Where to authorize an insert?

[thruflo]

The description of the check and load callbacks https://hexdocs.pm/phoenix_sync/Phoenix.Sync.Writer.html#module-callbacks indicates that:

1. check should not hit the DB (all checks are run together before iterating through the operations)
2. load is not called for an insert

So where should I authorize an insert?

[thruflo]

Like this? https://github.com/thruflo/burn/blob/main/lib/burn/ingest.ex#L30 / https://github.com/thruflo/burn/blob/main/lib/burn_web/controllers/ingest_controller.ex#L13 ?

I.e.: use the check function to authorise the inserts and the load function to authorize the updates and deletes?

[magnetised]

You can do it in the check callback as you have done, with the load function using the user as an extra param to validate ownership, inside the validate changeset, or in the pre_apply callback.