Centralize authorization enforcement

demo/lib/demo_web/item_actions/user_soft_delete.ex

@@ -67,14 +67,23 @@ defmodule DemoWeb.ItemActions.UserSoftDelete do
       try do
         updates = [set: [deleted_at: datetime]]
 
+        # Backpex re-read these items and authorized exactly them under this action's key before
+        # calling handle/3, so the write does not check again.
         {:ok, _count} =
-          Backpex.Resource.update_all(items, updates, "deleted", socket.assigns.live_resource)
+          Backpex.Resource.update_all(items, updates, socket.assigns, socket.assigns.live_resource,
+            event_name: "deleted",
+            authorize?: false
+          )
 
-        # nullify the user_id in the posts owned by the users
+        # nullify the user_id in the posts owned by the users. This is a cascade write on another
+        # resource, not a user-initiated action on it, so it skips authorization deliberately.
         _nullified_posts =
           items
           |> Enum.map(fn item ->
-            Backpex.Resource.update_all(item.posts, [set: [user_id: nil]], "updated", DemoWeb.PostLive)
+            Backpex.Resource.update_all(item.posts, [set: [user_id: nil]], socket.assigns, DemoWeb.PostLive,
+              event_name: "updated",
+              authorize?: false
+            )
           end)
 
         socket