fix: CustomField policies, no system-actor fallback, guidelines
- Tests and UI pass actor for CustomField create/read/destroy; seeds use actor - Member required-custom-fields validation uses context.actor only (no fallback) - CODE_GUIDELINES: add rule forbidding system-actor fallbacks
This commit is contained in:
parent
36b5d5880b
commit
1d17c4f2dd
10 changed files with 116 additions and 43 deletions
|
|
@ -16,8 +16,10 @@ defmodule MvWeb.Components.MemberFilterComponentTest do
|
|||
|
||||
alias Mv.Membership.CustomField
|
||||
|
||||
# Helper to create a boolean custom field
|
||||
# Helper to create a boolean custom field (uses system_actor - only admin can create)
|
||||
defp create_boolean_custom_field(attrs \\ %{}) do
|
||||
system_actor = Mv.Helpers.SystemActor.get_system_actor()
|
||||
|
||||
default_attrs = %{
|
||||
name: "test_boolean_#{System.unique_integer([:positive])}",
|
||||
value_type: :boolean
|
||||
|
|
@ -27,11 +29,13 @@ defmodule MvWeb.Components.MemberFilterComponentTest do
|
|||
|
||||
CustomField
|
||||
|> Ash.Changeset.for_create(:create, attrs)
|
||||
|> Ash.create!()
|
||||
|> Ash.create!(actor: system_actor)
|
||||
end
|
||||
|
||||
# Helper to create a non-boolean custom field
|
||||
# Helper to create a non-boolean custom field (uses system_actor - only admin can create)
|
||||
defp create_string_custom_field(attrs \\ %{}) do
|
||||
system_actor = Mv.Helpers.SystemActor.get_system_actor()
|
||||
|
||||
default_attrs = %{
|
||||
name: "test_string_#{System.unique_integer([:positive])}",
|
||||
value_type: :string
|
||||
|
|
@ -41,7 +45,7 @@ defmodule MvWeb.Components.MemberFilterComponentTest do
|
|||
|
||||
CustomField
|
||||
|> Ash.Changeset.for_create(:create, attrs)
|
||||
|> Ash.create!()
|
||||
|> Ash.create!(actor: system_actor)
|
||||
end
|
||||
|
||||
describe "rendering" do
|
||||
|
|
|
|||
|
|
@ -20,8 +20,9 @@ defmodule MvWeb.CustomFieldLive.DeletionTest do
|
|||
|
||||
setup do
|
||||
system_actor = Mv.Helpers.SystemActor.get_system_actor()
|
||||
admin_role = Mv.Fixtures.role_fixture("admin")
|
||||
|
||||
# Create admin user for testing
|
||||
# Create admin user for testing (must have admin role to read/manage CustomField)
|
||||
{:ok, user} =
|
||||
Mv.Accounts.User
|
||||
|> Ash.Changeset.for_create(:register_with_password, %{
|
||||
|
|
@ -30,8 +31,17 @@ defmodule MvWeb.CustomFieldLive.DeletionTest do
|
|||
})
|
||||
|> Ash.create(actor: system_actor)
|
||||
|
||||
conn = log_in_user(build_conn(), user)
|
||||
%{conn: conn, user: user}
|
||||
{:ok, user} =
|
||||
user
|
||||
|> Ash.Changeset.for_update(:update, %{})
|
||||
|> Ash.Changeset.manage_relationship(:role, admin_role, type: :append_and_remove)
|
||||
|> Ash.update(actor: system_actor)
|
||||
|
||||
user_with_role = Ash.load!(user, :role, domain: Mv.Accounts, actor: system_actor)
|
||||
conn = log_in_user(build_conn(), user_with_role)
|
||||
# Use English locale so "Delete" link text matches in assertions
|
||||
conn = Plug.Test.init_test_session(conn, Map.put(conn.private.plug_session, "locale", "en"))
|
||||
%{conn: conn, user: user_with_role}
|
||||
end
|
||||
|
||||
describe "delete button and modal" do
|
||||
|
|
@ -107,9 +117,8 @@ defmodule MvWeb.CustomFieldLive.DeletionTest do
|
|||
|> element("#delete-custom-field-modal form")
|
||||
|> render_change(%{"slug" => custom_field.slug})
|
||||
|
||||
# Confirm button should be enabled now (no disabled attribute)
|
||||
html = render(view)
|
||||
refute html =~ ~r/disabled(?:=""|(?!\w))/
|
||||
# Confirm button should be enabled now (no disabled attribute on the confirm button)
|
||||
refute has_element?(view, "#delete-custom-field-modal button.btn-error[disabled]")
|
||||
end
|
||||
|
||||
test "delete button is disabled when slug doesn't match", %{conn: conn} do
|
||||
|
|
@ -126,9 +135,8 @@ defmodule MvWeb.CustomFieldLive.DeletionTest do
|
|||
|> element("#delete-custom-field-modal form")
|
||||
|> render_change(%{"slug" => "wrong-slug"})
|
||||
|
||||
# Button should be disabled
|
||||
html = render(view)
|
||||
assert html =~ ~r/disabled(?:=""|(?!\w))/
|
||||
# Confirm button should be disabled
|
||||
assert has_element?(view, "#delete-custom-field-modal button.btn-error[disabled]")
|
||||
end
|
||||
end
|
||||
|
||||
|
|
@ -186,10 +194,8 @@ defmodule MvWeb.CustomFieldLive.DeletionTest do
|
|||
|> element("#delete-custom-field-modal form")
|
||||
|> render_change(%{"slug" => "wrong-slug"})
|
||||
|
||||
# Button should be disabled and we cannot click it
|
||||
# The test verifies that the button is properly disabled in the UI
|
||||
html = render(view)
|
||||
assert html =~ ~r/disabled(?:=""|(?!\w))/
|
||||
# Confirm button should be disabled and we cannot click it
|
||||
assert has_element?(view, "#delete-custom-field-modal button.btn-error[disabled]")
|
||||
|
||||
# Custom field should still exist since deletion couldn't proceed
|
||||
system_actor = Mv.Helpers.SystemActor.get_system_actor()
|
||||
|
|
|
|||
|
|
@ -750,8 +750,10 @@ defmodule MvWeb.MemberLive.IndexTest do
|
|||
describe "boolean custom field filters" do
|
||||
alias Mv.Membership.CustomField
|
||||
|
||||
# Helper to create a boolean custom field
|
||||
# Helper to create a boolean custom field (uses system actor for authorization)
|
||||
defp create_boolean_custom_field(attrs \\ %{}) do
|
||||
system_actor = Mv.Helpers.SystemActor.get_system_actor()
|
||||
|
||||
default_attrs = %{
|
||||
name: "test_boolean_#{System.unique_integer([:positive])}",
|
||||
value_type: :boolean
|
||||
|
|
@ -761,11 +763,13 @@ defmodule MvWeb.MemberLive.IndexTest do
|
|||
|
||||
CustomField
|
||||
|> Ash.Changeset.for_create(:create, attrs)
|
||||
|> Ash.create!()
|
||||
|> Ash.create!(actor: system_actor)
|
||||
end
|
||||
|
||||
# Helper to create a non-boolean custom field
|
||||
# Helper to create a non-boolean custom field (uses system actor for authorization)
|
||||
defp create_string_custom_field(attrs \\ %{}) do
|
||||
system_actor = Mv.Helpers.SystemActor.get_system_actor()
|
||||
|
||||
default_attrs = %{
|
||||
name: "test_string_#{System.unique_integer([:positive])}",
|
||||
value_type: :string
|
||||
|
|
@ -775,7 +779,7 @@ defmodule MvWeb.MemberLive.IndexTest do
|
|||
|
||||
CustomField
|
||||
|> Ash.Changeset.for_create(:create, attrs)
|
||||
|> Ash.create!()
|
||||
|> Ash.create!(actor: system_actor)
|
||||
end
|
||||
|
||||
test "mount initializes boolean_custom_field_filters as empty map", %{conn: conn} do
|
||||
|
|
@ -1016,6 +1020,7 @@ defmodule MvWeb.MemberLive.IndexTest do
|
|||
|
||||
test "handle_params removes filter when custom field is deleted", %{conn: conn} do
|
||||
conn = conn_with_oidc_user(conn)
|
||||
system_actor = Mv.Helpers.SystemActor.get_system_actor()
|
||||
boolean_field = create_boolean_custom_field()
|
||||
|
||||
# Set up filter via URL
|
||||
|
|
@ -1026,8 +1031,8 @@ defmodule MvWeb.MemberLive.IndexTest do
|
|||
filters_before = state_before.socket.assigns.boolean_custom_field_filters
|
||||
assert filters_before[boolean_field.id] == true
|
||||
|
||||
# Delete the custom field
|
||||
Ash.destroy!(boolean_field)
|
||||
# Delete the custom field (requires actor with destroy permission)
|
||||
Ash.destroy!(boolean_field, actor: system_actor)
|
||||
|
||||
# Navigate again - filter should be removed since custom field no longer exists
|
||||
{:ok, view2, _html} =
|
||||
|
|
@ -1328,7 +1333,7 @@ defmodule MvWeb.MemberLive.IndexTest do
|
|||
|
||||
members = [member_with_true, member_with_false, member_without_value]
|
||||
filters = %{to_string(boolean_field.id) => true}
|
||||
all_custom_fields = Mv.Membership.CustomField |> Ash.read!()
|
||||
all_custom_fields = Mv.Membership.CustomField |> Ash.read!(actor: system_actor)
|
||||
|
||||
result =
|
||||
MvWeb.MemberLive.Index.apply_boolean_custom_field_filters(
|
||||
|
|
@ -1378,7 +1383,7 @@ defmodule MvWeb.MemberLive.IndexTest do
|
|||
|
||||
members = [member_with_true, member_with_false, member_without_value]
|
||||
filters = %{to_string(boolean_field.id) => false}
|
||||
all_custom_fields = Mv.Membership.CustomField |> Ash.read!()
|
||||
all_custom_fields = Mv.Membership.CustomField |> Ash.read!(actor: system_actor)
|
||||
|
||||
result =
|
||||
MvWeb.MemberLive.Index.apply_boolean_custom_field_filters(
|
||||
|
|
@ -1417,7 +1422,7 @@ defmodule MvWeb.MemberLive.IndexTest do
|
|||
|
||||
members = [member1, member2]
|
||||
filters = %{}
|
||||
all_custom_fields = Mv.Membership.CustomField |> Ash.read!()
|
||||
all_custom_fields = Mv.Membership.CustomField |> Ash.read!(actor: system_actor)
|
||||
|
||||
result =
|
||||
MvWeb.MemberLive.Index.apply_boolean_custom_field_filters(
|
||||
|
|
@ -1507,7 +1512,7 @@ defmodule MvWeb.MemberLive.IndexTest do
|
|||
to_string(boolean_field2.id) => true
|
||||
}
|
||||
|
||||
all_custom_fields = Mv.Membership.CustomField |> Ash.read!()
|
||||
all_custom_fields = Mv.Membership.CustomField |> Ash.read!(actor: system_actor)
|
||||
|
||||
result =
|
||||
MvWeb.MemberLive.Index.apply_boolean_custom_field_filters(
|
||||
|
|
@ -1538,7 +1543,7 @@ defmodule MvWeb.MemberLive.IndexTest do
|
|||
|
||||
members = [member]
|
||||
filters = %{fake_id => true}
|
||||
all_custom_fields = Mv.Membership.CustomField |> Ash.read!()
|
||||
all_custom_fields = Mv.Membership.CustomField |> Ash.read!(actor: system_actor)
|
||||
|
||||
result =
|
||||
MvWeb.MemberLive.Index.apply_boolean_custom_field_filters(
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue