From 0219073d338a55d0d4c4a09a29a24c2f87d7c870 Mon Sep 17 00:00:00 2001
From: Moritz <moritz.m@local-it.org>
Date: Tue, 27 Jan 2026 15:44:43 +0100
Subject: [PATCH] CFV policies test: system_actor for setup, verify destroy
 with actor

- create_linked_member_for_user and create_unlinked_member use actor
  (system_actor) directly instead of creating admin user per call
- Remove create_admin_user helper
- After destroy, verify with Ash.get(..., actor: actor) to avoid
  false positive from Forbidden vs NotFound
---
 .../custom_field_value_policies_test.exs      | 41 +++++++++++--------
 1 file changed, 24 insertions(+), 17 deletions(-)

diff --git a/test/mv/membership/custom_field_value_policies_test.exs b/test/mv/membership/custom_field_value_policies_test.exs
index c7a80db..d400aec 100644
--- a/test/mv/membership/custom_field_value_policies_test.exs
+++ b/test/mv/membership/custom_field_value_policies_test.exs
@@ -60,13 +60,7 @@ defmodule Mv.Membership.CustomFieldValuePoliciesTest do
     user_with_role
   end
 
-  defp create_admin_user(actor) do
-    create_user_with_permission_set("admin", actor)
-  end
-
   defp create_linked_member_for_user(user, actor) do
-    admin = create_admin_user(actor)
-
     {:ok, member} =
       Member
       |> Ash.Changeset.for_create(:create_member, %{
@@ -74,19 +68,17 @@ defmodule Mv.Membership.CustomFieldValuePoliciesTest do
         last_name: "Member",
         email: "linked#{System.unique_integer([:positive])}@example.com"
       })
-      |> Ash.create(actor: admin, return_notifications?: false)
+      |> Ash.create(actor: actor, return_notifications?: false)
 
     user
     |> Ash.Changeset.for_update(:update, %{})
     |> Ash.Changeset.force_change_attribute(:member_id, member.id)
-    |> Ash.update(actor: admin, domain: Mv.Accounts, return_notifications?: false)
+    |> Ash.update(actor: actor, domain: Mv.Accounts, return_notifications?: false)
 
     member
   end
 
   defp create_unlinked_member(actor) do
-    admin = create_admin_user(actor)
-
     {:ok, member} =
       Member
       |> Ash.Changeset.for_create(:create_member, %{
@@ -94,7 +86,7 @@ defmodule Mv.Membership.CustomFieldValuePoliciesTest do
         last_name: "Member",
         email: "unlinked#{System.unique_integer([:positive])}@example.com"
       })
-      |> Ash.create(actor: admin)
+      |> Ash.create(actor: actor)
 
     member
   end
@@ -201,11 +193,16 @@ defmodule Mv.Membership.CustomFieldValuePoliciesTest do
       assert cfv.custom_field_id == custom_field2.id
     end
 
-    test "can destroy custom field value of linked member", %{user: user, cfv_linked: cfv_linked} do
+    test "can destroy custom field value of linked member", %{
+      user: user,
+      cfv_linked: cfv_linked,
+      actor: actor
+    } do
       result = Ash.destroy(cfv_linked, actor: user, domain: Mv.Membership)
       assert :ok = result
 
-      assert {:error, _} = Ash.get(CustomFieldValue, cfv_linked.id, domain: Mv.Membership)
+      assert {:error, _} =
+               Ash.get(CustomFieldValue, cfv_linked.id, domain: Mv.Membership, actor: actor)
     end
 
     test "cannot read custom field values of unlinked member", %{
@@ -408,10 +405,15 @@ defmodule Mv.Membership.CustomFieldValuePoliciesTest do
       assert %Ash.Union{value: "updated", type: :string} = updated.value
     end
 
-    test "can destroy any custom field value", %{user: user, cfv_unlinked: cfv_unlinked} do
+    test "can destroy any custom field value", %{
+      user: user,
+      cfv_unlinked: cfv_unlinked,
+      actor: actor
+    } do
       :ok = Ash.destroy(cfv_unlinked, actor: user, domain: Mv.Membership)
 
-      assert {:error, _} = Ash.get(CustomFieldValue, cfv_unlinked.id, domain: Mv.Membership)
+      assert {:error, _} =
+               Ash.get(CustomFieldValue, cfv_unlinked.id, domain: Mv.Membership, actor: actor)
     end
   end
 
@@ -478,10 +480,15 @@ defmodule Mv.Membership.CustomFieldValuePoliciesTest do
       assert %Ash.Union{value: "updated", type: :string} = updated.value
     end
 
-    test "can destroy any custom field value", %{user: user, cfv_unlinked: cfv_unlinked} do
+    test "can destroy any custom field value", %{
+      user: user,
+      cfv_unlinked: cfv_unlinked,
+      actor: actor
+    } do
       :ok = Ash.destroy(cfv_unlinked, actor: user, domain: Mv.Membership)
 
-      assert {:error, _} = Ash.get(CustomFieldValue, cfv_unlinked.id, domain: Mv.Membership)
+      assert {:error, _} =
+               Ash.get(CustomFieldValue, cfv_unlinked.id, domain: Mv.Membership, actor: actor)
     end
   end
 end