Posts CRUD and Ownership

Goal

This snapshot advances Solstice Ledger by teaching you to create, edit, and delete posts with owner authorization.

Every numbered folder is a complete app. Run this stage independently, then compare it with the previous folder.

Prerequisites

Use Elixir 1.15+, Mix, and Docker for Postgres stages.

Port 4001 must be free. Copy .env.example before starting database stages.

• Elixir and Mix
• A code editor and terminal
• Docker from part 4 onward

Concepts

Authorization compares session user with post.author_id.

Keep controllers thin: plugs prepare requests, contexts enforce rules, and HEEx escapes output by default.

Walkthrough

Return 403 when another account mutates.

Read the example, then open the matching snapshot. The repository includes the surrounding setup and error handling.

if user.id != post.author_id, do: raise Phoenix.ForbiddenError

Run and verify

Enter 09-Posts-CRUD-And-Ownership, fetch deps, copy .env.example, and start Phoenix on port 4001.

Open http://127.0.0.1:4001. Watch the terminal for validation and database errors.

docker compose up -d
git clone https://github.com/michaeldunga1/fcc-phoenix-blog.git
cd fcc-phoenix-blog/09-Posts-CRUD-And-Ownership
mix deps.get
cp .env.example .env
mix phx.server

Troubleshooting

UI hiding is not authorization.

For database failures, confirm Docker and the solstice_NN name when applicable. Never commit .env or _build/deps secrets.

• Read the first error first
• Restart after environment changes
• Never commit secrets

Try this

Log in as Ada and confirm Grace's post returns 403 on delete.

Test a happy path and one invalid or unauthorized request.

• Make one small change
• Test it in the browser
• Compare with the next snapshot only after it works