MembershipFeeCycle: own_data read :linked via bypass and HasPermission scope

- own_data gets read scope :linked; apply_scope in HasPermission; bypass check for own_data.
- PermissionSetsTest expects own_data :linked, others :all for MFC read.
This commit is contained in:
Moritz 2026-02-04 09:20:10 +01:00
parent 890a4d3752
commit 178f5a01c7
6 changed files with 140 additions and 6 deletions

View file

@ -129,7 +129,7 @@ defmodule Mv.Authorization.PermissionSets do
group_read_all() ++
[perm("MemberGroup", :read, :linked)] ++
membership_fee_type_read_all() ++
membership_fee_cycle_read_all(),
[perm("MembershipFeeCycle", :read, :linked)],
pages: [
# No "/" - Mitglied must not see member index at root (same content as /members).
# Own profile (sidebar links to /users/:id) and own user edit