Who reads a runtime resource's versions — the policies of the version resources AshPaperTrail generates.

A version is a copy of its record, so it is read as the record is: by anyone under the request's surface, and by a master (site_id nil) on any site, by a site user on its own site — and, with shared?: true, on the shared records too — through whichever read it asks, :read_any included. Anybody else, a missing actor included, reads none. System reads pass authorize?: false; AshPaperTrail writes versions without authorization.

Versions loaded through their record — its :sorted_versions or AshPaperTrail's :paper_trail_versions — are the record's own, so the read that reached the record decides: a record's reads build the versions query ahead of the load, and Ash runs such a query with no actor.

The version resource takes the authorizer through the source resource's version_extensions, and its mixin quotes these policies into its body:

paper_trail do
  version_extensions authorizers: [Ash.Policy.Authorizer]
  mixin {MishkaCmsCore.Runtime.Resources.Mixins.LayoutPaperTrailMixin, :postgres, []}
end

# in the mixin's quoted body
unquote(
  MishkaCmsCore.Runtime.Resources.Mixins.VersionReach.policies(
    source: MishkaCmsCore.Runtime.Layout,
    shared?: true
  )
)

Options

• :source — the versioned resource. Required.
• :shared? — whether the resource has shared (site_id nil) records a site user reads. Defaults to false.