WIP

.credo.exs

@@ -117,7 +117,7 @@
         ## Refactoring Opportunities
         #
         {Credo.Check.Refactor.CondStatements, []},
-        {Credo.Check.Refactor.CyclomaticComplexity, [max_complexity: 12]},
+        {Credo.Check.Refactor.CyclomaticComplexity, [max_complexity: 13]},
         {Credo.Check.Refactor.FunctionArity, []},
         {Credo.Check.Refactor.LongQuoteBlocks, []},
         {Credo.Check.Refactor.MapInto, []},

benchmarks/sat_solver.ex

@@ -0,0 +1,19 @@
+query =
+  AshExample.Api.query(AshExample.Representative)
+  |> Ash.Query.filter(
+    id: [in: ["35c73627-d24c-4d37-99c5-f6309202f514", "35c73627-d24c-4d37-99c5-f6309202f514"]]
+  )
+
+candidate =
+  AshExample.Api.query(AshExample.Representative)
+  |> Ash.Query.filter(id: "35c73627-d24c-4d37-99c5-f6309202f514")
+
+Benchee.run(
+  %{
+    "picosat" => fn ->
+      Ash.SatSolver.strict_filter_subset(query.filter, candidate.filter)
+    end
+  },
+  time: 10,
+  memory_time: 2
+)

lib/ash/actions/relationships.ex

@@ -170,20 +170,20 @@ defmodule Ash.Actions.Relationships do
        ) do
     relationship_name = relationship.name
 
-    filter =
+    {possible?, filter} =
       case identifiers do
         [single_identifier] ->
           if Keyword.keyword?(single_identifier) do
-            single_identifier
+            {true, single_identifier}
           else
-            [single_identifier]
+            {true, [single_identifier]}
           end
 
         [] ->
-          [__impossible__: true]
+          {false, []}
 
         many ->
-          [or: many]
+          {true, [or: many]}
       end
 
     query =
@@ -198,10 +198,15 @@ defmodule Ash.Actions.Relationships do
         action: Ash.primary_action!(relationship.destination, :read),
         query: query,
         path: [:relationships, relationship_name, type],
+        authorize?: possible?,
         data:
           Request.resolve(fn _data ->
-            query
-            |> api.read()
+            if possible? do
+              query
+              |> api.read()
+            else
+              []
+            end
           end),
         name: "read prior to write related #{relationship.name}"
       )

lib/ash/actions/side_load.ex

@@ -432,7 +432,7 @@ defmodule Ash.Actions.SideLoad do
       root_filter =
         case data do
           [] ->
-            [__impossible__: true]
+            false
 
           [%resource{} = item] ->
             item
@@ -588,8 +588,8 @@ defmodule Ash.Actions.SideLoad do
   end
 
   defp put_nested_relationship(request_filter, path, value, records? \\ true)
-  defp put_nested_relationship(_, _, [], true), do: [__impossible__: true]
-  defp put_nested_relationship(_, _, nil, true), do: [__impossible__: true]
+  defp put_nested_relationship(_, _, [], true), do: false
+  defp put_nested_relationship(_, _, nil, true), do: false
   defp put_nested_relationship(_, _, [], false), do: []
   defp put_nested_relationship(_, _, nil, false), do: []
 

lib/ash/data_layer/data_layer.ex

@@ -10,12 +10,10 @@ defmodule Ash.DataLayer do
   to ensure that the engine only ever tries to interact with the data layer in ways
   that it supports.
   """
-  @type filter_type :: :eq | :in
   @type feature() ::
           :transact
           | :async_engine
-          | {:filter, filter_type}
-          | {:filter_related, Ash.relationship_cardinality()}
+          | {:filter_predicate, struct}
           | :upsert
           | :composite_primary_key
 

lib/ash/data_layer/ets/ets.ex

@@ -5,7 +5,7 @@ defmodule Ash.DataLayer.Ets do
   This is used for testing. *Do not use this data layer in production*
   """
 
-  alias Ash.Filter.{Predicate, Expression, Not}
+  alias Ash.Filter.{Expression, Not, Predicate}
   alias Ash.Filter.Predicate.{Eq, In}
 
   @behaviour Ash.DataLayer
@@ -41,18 +41,10 @@ defmodule Ash.DataLayer.Ets do
     not private?(resource)
   end
 
-  def can?(_, :transact), do: false
-
   def can?(_, :composite_primary_key), do: true
   def can?(_, :upsert), do: true
-  def can?(_, {:filter, :in}), do: true
-  def can?(_, {:filter, :not_in}), do: true
-  def can?(_, {:filter, :not_eq}), do: true
-  def can?(_, {:filter, :eq}), do: true
-  def can?(_, {:filter, :and}), do: true
-  def can?(_, {:filter, :or}), do: true
-  def can?(_, {:filter, :not}), do: true
-  def can?(_, {:filter_related, _}), do: true
+  def can?(_, {:filter_predicate, %In{}}), do: true
+  def can?(_, {:filter_predicate, %Eq{}}), do: true
   def can?(_, _), do: false
 
   @impl true

lib/ash/engine/request.ex

@@ -43,7 +43,6 @@ defmodule Ash.Engine.Request do
     :data,
     :name,
     :api,
-    :authorization_filter,
     :query,
     :write_to_data?,
     :strict_check_only?,
@@ -393,6 +392,8 @@ defmodule Ash.Engine.Request do
   end
 
   defp do_strict_check(authorizer, request, notifications \\ []) do
+    strict_check_only? = request.strict_check_only?
+
     case missing_strict_check_dependencies?(authorizer, request) do
       [] ->
         case strict_check_authorizer(authorizer, request) do
@@ -402,41 +403,25 @@ defmodule Ash.Engine.Request do
           {:filter, filter} ->
             request
             |> Map.update!(:query, &Ash.Query.filter(&1, filter))
-            |> Map.update(:authorization_filter, filter, fn authorization_filter ->
-              if authorization_filter do
-                Ash.Filter.add_to_filter(authorization_filter, filter)
-              else
-                filter
-              end
-            end)
             |> set_authorizer_state(authorizer, :authorized)
             |> try_resolve([request.path ++ [:query]], false, false)
 
+          {:filter_and_continue, _, _} when strict_check_only? ->
+            {:error, "Request must pass strict check"}
+
           {:filter_and_continue, filter, new_authorizer_state} ->
-            if request.strict_check_only? do
-              {:error, "Request must pass strict check"}
-            else
-              new_request =
-                request
-                |> Map.update(:authorization_filter, filter, fn authorization_filter ->
-                  if authorization_filter do
-                    Ash.Filter.add_to_filter(authorization_filter, filter)
-                  else
-                    filter
-                  end
-                end)
-                |> Map.update!(:query, &Ash.Query.filter(&1, filter))
-                |> set_authorizer_state(authorizer, new_authorizer_state)
-
-              {:ok, new_request}
-            end
+            new_request =
+              request
+              |> Map.update!(:query, &Ash.Query.filter(&1, filter))
+              |> set_authorizer_state(authorizer, new_authorizer_state)
+
+            {:ok, new_request}
+
+          {:continue, _} when strict_check_only? ->
+            {:error, "Request must pass strict check"}
 
           {:continue, authorizer_state} ->
-            if request.strict_check_only? do
-              {:error, "Request must pass strict check"}
-            else
-              {:ok, set_authorizer_state(request, authorizer, authorizer_state)}
-            end
+            {:ok, set_authorizer_state(request, authorizer, authorizer_state)}
 
           {:error, error} ->
             {:error, error}
@@ -499,15 +484,7 @@ defmodule Ash.Engine.Request do
             {:ok, set_authorizer_state(request, authorizer, :authorized)}
 
           {:filter, filter} ->
-            request
-            |> Map.update(:authorization_filter, filter, fn authorization_filter ->
-              if authorization_filter do
-                Ash.Filter.add_to_filter(authorization_filter, filter)
-              else
-                filter
-              end
-            end)
-            |> runtime_filter(authorizer, filter)
+            runtime_filter(request, authorizer, filter)
 
           {:error, error} ->
             {:error, error}
@@ -624,7 +601,7 @@ defmodule Ash.Engine.Request do
     authorized? = Enum.all?(Map.values(request.authorizer_state), &(&1 == :authorized))
 
     # Don't fetch honor requests for dat until the request is authorized
-    if field in [:data, :query, :authorization_filter] and not authorized? and not internal? do
+    if field in [:data, :query] and not authorized? and not internal? do
       try_resolve_dependencies_of(request, field, internal?, optional?)
     else
       case Map.get(request, field) do

lib/ash/filter/expression.ex

@@ -1,4 +1,6 @@
 defmodule Ash.Filter.Expression do
+  @moduledoc "Represents a boolean expression"
+
   defstruct [:op, :left, :right]
 
   def new(_, nil, nil), do: nil