ash_iam

# Changelog

All notable changes to this project will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [2.0.0] - 2025-01-14

### Added

- **Hierarchical Wildcard Matching**: Wildcard patterns now support hierarchical matching where `foo:bar:*` matches all nested resources:
  - `foo:bar:10` (direct child)
  - `foo:bar:10:baz` (nested child)
  - `foo:bar:10:baz:100:qux` (deeply nested)
- **SQL LIKE-based Filtering**: Wildcard patterns with `permission_identifier` now use SQL LIKE operations for efficient database-level filtering
- **Data Layer Validation**: Runtime validation ensures wildcard patterns with calculations are only used on PostgreSQL data layers
  - Clear error messages with actionable guidance when validation fails
  - Three solution paths provided: use AshPostgres, remove permission_identifier, or avoid wildcards

### Changed

- **BREAKING**: Test infrastructure migrated from ETS to AshPostgres for LIKE pattern support
  - All test resources now use PostgreSQL data layer
  - Database setup required for running tests (PostgreSQL with default port 5434)
  - Migration files added to `priv/repo/migrations/`
- **BREAKING**: Wildcard behavior with `permission_identifier` calculations now requires AshPostgres.DataLayer
  - Previous behavior: wildcards fell back to record-level checks (`:ok` return)
  - New behavior: wildcards generate SQL LIKE filters for query-level optimization OR raise error on non-Postgres layers
- IAM wildcard `*` now converts to SQL wildcard `%` for LIKE pattern matching
- Enhanced filter generation to build hierarchical LIKE filters: `author:123:*` becomes LIKE `author:123:%`

### Fixed

- Wildcard patterns now properly match nested resources at any depth level
- Query-level filtering performance significantly improved for hierarchical permissions
- Exact pattern matching continues to work on all data layers (no breaking changes for non-wildcard use)

### Migration Guide

If you are using `permission_identifier` with wildcard patterns:

1. **If using AshPostgres**: No changes needed, hierarchical matching now works automatically
2. **If using other data layers (ETS, Mnesia, etc.)**:
   - Option A: Migrate to AshPostgres.DataLayer for your resources
   - Option B: Remove `permission_identifier` configuration and use standard ID-based authorization
   - Option C: Avoid using wildcard patterns (`*`) in IAM policies for these resources (exact matches still work)

If you are NOT using `permission_identifier` or NOT using wildcards: No breaking changes, upgrade safely.

## [1.4.0] - 2025-01-14

### Added

- **Nested Resource Permissions**: Support for hierarchical resource relationships using the `permission_identifier` option
  - Define custom permission paths via Ash calculations (e.g., `author:5:posts:10:comments:123`)
  - Automatic query-level filtering for exact pattern matches
  - Full support for deeply nested resource hierarchies
- New configuration option: `permission_identifier` - specify a calculation or attribute field that returns the full permission identifier
- Comprehensive test coverage for nested permissions including exact matches, wildcards, deny precedence, and edge cases

### Fixed

- Backward compatibility issue where standard resources with 2-part identifiers (e.g., `author:UUID`) were not being filtered correctly
- Deny precedence now works correctly with nested resources: exact deny patterns properly override wildcard allow patterns using NOT IN filters
- Improved filter generation for calculation-based permission identifiers

### Changed

- Enhanced `generate_calculation_filter` to handle combinations of wildcard allows and exact denies
- Improved query-level filtering performance for nested resources with exact permission patterns

## [1.2.0] - 2025-09-30

### Added

- Enhanced policies for non-filter actions
- Better test coverage
- Generic action support with simple checks

### Fixed

- Policy evaluation for generic actions

## [1.1.0] - Previous Release

### Added

- AWS IAM-style policy evaluation
- High-performance authorization with regex caching
- Multiple policy document support
- Deny precedence
- Wildcard matching
- Configurable policy sources
- Complete Ash integration for CRUD and generic actions
- Flexible action mapping

[2.0.0]: https://github.com/wearecococo/ash-iam/compare/v1.4.0...v2.0.0
[1.4.0]: https://github.com/wearecococo/ash-iam/compare/v1.2.0...v1.4.0
[1.2.0]: https://github.com/wearecococo/ash-iam/compare/v1.1.0...v1.2.0
[1.1.0]: https://github.com/wearecococo/ash-iam/releases/tag/v1.1.0