An Elixir authorization and resource-loading library for Plug and Phoenix.LiveView applications.
Canary is an authorization library for Elixir applications built with Plug and Phoenix.LiveView. It restricts what resources the current user can access and automatically loads and assigns resources from the database, streamlining permission management and data handling in web applications.
Elixir developers building web applications with Phoenix (both traditional controllers and LiveView) who need integrated resource loading and authorization. It is particularly suited for teams implementing role-based or permission-based access control following convention-over-configuration patterns.
Developers choose Canary for its seamless integration with Elixir's Plug and Phoenix ecosystems, automatic resource loading that reduces boilerplate code, and its lightweight, inspired-by-CanCan design that simplifies authorization logic without heavy dependencies.
:hatching_chick: Elixir authorization and resource-loading library for Plug applications.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Provides dedicated plugs for Phoenix controllers and hooks for LiveView, fitting naturally into Elixir web app lifecycles without extra boilerplate.
Reduces repetitive code by fetching Ecto resources from the database based on request parameters and assigning them, as shown in examples for both Conn and LiveView.
Allows overriding user keys, customizing resource names, preloading associations, and using non-ID fields like slugs, offering adaptability for various use cases.
Supports including or excluding specific actions from authorization and loading logic, enabling precise permission management per endpoint or event.
Exclusively works with Ecto, making it unsuitable for applications using other databases or ORMs, which limits its applicability in mixed-stack projects.
Requires implementing the Canada.Can protocol, which can be less flexible for complex, hierarchical, or context-dependent authorization rules compared to policy-based alternatives.
The 2.0.0 version introduces deprecations and changes, such as removing :non_id_actions, forcing migration efforts and potential disruptions for existing users.