Noir::ElixirPlugJudge

Decides whether a Phoenix/Plug plug can refuse an anonymous caller by reading its definition rather than its name. A module plug is judged by its call/2, a function plug (plug :require_user) by the def of that name in the plugging module or a module it imports; each together with the local helpers it calls and, a few hops deep, the remote helpers it resolves through aliases (H.unauthorized(conn, ...)).

A guard reads who the caller is (a current_user-style assign, an authorization/token header, a Guardian/Pow resource) and can refuse: a 401/403, a redirect to a login page, or, for a plug that halts, a 404 that hides the resource. A plug that only loads the user (AuthPlug assigning current_user) or redirects elsewhere (RequireLoggedOut sending users to their dashboard, a first-launch redirect to registration) is not one.

ponytail: textual over the reachable function bodies, not path-sensitive; a refusal that fires only for signed-in users (a ban check returning 403) still reads as a guard.