From 979b4e648d36c247c6ebcbc5d71f1536f3da1536 Mon Sep 17 00:00:00 2001
From: Zach Daniel <zach@zachdaniel.dev>
Date: Thu, 9 Mar 2023 07:55:27 -0500
Subject: [PATCH] fix: properly return `false` on forbidden errors

---
 lib/ash/api/api.ex | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/ash/api/api.ex b/lib/ash/api/api.ex
index 231bbf3c..c5453cfd 100644
--- a/lib/ash/api/api.ex
+++ b/lib/ash/api/api.ex
@@ -537,6 +537,9 @@ defmodule Ash.Api do
           end
 
         case authorizer.strict_check(authorizer_state, context) do
+          {:error, %{class: :forbidden} = e} when is_exception(e) ->
+            {:halt, {false, nil}}
+
           {:error, error} ->
             {:halt, {:error, error}}
 
@@ -563,6 +566,9 @@ defmodule Ash.Api do
       end
     )
     |> case do
+      {:error, error} ->
+        {:error, error}
+
       {true, query} when not is_nil(query) ->
         if opts[:run_queries?] do
           case query_or_changeset do