[P2][Tier-1] ActionBinding.check_authorization is authentication-presence only (audit B5)

[ty13r]

Severity: P2 (correctness/clarity) · Tier-1 (rename/redocument is mechanical)
Co-maintained repo (Pascal = architect).
Location: lib/ash_ui/runtime/action_binding.ex:167-174

check_authorization/2 returns {:ok, :authorized} whenever ResourceAccess.actor(context) is non-nil — no policy evaluation, never calls Runtime.check_action_authorization/3. Actions are authorized downstream by the target resource's Ash policies, so it isn't an open door today, but the name + moduledoc ("with proper authorization") overstate it, and any future caller building a context with authorize?: false would execute unauthorized.

Fix: route through Runtime.check_action_authorization/3, or rename/redocument as an authentication pre-check and assert authorize?: true at ResourceAccess.execute_action.

2026-05-28 cross-repo review — see ariston-ui docs/audits/cross-repo-review-2026-05-28.md (finding B5).

[ty13r]

Codex cross-validation (2026-05-28): SEVERITY P2->P3. Real defect (presence-only precheck at action_binding.ex:167), but NOT a total auth bypass — execution still routes through ResourceAccess.execute_action with actor + authorize?:true into Ash. Missing binding/action-level policy, not absent downstream authz.

[ty13r]

Codex cross-validation (2026-05-28): also flagged a context-key mismatch: ActionBinding.event_handler/2 builds context from :current_user, but mount assigns :ash_ui_user (action_binding.ex:345 vs liveview_integration.ex:313) — wired handlers can disagree with the main event path.