    end
+
+    test "creating feeds is rejected" do
+      assert {:error, error} = Ash.create(Seed, %{}, action: :feeds)
+      assert error_message(error) =~ "Seeding is disabled"
+    end
+
+    test "seeding a resource is rejected" do
+      assert {:error, error} =
+               Ash.create(
+                 Seed,
+                 %{
+                   resource: :detection,
+                   feed_id: "whatever",
+                   start_time: DateTime.utc_now(),
+                   end_time: DateTime.utc_now()
+                 },
+                 action: :resource
+               )
+
+      assert error_message(error) =~ "Seeding is disabled"
+    end
+  end
+
+  describe "with seeding enabled" do
+    setup do
+      set_seeding(true)
+      :ok
+    end
+
+    test "authorization no longer refuses the generic time_range action" do
+      # Not asserting success -- that would reach the prod GraphQL API. Only
+      # that the policy is no longer what stops it.
+      refute match?({:error, %Ash.Error.Forbidden{}}, run_time_range())
+    end
+  end
+
+  defp run_time_range do
+    Seed
+    |> Ash.ActionInput.for_action(:time_range, %{})
+    |> Ash.run_action()
+  end
+
+  defp error_message(error), do: Exception.message(error)
+end

ui/src/pages/seed.tsx

@@ -310,9 +310,14 @@ function toLocalISOString(date: Date) {
 
 SeedPage.getLayout = getSimpleLayout;
 
-export async function getStaticProps() {
+// Per request, not at build time. getStaticProps ran during the build, so
+// whether this page existed was decided by the app the artifact was built in
+// rather than the app serving the request -- and one artifact is promoted
+// across dev, staging and production. Hiding the page is presentation only;
+// the seed actions are refused server-side by Orcasite.Radio.Seed's policy.
+export async function getServerSideProps() {
   const enableSeedFromProd = process.env.ENABLE_SEED_FROM_PROD === "true";
-  // Hide the seed page when `ENABLE_SEED_FROM_PROD` isn't enabled
+
   return !enableSeedFromProd ? { notFound: true } : { props: {} };
 }