Merge remote-tracking branch 'origin/main' into feature/ui-for-adding-members-groups

.drone.yml

@@ -273,7 +273,7 @@ environment:
 
 steps:
   - name: renovate
-    image: renovate/renovate:42.81
+    image: renovate/renovate:42.97
     environment:
       RENOVATE_CONFIG_FILE: "renovate_backend_config.js"
       RENOVATE_TOKEN:

.env.example

@@ -11,9 +11,22 @@ PHX_HOST=localhost
 # Recommended: Association settings
 ASSOCIATION_NAME="Sportsclub XYZ"
 
+# Optional: Admin user (created/updated on container start via Release.seed_admin)
+# In production, set these so the first admin can log in. Change password without redeploy:
+#   bin/mv eval "Mv.Release.seed_admin()"  (with new ADMIN_PASSWORD or ADMIN_PASSWORD_FILE)
+# ADMIN_EMAIL=admin@example.com
+# ADMIN_PASSWORD=secure-password
+# ADMIN_PASSWORD_FILE=/run/secrets/admin_password
+
 # Optional: OIDC Configuration
 # These have defaults in docker-compose.prod.yml, only override if needed
 # OIDC_CLIENT_ID=mv
 # OIDC_BASE_URL=http://localhost:8080/auth/v1
 # OIDC_REDIRECT_URI=http://localhost:4001/auth/user/rauthy/callback
 # OIDC_CLIENT_SECRET=your-rauthy-client-secret
+
+# Optional: OIDC group → Admin role sync (e.g. Authentik groups from profile scope)
+# If OIDC_ADMIN_GROUP_NAME is set, users in that group get Admin role on registration/sign-in.
+# OIDC_GROUPS_CLAIM defaults to "groups" (JWT claim name for group list).
+# OIDC_ADMIN_GROUP_NAME=admin
+# OIDC_GROUPS_CLAIM=groups

CODE_GUIDELINES.md

@@ -81,9 +81,11 @@ lib/
 ├── membership/            # Membership domain
 │   ├── membership.ex      # Domain definition
 │   ├── member.ex          # Member resource
+│   ├── custom_field.ex               # Custom field (definition) resource
 │   ├── custom_field_value.ex        # Custom field value resource
-│   ├── custom_field.ex   # CustomFieldValue type resource
 │   ├── setting.ex         # Global settings (singleton resource)
+│   ├── group.ex           # Group resource
+│   ├── member_group.ex    # MemberGroup join table resource
 │   └── email.ex           # Email custom type
 ├── membership_fees/        # MembershipFees domain
 │   ├── membership_fees.ex # Domain definition
@@ -149,6 +151,10 @@ lib/
 │   │   ├── membership_fee_type_live/ # Membership fee type LiveViews
 │   │   ├── membership_fee_settings_live.ex # Membership fee settings
 │   │   ├── global_settings_live.ex # Global settings
+│   │   ├── group_live/     # Group management LiveViews
+│   │   ├── import_export_live.ex    # CSV import/export LiveView (mount/events/glue only)
+│   │   ├── import_export_live/     # Import/Export UI components
+│   │   │   └── components.ex       # custom_fields_notice, template_links, import_form, progress, results
 │   │   └── contribution_type_live/ # Contribution types (mock-up)
 │   ├── auth_overrides.ex  # AshAuthentication overrides
 │   ├── endpoint.ex        # Phoenix endpoint
@@ -194,7 +200,8 @@ test/
 ├── seeds_test.exs         # Database seed tests
 └── support/               # Test helpers
     ├── conn_case.ex       # Controller test helpers
-    └── data_case.ex       # Data layer test helpers
+    ├── data_case.ex       # Data layer test helpers
+    └── fixtures.ex        # Shared test fixtures (Mv.Fixtures)
 ```
 
 ### 1.2 Module Organization
@@ -641,7 +648,95 @@ def card(assigns) do
 end
 ```
 
-### 3.3 System Actor Pattern
+### 3.3 CSV Import Configuration
+
+**CSV Import Limits:**
+
+CSV import functionality supports configurable limits to prevent resource exhaustion:
+
+```elixir
+# config/config.exs
+config :mv,
+  csv_import: [
+    max_file_size_mb: 10,  # Maximum file size in megabytes
+    max_rows: 1000          # Maximum number of data rows (excluding header)
+  ]
+```
+
+**Accessing Configuration:**
+
+Use `Mv.Config` helper functions:
+
+```elixir
+# Get max file size in bytes
+max_bytes = Mv.Config.csv_import_max_file_size_bytes()
+
+# Get max file size in megabytes
+max_mb = Mv.Config.csv_import_max_file_size_mb()
+
+# Get max rows
+max_rows = Mv.Config.csv_import_max_rows()
+```
+
+**Best Practices:**
+- Set reasonable limits based on server resources
+- Display limits to users in UI
+- Validate file size before upload
+- Process imports in chunks (default: 200 rows per chunk)
+- Cap error collection (default: 50 errors per import)
+
+### 3.4 Page-Level Authorization
+
+**CheckPagePermission Plug:**
+
+Use `MvWeb.Plugs.CheckPagePermission` for page-level authorization:
+
+```elixir
+# lib/mv_web/router.ex
+defmodule MvWeb.Router do
+  use MvWeb, :router
+  
+  # Add plug to router pipeline
+  pipeline :browser do
+    plug :accepts, ["html"]
+    plug :fetch_session
+    plug :fetch_live_flash
+    plug :put_root_layout, html: {MvWeb.Layouts, :root}
+    plug :protect_from_forgery
+    plug :put_secure_browser_headers
+    plug MvWeb.Plugs.CheckPagePermission  # Page-level authorization
+  end
+end
+```
+
+**Permission Set Route Matrix:**
+
+Routes are mapped to permission sets:
+- `own_data`: Can access `/profile` and `/members/:id` (own linked member only)
+- `read_only`: Can read all data, cannot modify
+- `normal_user`: Can read and modify most data
+- `admin`: Full access to all routes
+
+**Usage in LiveViews:**
+
+```elixir
+# Check page access before mount
+def mount(_params, _session, socket) do
+  actor = current_actor(socket)
+  
+  if MvWeb.Authorization.can_access_page?(actor, "/admin/roles") do
+    {:ok, assign(socket, :roles, load_roles(actor))}
+  else
+    {:ok, redirect(socket, to: ~p"/")}
+  end
+end
+```
+
+**Public Paths:**
+
+Public paths (login, OIDC callbacks) are excluded from permission checks automatically.
+
+### 3.5 System Actor Pattern
 
 **When to Use System Actor:**
 
@@ -726,7 +821,7 @@ Two mechanisms exist for bypassing standard authorization:
 
 **See also:** `docs/roles-and-permissions-architecture.md` (Authorization Bootstrap Patterns section)
 
-### 3.4 Ash Framework
+### 3.6 Ash Framework
 
 **Resource Definition Best Practices:**
 
@@ -1247,7 +1342,8 @@ test/
 │   └── components/
 └── support/               # Test helpers
     ├── conn_case.ex       # Controller test setup
-    └── data_case.ex       # Database test setup
+    ├── data_case.ex       # Database test setup
+    └── fixtures.ex        # Shared test fixtures (Mv.Fixtures)
 ```
 
 **Test File Naming:**

config/config.exs

@@ -58,6 +58,11 @@ config :mv,
     max_rows: 1000
   ]
 
+# OIDC group → role sync (optional). Overridden in runtime.exs from ENV in production.
+config :mv, :oidc_role_sync,
+  admin_group_name: nil,
+  groups_claim: "groups"
+
 # Configures the endpoint
 config :mv, MvWeb.Endpoint,
   url: [host: "localhost"],

config/runtime.exs

@@ -89,6 +89,11 @@ if System.get_env("PHX_SERVER") do
   config :mv, MvWeb.Endpoint, server: true
 end
 
+# OIDC group → Admin role sync: read from ENV in all environments (dev/test/prod)
+config :mv, :oidc_role_sync,
+  admin_group_name: System.get_env("OIDC_ADMIN_GROUP_NAME"),
+  groups_claim: System.get_env("OIDC_GROUPS_CLAIM") || "groups"
+
 if config_env() == :prod do
   database_url = build_database_url.()
 

docker-compose.yml

@@ -25,7 +25,7 @@ services:
 
   rauthy:
     container_name: rauthy-dev
-    image: ghcr.io/sebadob/rauthy:0.33.4
+    image: ghcr.io/sebadob/rauthy:0.34.3
     environment:
       - LOCAL_TEST=true
       - SMTP_URL=mailcrab

docs/admin-bootstrap-and-oidc-role-sync.md

@@ -0,0 +1,54 @@
+# Admin Bootstrap and OIDC Role Sync
+
+## Overview
+
+- **Admin bootstrap:** In production, no seeds run. The first admin user is created/updated from environment variables in the Docker entrypoint (after migrate, before server). Password can be changed without redeploy via `bin/mv eval "Mv.Release.seed_admin()"`.
+- **OIDC role sync:** Optional mapping from OIDC groups (e.g. from Authentik profile scope) to the Admin role. Users in the configured admin group get the Admin role on registration and on each sign-in.
+
+## Admin Bootstrap (Part A)
+
+### Environment Variables
+
+- `ADMIN_EMAIL` – Email of the admin user to create/update. If unset, seed_admin/0 does nothing.
+- `ADMIN_PASSWORD` – Password for the admin user. If unset (and no file), no new user is created; if a user with ADMIN_EMAIL already exists (e.g. OIDC-only), their role is set to Admin (no password change).
+- `ADMIN_PASSWORD_FILE` – Path to a file containing the password (e.g. Docker secret).
+
+### Release Task
+
+- `Mv.Release.seed_admin/0` – Reads ADMIN_EMAIL and password from ADMIN_PASSWORD or ADMIN_PASSWORD_FILE. If both email and password are set: creates or updates the user with the Admin role. If only ADMIN_EMAIL is set: sets the Admin role on an existing user with that email (for OIDC-only admins); does not create a user. Idempotent.
+
+### Entrypoint
+
+- rel/overlays/bin/docker-entrypoint.sh – After migrate, runs seed_admin(), then starts the server.
+
+### Seeds (Dev/Test)
+
+- priv/repo/seeds.exs – Uses ADMIN_PASSWORD or ADMIN_PASSWORD_FILE when set; otherwise fallback "testpassword" only in dev/test.
+
+## OIDC Role Sync (Part B)
+
+### Configuration
+
+- `OIDC_ADMIN_GROUP_NAME` – OIDC group name that maps to the Admin role. If unset, no role sync.
+- `OIDC_GROUPS_CLAIM` – JWT claim name for group list (default "groups").
+- Module: Mv.OidcRoleSyncConfig (oidc_admin_group_name/0, oidc_groups_claim/0).
+
+### Sync Logic
+
+- Mv.OidcRoleSync.apply_admin_role_from_user_info(user, user_info) – If admin group configured, sets user role to Admin or Mitglied based on user_info groups.
+
+### Where It Runs
+
+1. Registration: register_with_rauthy after_action calls OidcRoleSync.
+2. Sign-in: sign_in_with_rauthy prepare after_action calls OidcRoleSync for each user.
+
+### Internal Action
+
+- User.set_role_from_oidc_sync – Internal update (role_id only). Used by OidcRoleSync; not exposed.
+
+## See Also
+
+- .env.example – Admin and OIDC group env vars.
+- lib/mv/release.ex – seed_admin/0.
+- lib/mv/oidc_role_sync.ex – Sync implementation.
+- docs/oidc-account-linking.md – OIDC account linking.

docs/csv-member-import-v1.md

@@ -696,11 +696,14 @@ lib/
 │   └── membership/
 │       └── import/
 │           ├── member_csv.ex          # prepare + process_chunk
+│           ├── import_runner.ex       # orchestration: file read, progress merge, chunk process, error format
 │           ├── csv_parser.ex          # delimiter detection + parsing + BOM handling
 │           └── header_mapper.ex       # normalization + header mapping
 └── mv_web/
     └── live/
-        └── global_settings_live.ex    # add import section + LV message loop
+        ├── import_export_live.ex       # mount / handle_event / handle_info + glue only
+        └── import_export_live/
+            └── components.ex          # UI: custom_fields_notice, template_links, import_form, import_progress, import_results
 
 priv/
 └── static/

docs/database-schema-readme.md

@@ -15,10 +15,10 @@ This document provides a comprehensive overview of the Mila Membership Managemen
 
 | Metric | Count |
 |--------|-------|
-| **Tables** | 9 |
+| **Tables** | 11 |
 | **Domains** | 4 (Accounts, Membership, MembershipFees, Authorization) |
-| **Relationships** | 7 |
-| **Indexes** | 20+ |
+| **Relationships** | 9 |
+| **Indexes** | 25+ |
 | **Triggers** | 1 (Full-text search) |
 
 ## Tables Overview
@@ -77,6 +77,23 @@ This document provides a comprehensive overview of the Mila Membership Managemen
   - Membership fee default settings
   - Environment variable support for club name
 
+#### `groups`
+- **Purpose:** Group definitions for organizing members
+- **Rows (Estimated):** Low (typically 5-20 groups per club)
+- **Key Features:**
+  - Unique group names (case-insensitive)
+  - URL-friendly slugs (auto-generated, immutable)
+  - Optional descriptions
+  - Many-to-many relationship with members
+
+#### `member_groups`
+- **Purpose:** Join table for many-to-many relationship between members and groups
+- **Rows (Estimated):** Medium to High (multiple groups per member)
+- **Key Features:**
+  - Unique constraint on (member_id, group_id)
+  - CASCADE delete on both sides
+  - Efficient indexes for queries
+
 ### Authorization Domain
 
 #### `roles`
@@ -100,6 +117,10 @@ Member (1) → (N) MembershipFeeCycles
                     ↓
             MembershipFeeType (1)
 
+Member (N) ←→ (N) Group
+       ↓              ↓
+  MemberGroups (N)  MemberGroups (N)
+
 Settings (1) → MembershipFeeType (0..1)
 ```
 
@@ -145,6 +166,12 @@ Settings (1) → MembershipFeeType (0..1)
    - Settings can reference a default fee type
    - `ON DELETE SET NULL` - if fee type is deleted, setting is cleared
 
+9. **Member ↔ Group (N:N via MemberGroup)**
+   - Many-to-many relationship through `member_groups` join table
+   - `ON DELETE CASCADE` on both sides - removing member/group removes associations
+   - Unique constraint on (member_id, group_id) prevents duplicates
+   - Groups searchable via member search vector
+
 ## Important Business Rules
 
 ### Email Synchronization
@@ -509,7 +536,7 @@ mix run priv/repo/seeds.exs
 
 ---
 
-**Last Updated:** 2026-01-13  
-**Schema Version:** 1.4  
+**Last Updated:** 2026-01-27  
+**Schema Version:** 1.5  
 **Database:** PostgreSQL 17.6 (dev) / 16 (prod)
 

docs/development-progress-log.md

@@ -1752,8 +1752,151 @@ This project demonstrates a modern Phoenix application built with:
 
 ---
 
-**Document Version:** 1.4  
-**Last Updated:** 2026-01-13  
+---
+
+## Recent Updates (2026-01-13 to 2026-01-27)
+
+### Groups Feature Implementation (2026-01-27)
+
+**PR #378:** *Add groups resource* (closes #371)
+- Created `Mv.Membership.Group` resource with name, slug, description
+- Created `Mv.Membership.MemberGroup` join table for many-to-many relationship
+- Automatic slug generation from name (immutable after creation)
+- Case-insensitive name uniqueness via LOWER(name) index
+- Database migration: `20260127141620_add_groups_and_member_groups.exs`
+
+**PR #382:** *Groups Admin UI* (closes #372)
+- Groups management LiveViews (`/groups`)
+- Create, edit, delete groups with confirmation
+- Member count display per group
+- Add/remove members from groups
+- Groups displayed in member overview and detail views
+- Filter and sort by groups in member list
+
+**Key Features:**
+- Many-to-many relationship: Members can belong to multiple groups
+- Groups searchable via member search vector (full-text search)
+- CASCADE delete: Removing member/group removes associations
+- Unique constraint prevents duplicate member-group associations
+
+### CSV Import Feature Implementation (2026-01-27)
+
+**PR #359:** *Implements CSV Import UI* (closes #335)
+- Import/Export LiveView (`/import_export`)
+- CSV file upload with auto-upload
+- Real-time import progress tracking
+- Error and warning reporting
+- Chunked processing (200 rows per chunk)
+
+**PR #394:** *Adds config for import limits* (closes #336)
+- Configurable maximum file size (default: 10 MB)
+- Configurable maximum rows (default: 1000)
+- Configuration via `config :mv, csv_import: [max_file_size_mb: ..., max_rows: ...]`
+- UI displays limits to users
+
+**PR #395:** *Implements custom field CSV import* (closes #338)
+- Support for importing custom field values via CSV
+- Custom field mapping by slug or name
+- Validation of custom field value types
+- Error reporting with line numbers and field names
+- CSV templates (German and English) available for download
+
+**Key Features:**
+- Member field import (email, first_name, last_name, etc.)
+- Custom field value import (all types: string, integer, boolean, date, email)
+- Error capping (max 50 errors per import to prevent memory issues)
+- Async chunk processing with progress updates
+- Admin-only access (requires `:create` permission on Member resource)
+
+### Page Permission Router Plug (2026-01-27)
+
+**PR #390:** *Page Permission Router Plug* (closes #388)
+- `MvWeb.Plugs.CheckPagePermission` plug for page-level authorization
+- Route-based permission checking
+- Automatic redirects for unauthorized access
+- Integration with permission sets (own_data, read_only, normal_user, admin)
+- Documentation: `docs/page-permission-route-coverage.md`
+
+**Key Features:**
+- Page-level access control before LiveView mount
+- Permission set-based route matrix
+- Redirect targets for different permission levels
+- Public paths (login, OIDC callbacks) excluded from checks
+
+### Resource Policies Implementation (2026-01-27)
+
+**PR #387:** *CustomField Resource Policies* (closes #386)
+- CustomField resource policies with actor-based authorization
+- Admin-only create/update/destroy operations
+- Read access for authenticated users
+- No system-actor fallback (explicit actor required)
+
+**PR #377:** *CustomFieldValue Resource Policies* (closes #369)
+- CustomFieldValue resource policies
+- own_data permission set: can create/update own linked member's custom field values
+- Admin and normal_user: full access
+- Bypass read rule for CustomFieldValue pattern (documented)
+
+**PR #364:** *User Resource Policies* (closes #363)
+- User resource policies with scope filtering
+- own_data: can read/update own user record
+- Admin: full access
+- Email change validation for linked members
+
+### System Actor Improvements (2026-01-27)
+
+**PR #379:** *Fix System missing system actor in prod and prevent deletion*
+- System actor user creation in migrations
+- Block update/destroy on system-actor user
+- System user handling in UserLive forms
+- Normalize system actor email
+
+**PR #361:** *System Actor Mode for Systemic Flows* (closes #348)
+- System actor pattern for systemic operations
+- Email synchronization uses system actor
+- Cycle generation uses system actor
+- Documentation: `docs/roles-and-permissions-architecture.md` (Authorization Bootstrap Patterns)
+
+**PR #367:** *Remove NoActor bypass*
+- Removed NoActor bypass to prevent masking authorization bugs
+- All tests now require explicit actor
+- Exception: AshAuthentication bypass tests (conscious exception)
+
+### Email Sync Fixes (2026-01-27)
+
+**PR #380:** *Fix email sync (user->member) when changing password and email*
+- Email sync when admin sets password via `admin_set_password`
+- Bidirectional email synchronization improvements
+- Validation fixes for linked user-member pairs
+
+### UI/UX Improvements (2026-01-27)
+
+**PR #389:** *Change Logo* (closes #385)
+- Updated application logo
+- Logo display in sidebar and navigation
+
+**PR #362:** *Add boolean custom field filters to member overview* (closes #309)
+- Boolean custom field filtering in member list
+- Filter by true/false values
+- Integration with existing filter system
+
+### Test Performance Optimization (2026-01-27)
+
+**PR #384:** *Minor test refactoring to improve on performance* (closes #383)
+- Moved slow tests to nightly test suite
+- Optimized policy tests
+- Reduced test complexity in seeds tests
+- Documentation: `docs/test-performance-optimization.md`
+
+**Key Changes:**
+- Fast tests (standard CI): Business logic, validations, data persistence
+- Slow tests (nightly): Performance tests, large datasets, query optimization
+- UI tests: Basic HTML rendering, navigation, translations
+
+---
+
+**Document Version:** 1.5  
+**Last Updated:** 2026-01-27  
 **Maintainer:** Development Team  
 **Status:** Living Document (update as project evolves)
 

docs/email-sync.md

@@ -4,6 +4,7 @@
 2. **DB constraints** - Prevent duplicates within same table (users.email, members.email)
 3. **Custom validations** - Prevent cross-table conflicts only for linked entities
 4. **Sync is bidirectional**: User ↔ Member (but User always wins on link)
+5. **Linked member email change** - When a member is linked, only administrators or the linked user may change that member's email (Member resource validation `EmailChangePermission`). Because User.email wins on link and changes sync Member → User, allowing anyone to change a linked member's email would overwrite that user's account email; this rule keeps sync under control.
 
 ---
 

docs/feature-roadmap.md

@@ -1,7 +1,7 @@
 # Feature Roadmap & Implementation Plan
 
 **Project:** Mila - Membership Management System  
-**Last Updated:** 2026-01-13  
+**Last Updated:** 2026-01-27  
 **Status:** Active Development
 
 ---
@@ -29,6 +29,10 @@
 - ✅ **OIDC account linking with password verification** (PR #192, closes #171)
 - ✅ **Secure OIDC email collision handling** (PR #192)
 - ✅ **Automatic linking for passwordless users** (PR #192)
+- ✅ **Page Permission Router Plug** - Page-level authorization (PR #390, closes #388, 2026-01-27)
+  - Route-based permission checking
+  - Automatic redirects for unauthorized access
+  - Integration with permission sets
 
 **Closed Issues:**
 - ✅ [#171](https://git.local-it.org/local-it/mitgliederverwaltung/issues/171) - OIDC handling and linking (closed 2025-11-13)
@@ -55,6 +59,10 @@
 - ✅ [#191](https://git.local-it.org/local-it/mitgliederverwaltung/issues/191) - Implement Roles in Ash (M) - Completed
 - ✅ [#190](https://git.local-it.org/local-it/mitgliederverwaltung/issues/190) - Implement Permissions in Ash (M) - Completed
 - ✅ [#151](https://git.local-it.org/local-it/mitgliederverwaltung/issues/151) - Define implementation plan for roles and permissions (M) - Completed
+- ✅ [#388](https://git.local-it.org/local-it/mitgliederverwaltung/issues/388) - Page Permission Router Plug (closed 2026-01-27)
+- ✅ [#386](https://git.local-it.org/local-it/mitgliederverwaltung/issues/386) - CustomField Resource Policies (closed 2026-01-27)
+- ✅ [#369](https://git.local-it.org/local-it/mitgliederverwaltung/issues/369) - CustomFieldValue Resource Policies (closed 2026-01-27)
+- ✅ [#363](https://git.local-it.org/local-it/mitgliederverwaltung/issues/363) - User Resource Policies (closed 2026-01-27)
 
 ---
 
@@ -73,9 +81,24 @@
 - ✅ User-Member linking (optional 1:1)
 - ✅ Email synchronization between User and Member
 - ✅ **Bulk email copy** - Copy selected members' email addresses to clipboard (Issue #230)
+- ✅ **Groups** - Organize members into groups (PR #378, #382, closes #371, #372, 2026-01-27)
+  - Many-to-many relationship with groups
+  - Groups management UI (`/groups`)
+  - Filter and sort by groups in member list
+  - Groups displayed in member overview and detail views
+- ✅ **CSV Import** - Import members from CSV files (PR #359, #394, #395, closes #335, #336, #338, 2026-01-27)
+  - Member field import
+  - Custom field value import
+  - Real-time progress tracking
+  - Error reporting
 
 **Closed Issues:**
 - ✅ [#162](https://git.local-it.org/local-it/mitgliederverwaltung/issues/162) - Fuzzy and substring search (closed 2025-11-12)
+- ✅ [#371](https://git.local-it.org/local-it/mitgliederverwaltung/issues/371) - Add groups resource (closed 2026-01-27)
+- ✅ [#372](https://git.local-it.org/local-it/mitgliederverwaltung/issues/372) - Groups Admin UI (closed 2026-01-27)
+- ✅ [#335](https://git.local-it.org/local-it/mitgliederverwaltung/issues/335) - CSV Import UI (closed 2026-01-27)
+- ✅ [#336](https://git.local-it.org/local-it/mitgliederverwaltung/issues/336) - Config for import limits (closed 2026-01-27)
+- ✅ [#338](https://git.local-it.org/local-it/mitgliederverwaltung/issues/338) - Custom field CSV import (closed 2026-01-27)
 
 **Open Issues:**
 - [#169](https://git.local-it.org/local-it/mitgliederverwaltung/issues/169) - Allow combined creation of Users/Members (M, Low priority)
@@ -88,7 +111,7 @@
 - ❌ Advanced filters (date ranges, multiple criteria)
 - ❌ Pagination (currently all members loaded)
 - ❌ Bulk operations (bulk delete, bulk update)
-- ❌ Member import/export (CSV, Excel)
+- ❌ Excel import for members
 - ❌ Member profile photos/avatars
 - ❌ Member history/audit log
 - ❌ Duplicate detection
@@ -288,12 +311,24 @@
 - ✅ **CSV Import Templates** - German and English templates (#329, 2026-01-13)
   - Template files in `priv/static/templates/member_import_de.csv` and `member_import_en.csv`
   - CSV specification documented in `docs/csv-member-import-v1.md`
+- ✅ **CSV Import Implementation** - Full CSV import feature (#335, #336, #338, 2026-01-27)
+  - Import/Export LiveView (`/import_export`)
+  - Member field import (email, first_name, last_name, etc.)
+  - Custom field value import (all types: string, integer, boolean, date, email)
+  - Real-time progress tracking
+  - Error and warning reporting with line numbers
+  - Configurable limits (max file size, max rows)
+  - Chunked processing (200 rows per chunk)
+  - Admin-only access
+
+**Closed Issues:**
+- ✅ [#335](https://git.local-it.org/local-it/mitgliederverwaltung/issues/335) - CSV Import UI (closed 2026-01-27)
+- ✅ [#336](https://git.local-it.org/local-it/mitgliederverwaltung/issues/336) - Config for import limits (closed 2026-01-27)
+- ✅ [#338](https://git.local-it.org/local-it/mitgliederverwaltung/issues/338) - Custom field CSV import (closed 2026-01-27)
 
 **Missing Features:**
-- ❌ CSV import implementation (templates ready, import logic pending)
 - ❌ Excel import for members
-- ❌ Import validation and preview
-- ❌ Import error handling
+- ❌ Import validation preview (before import)
 - ❌ Bulk data export
 - ❌ Backup export
 - ❌ Data migration tools

docs/groups-architecture.md

@@ -4,7 +4,7 @@
 **Feature:** Groups Management  
 **Version:** 1.0  
 **Last Updated:** 2025-01-XX  
-**Status:** Architecture Design - Ready for Implementation
+**Status:** ✅ Implemented (authorization: see [roles-and-permissions-architecture.md](./roles-and-permissions-architecture.md))
 
 ---
 
@@ -427,15 +427,17 @@ lib/
 
 ## Authorization
 
+**Status:** ✅ Implemented. Group and MemberGroup resource policies and PermissionSets are in place. See [roles-and-permissions-architecture.md](./roles-and-permissions-architecture.md) for the full permission matrix and policy patterns.
+
 ### Permission Model (MVP)
 
-**Resource:** `groups`
+**Resource:** `Group` (and `MemberGroup`)
 
 **Actions:**
-- `read` - View groups (all users with member read permission)
-- `create` - Create groups (admin only)
-- `update` - Edit groups (admin only)
-- `destroy` - Delete groups (admin only)
+- `read` - View groups (all permission sets)
+- `create` - Create groups (normal_user and admin)
+- `update` - Edit groups (normal_user and admin)
+- `destroy` - Delete groups (normal_user and admin)
 
 **Scopes:**
 - `:all` - All groups (for all permission sets that have read access)
@@ -457,7 +459,7 @@ lib/
 **Own Data Permission Set:**
 - `read` action on `Group` resource with `:all` scope - granted
 
-**Note:** All permission sets use `:all` scope for groups. Groups are considered public information that all users with member read permission can view. Only admins can manage (create/update/destroy) groups.
+**Note:** All permission sets use `:all` scope for groups. Groups are considered public information that all users with member read permission can view. normal_user and admin can manage (create/update/destroy) groups.
 
 ### Member-Group Association Permissions
 

docs/membership-fee-architecture.md

@@ -334,20 +334,18 @@ lib/
 
 ### Permission System Integration
 
-**See:** [roles-and-permissions-architecture.md](./roles-and-permissions-architecture.md)
+**Status:** ✅ Implemented. See [roles-and-permissions-architecture.md](./roles-and-permissions-architecture.md) for the full permission matrix and policy patterns.
 
-**Required Permissions:**
+**PermissionSets (lib/mv/authorization/permission_sets.ex):**
 
-- `MembershipFeeType.create/update/destroy` - Admin only
-- `MembershipFeeType.read` - Admin, Treasurer, Board
-- `MembershipFeeCycle.update` (status changes) - Admin, Treasurer
-- `MembershipFeeCycle.read` - Admin, Treasurer, Board, Own member
+- **MembershipFeeType:** All permission sets can read (:all); only admin has create/update/destroy (:all).
+- **MembershipFeeCycle:** All can read (:all); read_only has read only; normal_user and admin have read + create + update + destroy (:all).
+- **Manual "Regenerate Cycles" (UI + server):** The "Regenerate Cycles" button in the member detail view is shown to users who have MembershipFeeCycle create permission (normal_user and admin). UI access is gated by `can_create_cycle`. The LiveView handler also enforces `can?(:create, MembershipFeeCycle)` server-side before running regeneration (so e.g. a read_only user cannot trigger it via DevTools). Regeneration runs with system actor.
 
-**Policy Patterns:**
+**Resource Policies:**
 
-- Use existing HasPermission check
-- Leverage existing roles (Admin, Kassenwart)
-- Member can read own cycles (linked via member_id)
+- **MembershipFeeType** (`lib/membership_fees/membership_fee_type.ex`): `authorizers: [Ash.Policy.Authorizer]`, single policy with `HasPermission` for read/create/update/destroy.
+- **MembershipFeeCycle** (`lib/membership_fees/membership_fee_cycle.ex`): Same pattern; update includes mark_as_paid, mark_as_suspended, mark_as_unpaid.
 
 ### LiveView Integration
 
@@ -357,7 +355,7 @@ lib/
 2. MembershipFeeCycle table component (member detail view)
    - Implemented as `MvWeb.MemberLive.Show.MembershipFeesComponent`
    - Displays all cycles in a table with status management
-   - Allows changing cycle status, editing amounts, and regenerating cycles
+   - Allows changing cycle status, editing amounts, and manually regenerating cycles (normal_user and admin)
 3. Settings form section (admin)
 4. Member list column (membership fee status)
 

docs/roles-and-permissions-architecture.md

@@ -97,6 +97,10 @@ Control CRUD operations on:
 - CustomFieldValue (custom field values)
 - CustomField (custom field definitions)
 - Role (role management)
+- Group (group definitions; read all, create/update/destroy normal_user and admin)
+- MemberGroup (member–group associations; own_data read :linked, read_only read :all, normal_user/admin create/destroy)
+- MembershipFeeType (fee type definitions; all read, admin-only create/update/destroy)
+- MembershipFeeCycle (fee cycles; own_data read :linked, read_only read :all, normal_user/admin read+create+update+destroy; manual "Regenerate Cycles" for normal_user and admin)
 
 **4. Page-Level Permissions**
 
@@ -105,6 +109,7 @@ Control access to LiveView pages:
 - Show pages (detail views)
 - Form pages (create/edit)
 - Admin pages
+- Settings pages: `/settings` and `/membership_fee_settings` are admin-only (explicit in PermissionSets)
 
 **5. Granular Scopes**
 
@@ -121,6 +126,8 @@ Three scope levels for permissions:
 - **Linked Member Email:** Only admins can edit email of member linked to user
 - **System Roles:** "Mitglied" role cannot be deleted (is_system_role flag)
 - **User-Member Linking:** Only admins can link/unlink users and members
+- **User Role Assignment:** Only admins can change a user's role (via `update_user` with `role_id`). Last-admin validation ensures at least one user keeps the Admin role.
+- **Settings Pages:** `/settings` and `/membership_fee_settings` are admin-only (explicit in PermissionSets pages).
 
 **7. UI Consistency**
 
@@ -684,6 +691,12 @@ Quick reference table showing what each permission set allows:
 | **CustomFieldValue** (all) | - | R | R, C, U, D | R, C, U, D |
 | **CustomField** (all) | R | R | R | R, C, U, D |
 | **Role** (all) | - | - | - | R, C, U, D |
+| **Group** (all) | R | R | R, C, U, D | R, C, U, D |
+| **MemberGroup** (linked) | R | - | - | - |
+| **MemberGroup** (all) | - | R | R, C, D | R, C, D |
+| **MembershipFeeType** (all) | R | R | R | R, C, U, D |
+| **MembershipFeeCycle** (linked) | R | - | - | - |
+| **MembershipFeeCycle** (all) | - | R | R, C, U, D | R, C, U, D |
 
 **Legend:** R=Read, C=Create, U=Update, D=Destroy
 
@@ -1012,16 +1025,21 @@ defmodule Mv.Membership.Member do
       authorize_if expr(id == ^actor(:member_id))
     end
     
-    # 2. GENERAL: Check permissions from role
-    # - :own_data → can UPDATE linked member (scope :linked via HasPermission)
-    # - :read_only → can READ all members (scope :all), no update permission
-    # - :normal_user → can CRUD all members (scope :all)
-    # - :admin → can CRUD all members (scope :all)
-    policy action_type([:read, :create, :update, :destroy]) do
+    # 2. READ/DESTROY: Check permissions only (no :user argument on these actions)
+    policy action_type([:read, :destroy]) do
       description "Check permissions from user's role"
       authorize_if Mv.Authorization.Checks.HasPermission
     end
 
+    # 3. CREATE/UPDATE: Forbid user link unless admin; then check permissions
+    # ForbidMemberUserLinkUnlessAdmin: only admins may pass :user (link or unlink via nil/empty).
+    # HasPermission: :own_data → update linked; :read_only → no update; :normal_user/admin → update all
+    policy action_type([:create, :update]) do
+      description "Forbid user link unless admin; then check permissions"
+      forbid_if Mv.Authorization.Checks.ForbidMemberUserLinkUnlessAdmin
+      authorize_if Mv.Authorization.Checks.HasPermission
+    end
+
     # 4. DEFAULT: Ash implicitly forbids if no policy authorizes (fail-closed)
   end
   
@@ -1041,6 +1059,8 @@ end
 - **READ list queries**: No record at strict_check time → bypass with `expr(id == ^actor(:member_id))` needed for auto_filter ✅
 - **UPDATE operations**: Changeset contains record → HasPermission evaluates `scope :linked` correctly ✅
 
+**User–member link:** Only admins may pass the `:user` argument on create_member or update_member (link or unlink via `user: nil`/`user: %{}`). The check uses **argument presence** (key in arguments), not value, to avoid bypass (see [User-Member Linking](#user-member-linking)).
+
 **Permission Matrix:**
 
 | Action | Mitglied | Vorstand | Kassenwart | Buchhaltung | Admin |
@@ -1135,23 +1155,20 @@ end
 
 **Location:** `lib/mv/authorization/role.ex`
 
-**Special Protection:** System roles cannot be deleted.
+**Defense-in-depth:** The Role resource uses `authorizers: [Ash.Policy.Authorizer]` and policies with `Mv.Authorization.Checks.HasPermission`. **Read** is allowed for all permission sets (own_data, read_only, normal_user, admin) via `perm("Role", :read, :all)` in PermissionSets; reading roles is not a security concern. **Create, update, and destroy** are allowed only for admin (admin has full Role CRUD in PermissionSets). Seeds and bootstrap use `authorize?: false` where necessary.
+
+**Special Protection:** System roles cannot be deleted (validation on destroy).
 
 ```elixir
 defmodule Mv.Authorization.Role do
-  use Ash.Resource, ...
+  use Ash.Resource,
+    authorizers: [Ash.Policy.Authorizer]
   
   policies do
-    # Only admin can manage roles
     policy action_type([:read, :create, :update, :destroy]) do
-      description "Check permissions from user's role"
+      description "Check permissions from user's role (read all, create/update/destroy admin only)"
       authorize_if Mv.Authorization.Checks.HasPermission
     end
-    
-    # DEFAULT: Forbid
-    policy action_type([:read, :create, :update, :destroy]) do
-      forbid_if always()
-    end
   end
   
   # Prevent deletion of system roles
@@ -1188,13 +1205,43 @@ end
 
 | Action | Mitglied | Vorstand | Kassenwart | Buchhaltung | Admin |
 |--------|----------|----------|------------|-------------|-------|
-| Read | ❌ | ❌ | ❌ | ❌ | ✅ |
+| Read | ✅ | ✅ | ✅ | ✅ | ✅ |
 | Create | ❌ | ❌ | ❌ | ❌ | ✅ |
 | Update | ❌ | ❌ | ❌ | ❌ | ✅ |
 | Destroy* | ❌ | ❌ | ❌ | ❌ | ✅ |
 
 *Cannot destroy if `is_system_role=true`
 
+### User Role Assignment (Admin-Only)
+
+**Location:** `lib/accounts/user.ex` (update_user action), `lib/mv_web/live/user_live/form.ex`
+
+Only admins can change a user's role. The `update_user` action accepts `role_id`; the User form shows a role dropdown when `can?(actor, :update, Mv.Authorization.Role)`. **Last-admin validation:** If the only non-system admin tries to change their role, the change is rejected with "At least one user must keep the Admin role." (System user is excluded from the admin count.) See [User-Member Linking](#user-member-linking) for the same admin-only pattern.
+
+### Group Resource Policies
+
+**Location:** `lib/membership/group.ex`
+
+Policies use `HasPermission` for read/create/update/destroy. All permission sets can read; normal_user and admin can create, update, destroy. No bypass (scope :all only in PermissionSets).
+
+### MemberGroup Resource Policies
+
+**Location:** `lib/membership/member_group.ex`
+
+Bypass for read restricted to own_data (MemberGroupReadLinkedForOwnData check: own_data only, filter `member_id == actor.member_id`); HasPermission for read (read_only/normal_user/admin :all) and create/destroy (normal_user + admin only). Admin with member_id set still gets :all from HasPermission (bypass does not apply).
+
+### MembershipFeeType Resource Policies
+
+**Location:** `lib/membership_fees/membership_fee_type.ex`
+
+Policies use `HasPermission` for read/create/update/destroy. All permission sets can read; only admin can create, update, destroy.
+
+### MembershipFeeCycle Resource Policies
+
+**Location:** `lib/membership_fees/membership_fee_cycle.ex`
+
+Bypass for read restricted to own_data (MembershipFeeCycleReadLinkedForOwnData: own_data only, filter `member_id == actor.member_id`); HasPermission for read (read_only/normal_user/admin :all) and create/update/destroy. own_data can only read cycles of the linked member; read_only can read all; normal_user and admin can read, create, update, and destroy (including mark_as_paid and manual "Regenerate Cycles"; UI button when `can_create_cycle`). Regenerate-cycles handler enforces `can?(:create, MembershipFeeCycle)` server-side.
+
 ---
 
 ## Page Permission System
@@ -2002,7 +2049,10 @@ Users and Members are separate entities that can be linked. Special rules:
 - A user cannot link themselves to an existing member
 - A user CAN create a new member and be directly linked to it (self-service)
 
-**Enforcement:** The User resource restricts the `update_user` action (which accepts the `member` argument for link/unlink) to admins only via `Mv.Authorization.Checks.ActorIsAdmin`. The UserLive.Form shows the Member-Linking UI and runs member link/unlink on save only when the current user is admin; non-admins use the `:update` action (email only) for profile edit.
+**Enforcement:**
+
+- **User side:** The User resource restricts the `update_user` action (which accepts the `member` argument for link/unlink) to admins only via `Mv.Authorization.Checks.ActorIsAdmin`. The UserLive.Form shows the Member-Linking UI and runs member link/unlink on save only when the current user is admin; non-admins use the `:update` action (email only) for profile edit.
+- **Member side:** Only admins may set or change the user–member link on **Member** create or update. When creating or updating a member, the `:user` argument (which links the member to a user account) is forbidden for non-admins. This is enforced by `Mv.Authorization.Checks.ForbidMemberUserLinkUnlessAdmin` in the Member resource policies (`forbid_if` before `authorize_if HasPermission`). Non-admins can still create and update members as long as they do **not** pass the `:user` argument. The Member resource uses **`on_missing: :ignore`** for the `:user` relationship on update_member, so **omitting** `:user` from params does **not** change the link (no "unlink by omission"); unlink is only possible by explicitly passing `:user` (e.g. `user: nil`), which is admin-only.
 
 ### Approach: Separate Ash Actions
 

docs/roles-and-permissions-implementation-plan.md

@@ -78,10 +78,11 @@ Stored in database `roles` table, each referencing a `permission_set_name`:
 - ✅ Hardcoded PermissionSets module with 4 permission sets
 - ✅ Role database table and CRUD interface
 - ✅ Custom Ash Policy Check (`HasPermission`) that reads from PermissionSets
-- ✅ Policies on all resources (Member, User, CustomFieldValue, CustomField, Role)
-- ✅ Page-level permissions via Phoenix Plug
+- ✅ Policies on all resources (Member, User, CustomFieldValue, CustomField, Role, Group, MemberGroup, MembershipFeeType, MembershipFeeCycle)
+- ✅ Page-level permissions via Phoenix Plug (including admin-only `/settings` and `/membership_fee_settings`)
 - ✅ UI authorization helpers for conditional rendering
 - ✅ Special case: Member email validation for linked users
+- ✅ User role assignment: admin-only `role_id` in update_user; Last-Admin validation; role dropdown in User form when `can?(actor, :update, Role)`
 - ✅ Seed data for 5 roles
 
 **Benefits of Hardcoded Approach:**

lib/accounts/user.ex

@@ -8,6 +8,9 @@ defmodule Mv.Accounts.User do
     extensions: [AshAuthentication],
     authorizers: [Ash.Policy.Authorizer]
 
+  require Ash.Query
+  import Ash.Expr
+
   postgres do
     table "users"
     repo Mv.Repo
@@ -146,9 +149,10 @@ defmodule Mv.Accounts.User do
 
     update :update_user do
       description "Updates a user and manages the optional member relationship. To change an existing member link, first remove it (set member to nil), then add the new one."
-      # Only accept email directly - member_id is NOT in accept list
-      # This prevents direct foreign key manipulation, forcing use of manage_relationship
-      accept [:email]
+
+      # Accept email and role_id (role_id only used by admins; policy restricts update_user to admins).
+      # member_id is NOT in accept list - use argument :member for relationship management.
+      accept [:email, :role_id]
       # Allow member to be passed as argument for relationship management
       argument :member, :map, allow_nil?: true
 
@@ -183,6 +187,13 @@ defmodule Mv.Accounts.User do
       require_atomic? false
     end
 
+    # Internal: set role from OIDC group sync (Mv.OidcRoleSync). Bypass policy when context.private.oidc_role_sync.
+    # Same "at least one admin" validation as update_user (see validations where action_is).
+    update :set_role_from_oidc_sync do
+      accept [:role_id]
+      require_atomic? false
+    end
+
     # Admin action for direct password changes in admin panel
     # Uses the official Ash Authentication HashPasswordChange with correct context
     update :admin_set_password do
@@ -247,6 +258,8 @@ defmodule Mv.Accounts.User do
     end
 
     read :sign_in_with_rauthy do
+      # Single record expected; required for AshAuthentication OAuth2 strategy (returns list of 0 or 1).
+      get? true
       argument :user_info, :map, allow_nil?: false
       argument :oauth_tokens, :map, allow_nil?: false
       prepare AshAuthentication.Strategy.OAuth2.SignInPreparation
@@ -256,6 +269,27 @@ defmodule Mv.Accounts.User do
       # linked their account via OIDC. Password-only users (oidc_id = nil)
       # cannot be accessed via OIDC login without password verification.
       filter expr(oidc_id == get_path(^arg(:user_info), [:sub]))
+
+      # Sync role from OIDC groups after sign-in (e.g. admin group → Admin role)
+      # get? true can return nil, a single %User{}, or a list; normalize to list for Enum.each
+      prepare Ash.Resource.Preparation.Builtins.after_action(fn query, result, _context ->
+                user_info = Ash.Query.get_argument(query, :user_info) || %{}
+                oauth_tokens = Ash.Query.get_argument(query, :oauth_tokens) || %{}
+
+                users =
+                  case result do
+                    nil -> []
+                    u when is_struct(u, User) -> [u]
+                    list when is_list(list) -> list
+                    _ -> []
+                  end
+
+                Enum.each(users, fn user ->
+                  Mv.OidcRoleSync.apply_admin_role_from_user_info(user, user_info, oauth_tokens)
+                end)
+
+                {:ok, result}
+              end)
     end
 
     create :register_with_rauthy do
@@ -293,6 +327,18 @@ defmodule Mv.Accounts.User do
 
       # Sync user email to member when linking (User → Member)
       change Mv.EmailSync.Changes.SyncUserEmailToMember
+
+      # Sync role from OIDC groups (e.g. admin group → Admin role) after user is created/updated
+      change fn changeset, _ctx ->
+        user_info = Ash.Changeset.get_argument(changeset, :user_info)
+        oauth_tokens = Ash.Changeset.get_argument(changeset, :oauth_tokens) || %{}
+
+        Ash.Changeset.after_action(changeset, fn _cs, record ->
+          Mv.OidcRoleSync.apply_admin_role_from_user_info(record, user_info, oauth_tokens)
+          # Return original record so __metadata__.token (from GenerateTokenChange) is preserved
+          {:ok, record}
+        end)
+      end
     end
   end
 
@@ -319,6 +365,13 @@ defmodule Mv.Accounts.User do
       authorize_if Mv.Authorization.Checks.ActorIsAdmin
     end
 
+    # set_role_from_oidc_sync: internal only (called from Mv.OidcRoleSync on registration/sign-in).
+    # Not exposed in code_interface; only allowed when context.private.oidc_role_sync is set.
+    bypass action(:set_role_from_oidc_sync) do
+      description "Internal: OIDC role sync (server-side only)"
+      authorize_if Mv.Authorization.Checks.OidcRoleSyncContext
+    end
+
     # UPDATE/DESTROY via HasPermission (evaluates PermissionSets scope)
     policy action_type([:read, :create, :update, :destroy]) do
       description "Check permissions from user's role and permission set"
@@ -387,6 +440,63 @@ defmodule Mv.Accounts.User do
       end
     end
 
+    # Last-admin: prevent the only admin from leaving the admin role (at least one admin required).
+    # Only block when the user is leaving admin (target role is not admin). Switching between
+    # two admin roles (e.g. "Admin" and "Superadmin" both with permission_set_name "admin") is allowed.
+    validate fn changeset, _context ->
+               if Ash.Changeset.changing_attribute?(changeset, :role_id) do
+                 new_role_id = Ash.Changeset.get_attribute(changeset, :role_id)
+
+                 if is_nil(new_role_id) do
+                   :ok
+                 else
+                   current_role_id = changeset.data.role_id
+
+                   current_role =
+                     Mv.Authorization.Role
+                     |> Ash.get!(current_role_id, authorize?: false)
+
+                   new_role =
+                     Mv.Authorization.Role
+                     |> Ash.get!(new_role_id, authorize?: false)
+
+                   # Only block when current user is admin and target role is not admin (leaving admin)
+                   if current_role.permission_set_name == "admin" and
+                        new_role.permission_set_name != "admin" do
+                     admin_role_ids =
+                       Mv.Authorization.Role
+                       |> Ash.Query.for_read(:read)
+                       |> Ash.Query.filter(expr(permission_set_name == "admin"))
+                       |> Ash.read!(authorize?: false)
+                       |> Enum.map(& &1.id)
+
+                     # Count only non-system users with admin role (system user is for internal ops)
+                     system_email = Mv.Helpers.SystemActor.system_user_email()
+
+                     count =
+                       Mv.Accounts.User
+                       |> Ash.Query.for_read(:read)
+                       |> Ash.Query.filter(expr(role_id in ^admin_role_ids))
+                       |> Ash.Query.filter(expr(email != ^system_email))
+                       |> Ash.count!(authorize?: false)
+
+                     if count <= 1 do
+                       {:error,
+                        field: :role_id, message: "At least one user must keep the Admin role."}
+                     else
+                       :ok
+                     end
+                   else
+                     :ok
+                   end
+                 end
+               else
+                 :ok
+               end
+             end,
+             on: [:update],
+             where: [action_is([:update_user, :set_role_from_oidc_sync])]
+
     # Prevent modification of the system actor user (required for internal operations).
     # Block update/destroy on UI-exposed actions only; :update_internal is used by bootstrap/tests.
     validate fn changeset, _context ->

lib/membership/group.ex

@@ -36,7 +36,8 @@ defmodule Mv.Membership.Group do
   """
   use Ash.Resource,
     domain: Mv.Membership,
-    data_layer: AshPostgres.DataLayer
+    data_layer: AshPostgres.DataLayer,
+    authorizers: [Ash.Policy.Authorizer]
 
   require Ash.Query
   alias Mv.Helpers
@@ -63,6 +64,13 @@ defmodule Mv.Membership.Group do
     end
   end
 
+  policies do
+    policy action_type([:read, :create, :update, :destroy]) do
+      description "Check permissions from role (all can read; normal_user and admin can create/update/destroy)"
+      authorize_if Mv.Authorization.Checks.HasPermission
+    end
+  end
+
   validations do
     validate present(:name)
 
@@ -136,7 +144,7 @@ defmodule Mv.Membership.Group do
     query =
       Mv.Membership.Group
       |> Ash.Query.filter(fragment("LOWER(?) = LOWER(?)", name, ^name))
-      |> maybe_exclude_id(exclude_id)
+      |> Helpers.query_exclude_id(exclude_id)
 
     opts = Helpers.ash_actor_opts(actor)
 
@@ -155,7 +163,4 @@ defmodule Mv.Membership.Group do
         :ok
     end
   end
-
-  defp maybe_exclude_id(query, nil), do: query
-  defp maybe_exclude_id(query, id), do: Ash.Query.filter(query, id != ^id)
 end

lib/membership/member.ex

@@ -25,6 +25,7 @@ defmodule Mv.Membership.Member do
   - Postal code format: exactly 5 digits (German format)
   - Date validations: join_date not in future, exit_date after join_date
   - Email uniqueness: prevents conflicts with unlinked users
+  - Linked member email change: only admins or the linked user may change a linked member's email (see `Mv.Membership.Member.Validations.EmailChangePermission`)
 
   ## Full-Text Search
   Members have a `search_vector` attribute (tsvector) that is automatically
@@ -152,16 +153,18 @@ defmodule Mv.Membership.Member do
 
       change manage_relationship(:custom_field_values, on_match: :update, on_no_match: :create)
 
+      # When :user argument is present and nil/empty, unrelate (admin-only via policy).
+      # Must run before manage_relationship; on_missing: :ignore then does nothing for nil input.
+      change Mv.Membership.Member.Changes.UnrelateUserWhenArgumentNil
+
       # Manage the user relationship during member update
+      # on_missing: :ignore so that omitting :user does NOT unlink (security: only admins may
+      # change the link; unlink is explicit via user: nil, forbidden for non-admins by policy).
       change manage_relationship(:user, :user,
-               # Look up existing user and relate to it
                on_lookup: :relate,
-               # Error if user doesn't exist in database
                on_no_match: :error,
-               # Error if user is already linked to another member (prevents "stealing")
                on_match: :error,
-               # If no user provided, remove existing relationship (allows user removal)
-               on_missing: :unrelate
+               on_missing: :ignore
              )
 
       # Sync member email to user when email changes (Member → User)
@@ -311,14 +314,18 @@ defmodule Mv.Membership.Member do
       authorize_if expr(id == ^actor(:member_id))
     end
 
-    # GENERAL: Check permissions from user's role
-    # HasPermission handles update permissions correctly:
-    # - :own_data → can update linked member (scope :linked)
-    # - :read_only → cannot update any member (no update permission)
-    # - :normal_user → can update all members (scope :all)
-    # - :admin → can update all members (scope :all)
-    policy action_type([:read, :create, :update, :destroy]) do
-      description "Check permissions from user's role and permission set"
+    # READ/DESTROY: Check permissions only (no :user argument on these actions)
+    policy action_type([:read, :destroy]) do
+      description "Check permissions from user's role"
+      authorize_if Mv.Authorization.Checks.HasPermission
+    end
+
+    # CREATE/UPDATE: Forbid member–user link unless admin, then check permissions
+    # ForbidMemberUserLinkUnlessAdmin: only admins may pass :user (link or unlink via nil/empty).
+    # HasPermission: :own_data → update linked; :read_only → no update; :normal_user/admin → update all.
+    policy action_type([:create, :update]) do
+      description "Forbid user link unless admin; then check permissions"
+      forbid_if Mv.Authorization.Checks.ForbidMemberUserLinkUnlessAdmin
       authorize_if Mv.Authorization.Checks.HasPermission
     end
 
@@ -381,6 +388,9 @@ defmodule Mv.Membership.Member do
     # Validates that member email is not already used by another (unlinked) user
     validate Mv.Membership.Member.Validations.EmailNotUsedByOtherUser
 
+    # Only admins or the linked user may change a linked member's email (prevents breaking sync)
+    validate Mv.Membership.Member.Validations.EmailChangePermission, on: [:update]
+
     # Prevent linking to a user that already has a member
     # This validation prevents "stealing" users from other members by checking
     # if the target user is already linked to a different member

lib/membership/member/changes/unrelate_user_when_argument_nil.ex

@@ -0,0 +1,50 @@
+defmodule Mv.Membership.Member.Changes.UnrelateUserWhenArgumentNil do
+  @moduledoc """
+  When :user argument is present and nil/empty on update_member, unrelate the current user.
+
+  With on_missing: :ignore, manage_relationship does not unrelate when input is nil/[].
+  This change handles explicit unlink (user: nil or user: %{}) by updating the linked
+  User to set member_id = nil. Only runs when the argument key is present (policy
+  ForbidMemberUserLinkUnlessAdmin ensures only admins can pass :user).
+  """
+  use Ash.Resource.Change
+
+  @spec change(Ash.Changeset.t(), keyword(), Ash.Resource.Change.context()) :: Ash.Changeset.t()
+  def change(changeset, _opts, _context) do
+    if unlink_requested?(changeset) do
+      unrelate_current_user(changeset)
+    else
+      changeset
+    end
+  end
+
+  defp unlink_requested?(changeset) do
+    args = changeset.arguments || %{}
+
+    if Map.has_key?(args, :user) or Map.has_key?(args, "user") do
+      user_arg = Ash.Changeset.get_argument(changeset, :user)
+      user_arg == nil or (is_map(user_arg) and map_size(user_arg) == 0)
+    else
+      false
+    end
+  end
+
+  defp unrelate_current_user(changeset) do
+    member = changeset.data
+    actor = Map.get(changeset.context || %{}, :actor)
+
+    case Ash.load(member, :user, domain: Mv.Membership, authorize?: false) do
+      {:ok, %{user: user}} when not is_nil(user) ->
+        # User's :update action only accepts [:email]; use :update_user so
+        # manage_relationship(:member, ..., on_missing: :unrelate) runs and clears member_id.
+        user
+        |> Ash.Changeset.for_update(:update_user, %{member: nil}, domain: Mv.Accounts)
+        |> Ash.update(domain: Mv.Accounts, actor: actor, authorize?: false)
+
+        changeset
+
+      _ ->
+        changeset
+    end
+  end
+end

lib/membership/member_group.ex

@@ -39,7 +39,8 @@ defmodule Mv.Membership.MemberGroup do
   """
   use Ash.Resource,
     domain: Mv.Membership,
-    data_layer: AshPostgres.DataLayer
+    data_layer: AshPostgres.DataLayer,
+    authorizers: [Ash.Policy.Authorizer]
 
   require Ash.Query
 
@@ -56,6 +57,26 @@ defmodule Mv.Membership.MemberGroup do
     end
   end
 
+  # Authorization: read uses bypass for :linked (own_data only) then HasPermission for :all;
+  # create/destroy use HasPermission (normal_user + admin only).
+  # Single check: own_data gets filter via auto_filter; admin does not match, gets :all from HasPermission.
+  policies do
+    bypass action_type(:read) do
+      description "own_data: read only member_groups where member_id == actor.member_id"
+      authorize_if Mv.Authorization.Checks.MemberGroupReadLinkedForOwnData
+    end
+
+    policy action_type(:read) do
+      description "Check read permission from role (read_only/normal_user/admin :all)"
+      authorize_if Mv.Authorization.Checks.HasPermission
+    end
+
+    policy action_type([:create, :destroy]) do
+      description "Check create/destroy from role (normal_user + admin only)"
+      authorize_if Mv.Authorization.Checks.HasPermission
+    end
+  end
+
   validations do
     validate present(:member_id)
     validate present(:group_id)
@@ -118,7 +139,7 @@ defmodule Mv.Membership.MemberGroup do
     query =
       Mv.Membership.MemberGroup
       |> Ash.Query.filter(member_id == ^member_id and group_id == ^group_id)
-      |> maybe_exclude_id(exclude_id)
+      |> Helpers.query_exclude_id(exclude_id)
 
     opts = Helpers.ash_actor_opts(actor)
 
@@ -135,7 +156,4 @@ defmodule Mv.Membership.MemberGroup do
         :ok
     end
   end
-
-  defp maybe_exclude_id(query, nil), do: query
-  defp maybe_exclude_id(query, id), do: Ash.Query.filter(query, id != ^id)
 end

lib/membership/setting.ex

@@ -155,12 +155,15 @@ defmodule Mv.Membership.Setting do
              on: [:create, :update]
 
     # Validate default_membership_fee_type_id exists if set
-    validate fn changeset, _context ->
+    validate fn changeset, context ->
                fee_type_id =
                  Ash.Changeset.get_attribute(changeset, :default_membership_fee_type_id)
 
                if fee_type_id do
-                 case Ash.get(Mv.MembershipFees.MembershipFeeType, fee_type_id) do
+                 # Check existence only; action is already restricted by policy (e.g. admin).
+                 opts = [domain: Mv.MembershipFees, authorize?: false]
+
+                 case Ash.get(Mv.MembershipFees.MembershipFeeType, fee_type_id, opts) do
                    {:ok, _} ->
                      :ok
 

lib/membership_fees/changes/set_membership_fee_start_date.ex

@@ -31,12 +31,12 @@ defmodule Mv.MembershipFees.Changes.SetMembershipFeeStartDate do
   alias Mv.MembershipFees.CalendarCycles
 
   @impl true
-  def change(changeset, _opts, _context) do
+  def change(changeset, _opts, context) do
     # Only calculate if membership_fee_start_date is not already set
     if has_start_date?(changeset) do
       changeset
     else
-      calculate_and_set_start_date(changeset)
+      calculate_and_set_start_date(changeset, context)
     end
   end
 
@@ -56,10 +56,13 @@ defmodule Mv.MembershipFees.Changes.SetMembershipFeeStartDate do
     end
   end
 
-  defp calculate_and_set_start_date(changeset) do
+  defp calculate_and_set_start_date(changeset, context) do
+    actor = Map.get(context || %{}, :actor)
+    opts = if actor, do: [actor: actor], else: []
+
     with {:ok, join_date} <- get_join_date(changeset),
          {:ok, membership_fee_type_id} <- get_membership_fee_type_id(changeset),
-         {:ok, interval} <- get_interval(membership_fee_type_id),
+         {:ok, interval} <- get_interval(membership_fee_type_id, opts),
          {:ok, include_joining_cycle} <- get_include_joining_cycle() do
       start_date = calculate_start_date(join_date, interval, include_joining_cycle)
       Ash.Changeset.force_change_attribute(changeset, :membership_fee_start_date, start_date)
@@ -118,8 +121,8 @@ defmodule Mv.MembershipFees.Changes.SetMembershipFeeStartDate do
     end
   end
 
-  defp get_interval(membership_fee_type_id) do
-    case Ash.get(Mv.MembershipFees.MembershipFeeType, membership_fee_type_id) do
+  defp get_interval(membership_fee_type_id, opts) do
+    case Ash.get(Mv.MembershipFees.MembershipFeeType, membership_fee_type_id, opts) do
       {:ok, %{interval: interval}} -> {:ok, interval}
       {:error, _} -> {:error, :membership_fee_type_not_found}
     end

lib/membership_fees/changes/validate_same_interval.ex

@@ -19,9 +19,9 @@ defmodule Mv.MembershipFees.Changes.ValidateSameInterval do
   use Ash.Resource.Change
 
   @impl true
-  def change(changeset, _opts, _context) do
+  def change(changeset, _opts, context) do
     if changing_membership_fee_type?(changeset) do
-      validate_interval_match(changeset)
+      validate_interval_match(changeset, context)
     else
       changeset
     end
@@ -33,9 +33,10 @@ defmodule Mv.MembershipFees.Changes.ValidateSameInterval do
   end
 
   # Validate that the new type has the same interval as the current type
-  defp validate_interval_match(changeset) do
+  defp validate_interval_match(changeset, context) do
     current_type_id = get_current_type_id(changeset)
     new_type_id = get_new_type_id(changeset)
+    actor = Map.get(context || %{}, :actor)
 
     cond do
       # If no current type, allow any change (first assignment)
@@ -48,13 +49,13 @@ defmodule Mv.MembershipFees.Changes.ValidateSameInterval do
 
       # Both types exist - validate intervals match
       true ->
-        validate_intervals_match(changeset, current_type_id, new_type_id)
+        validate_intervals_match(changeset, current_type_id, new_type_id, actor)
     end
   end
 
   # Validates that intervals match when both types exist
-  defp validate_intervals_match(changeset, current_type_id, new_type_id) do
-    case get_intervals(current_type_id, new_type_id) do
+  defp validate_intervals_match(changeset, current_type_id, new_type_id, actor) do
+    case get_intervals(current_type_id, new_type_id, actor) do
       {:ok, current_interval, new_interval} ->
         if current_interval == new_interval do
           changeset
@@ -85,11 +86,16 @@ defmodule Mv.MembershipFees.Changes.ValidateSameInterval do
     end
   end
 
-  # Get intervals for both types
-  defp get_intervals(current_type_id, new_type_id) do
+  # Get intervals for both types (actor required for authorization when resource has policies)
+  defp get_intervals(current_type_id, new_type_id, actor) do
     alias Mv.MembershipFees.MembershipFeeType
 
-    case {Ash.get(MembershipFeeType, current_type_id), Ash.get(MembershipFeeType, new_type_id)} do
+    opts = if actor, do: [actor: actor], else: []
+
+    case {
+      Ash.get(MembershipFeeType, current_type_id, opts),
+      Ash.get(MembershipFeeType, new_type_id, opts)
+    } do
       {{:ok, current_type}, {:ok, new_type}} ->
         {:ok, current_type.interval, new_type.interval}
 

lib/membership_fees/membership_fee_cycle.ex

@@ -28,7 +28,8 @@ defmodule Mv.MembershipFees.MembershipFeeCycle do
   """
   use Ash.Resource,
     domain: Mv.MembershipFees,
-    data_layer: AshPostgres.DataLayer
+    data_layer: AshPostgres.DataLayer,
+    authorizers: [Ash.Policy.Authorizer]
 
   postgres do
     table "membership_fee_cycles"
@@ -83,6 +84,19 @@ defmodule Mv.MembershipFees.MembershipFeeCycle do
     end
   end
 
+  # READ: bypass for own_data (:linked) then HasPermission for :all; create/update/destroy: HasPermission only.
+  policies do
+    bypass action_type(:read) do
+      description "own_data: read only cycles where member_id == actor.member_id"
+      authorize_if Mv.Authorization.Checks.MembershipFeeCycleReadLinkedForOwnData
+    end
+
+    policy action_type([:read, :create, :update, :destroy]) do
+      description "Check permissions from role (all read; normal_user and admin create/update/destroy)"
+      authorize_if Mv.Authorization.Checks.HasPermission
+    end
+  end
+
   attributes do
     uuid_v7_primary_key :id
 

lib/membership_fees/membership_fee_type.ex

@@ -24,7 +24,8 @@ defmodule Mv.MembershipFees.MembershipFeeType do
   """
   use Ash.Resource,
     domain: Mv.MembershipFees,
-    data_layer: AshPostgres.DataLayer
+    data_layer: AshPostgres.DataLayer,
+    authorizers: [Ash.Policy.Authorizer]
 
   postgres do
     table "membership_fee_types"
@@ -61,6 +62,13 @@ defmodule Mv.MembershipFees.MembershipFeeType do
     end
   end
 
+  policies do
+    policy action_type([:read, :create, :update, :destroy]) do
+      description "Check permissions from role (all can read, only admin can create/update/destroy)"
+      authorize_if Mv.Authorization.Checks.HasPermission
+    end
+  end
+
   validations do
     # Prevent interval changes after creation
     validate fn changeset, _context ->

lib/mv/accounts/user/validations/email_not_used_by_other_member.ex

@@ -81,7 +81,7 @@ defmodule Mv.Accounts.User.Validations.EmailNotUsedByOtherMember do
     query =
       Mv.Membership.Member
       |> Ash.Query.filter(email == ^to_string(email))
-      |> maybe_exclude_id(exclude_member_id)
+      |> Mv.Helpers.query_exclude_id(exclude_member_id)
 
     system_actor = SystemActor.get_system_actor()
     opts = Helpers.ash_actor_opts(system_actor)
@@ -101,7 +101,4 @@ defmodule Mv.Accounts.User.Validations.EmailNotUsedByOtherMember do
         :ok
     end
   end
-
-  defp maybe_exclude_id(query, nil), do: query
-  defp maybe_exclude_id(query, id), do: Ash.Query.filter(query, id != ^id)
 end

lib/mv/authorization/actor.ex

@@ -1,6 +1,7 @@
 defmodule Mv.Authorization.Actor do
   @moduledoc """
-  Helper functions for ensuring User actors have required data loaded.
+  Helper functions for ensuring User actors have required data loaded
+  and for querying actor capabilities (e.g. admin, permission set).
 
   ## Actor Invariant
 
@@ -27,8 +28,11 @@ defmodule Mv.Authorization.Actor do
         assign(socket, :current_user, user)
       end
 
-      # In tests
-      user = Actor.ensure_loaded(user)
+      # Check if actor is admin (policy checks, validations)
+      if Actor.admin?(actor), do: ...
+
+      # Get permission set name (string or nil)
+      ps_name = Actor.permission_set_name(actor)
 
   ## Security Note
 
@@ -47,6 +51,8 @@ defmodule Mv.Authorization.Actor do
 
   require Logger
 
+  alias Mv.Helpers.SystemActor
+
   @doc """
   Ensures the actor (User) has their `:role` relationship loaded.
 
@@ -96,4 +102,45 @@ defmodule Mv.Authorization.Actor do
         actor
     end
   end
+
+  @doc """
+  Returns the actor's permission set name (string or atom) from their role, or nil.
+
+  Ensures role is loaded (including when role is nil). Supports both atom and
+  string keys for session/socket assigns. Use for capability checks consistent
+  with `ActorIsAdmin` and `HasPermission`.
+  """
+  @spec permission_set_name(Mv.Accounts.User.t() | map() | nil) :: String.t() | atom() | nil
+  def permission_set_name(nil), do: nil
+
+  def permission_set_name(actor) do
+    actor = actor |> ensure_loaded() |> maybe_load_role()
+
+    get_in(actor, [Access.key(:role), Access.key(:permission_set_name)]) ||
+      get_in(actor, [Access.key("role"), Access.key("permission_set_name")])
+  end
+
+  @doc """
+  Returns true if the actor is the system user or has the admin permission set.
+
+  Use for validations and policy checks that require admin capability (e.g.
+  changing a linked member's email). Consistent with `ActorIsAdmin` policy check.
+  """
+  @spec admin?(Mv.Accounts.User.t() | map() | nil) :: boolean()
+  def admin?(nil), do: false
+
+  def admin?(actor) do
+    SystemActor.system_user?(actor) or permission_set_name(actor) in ["admin", :admin]
+  end
+
+  # Load role only when it is nil (e.g. actor from session without role). ensure_loaded/1
+  # already handles %Ash.NotLoaded{}, so we do not double-load in the normal Ash path.
+  defp maybe_load_role(%Mv.Accounts.User{role: nil} = user) do
+    case Ash.load(user, :role, domain: Mv.Accounts, authorize?: false) do
+      {:ok, loaded} -> loaded
+      _ -> user
+    end
+  end
+
+  defp maybe_load_role(actor), do: actor
 end

lib/mv/authorization/checks/actor_is_admin.ex

@@ -1,22 +1,18 @@
 defmodule Mv.Authorization.Checks.ActorIsAdmin do
   @moduledoc """
-  Policy check: true when the actor's role has permission_set_name "admin".
+  Policy check: true when the actor is the system user or has permission_set_name "admin".
 
   Used to restrict actions (e.g. User.update_user for member link/unlink) to admins only.
+  Delegates to `Mv.Authorization.Actor.admin?/1`, which returns true for the system actor
+  or for a user whose role has permission_set_name "admin".
   """
   use Ash.Policy.SimpleCheck
 
+  alias Mv.Authorization.Actor
+
   @impl true
   def describe(_opts), do: "actor has admin permission set"
 
   @impl true
-  def match?(nil, _context, _opts), do: false
-
-  def match?(actor, _context, _opts) do
-    ps_name =
-      get_in(actor, [Access.key(:role), Access.key(:permission_set_name)]) ||
-        get_in(actor, [Access.key("role"), Access.key("permission_set_name")])
-
-    ps_name == "admin"
-  end
+  def match?(actor, _context, _opts), do: Actor.admin?(actor)
 end

lib/mv/authorization/checks/actor_permission_set_is.ex

@@ -0,0 +1,44 @@
+defmodule Mv.Authorization.Checks.ActorPermissionSetIs do
+  @moduledoc """
+  Policy check: true when the actor's role has the given permission_set_name.
+
+  Used to restrict bypass policies (e.g. MemberGroup read by member_id) to actors
+  with a specific permission set (e.g. "own_data") so that admin with member_id
+  still gets :all scope from HasPermission, not the bypass filter.
+
+  ## Usage
+
+      # In a resource policy (both conditions must hold for the bypass)
+      bypass action_type(:read) do
+        authorize_if expr(member_id == ^actor(:member_id))
+        authorize_if {Mv.Authorization.Checks.ActorPermissionSetIs, permission_set_name: "own_data"}
+      end
+
+  ## Options
+
+  - `:permission_set_name` (required) - String or atom, e.g. `"own_data"` or `:own_data`
+  """
+  use Ash.Policy.SimpleCheck
+
+  alias Mv.Authorization.Actor
+
+  @impl true
+  def describe(opts) do
+    name = opts[:permission_set_name] || "?"
+    "actor has permission set #{name}"
+  end
+
+  @impl true
+  def match?(actor, _context, opts) do
+    case opts[:permission_set_name] do
+      nil ->
+        false
+
+      expected ->
+        case Actor.permission_set_name(actor) do
+          nil -> false
+          actual -> to_string(expected) == to_string(actual)
+        end
+    end
+  end
+end

lib/mv/authorization/checks/forbid_member_user_link_unless_admin.ex

@@ -0,0 +1,71 @@
+defmodule Mv.Authorization.Checks.ForbidMemberUserLinkUnlessAdmin do
+  @moduledoc """
+  Policy check: forbids setting or changing the member–user link unless the actor is admin.
+
+  Used on Member create_member and update_member actions. When the `:user` argument
+  **is present** (key in arguments, regardless of value), only admins may perform the action.
+  This covers:
+  - **Linking:** `user: %{id: user_id}` → only admin
+  - **Unlinking:** explicit `user: nil` or `user: %{}` on update_member → only admin
+  Non-admin users can create and update members only when they do **not** pass the
+  `:user` argument; omitting `:user` leaves the relationship unchanged.
+
+  ## Unlink semantics (update_member)
+
+  The Member resource uses `on_missing: :ignore` for the `:user` relationship on update.
+  So **omitting** `:user` from params does **not** change the link (no "unlink by omission").
+  Unlink is only possible by **explicitly** passing `:user` (e.g. `user: nil`), which this
+  check forbids for non-admins. Admins may link or unlink via the `:user` argument.
+
+  ## Usage
+
+  In Member resource policies, restrict to create/update only:
+
+      policy action_type([:create, :update]) do
+        forbid_if Mv.Authorization.Checks.ForbidMemberUserLinkUnlessAdmin
+        authorize_if Mv.Authorization.Checks.HasPermission
+      end
+
+  ## Behaviour
+
+  - If the `:user` argument **key is not present** → does not forbid.
+  - If `:user` is present (any value, including nil or %{}) and actor is not admin → forbids.
+  - If actor is nil → treated as non-admin (forbid when :user present). `Actor.admin?(nil)` is defined and returns false.
+  - If actor is admin (or system actor) → does not forbid.
+  """
+  use Ash.Policy.Check
+
+  alias Mv.Authorization.Actor
+
+  @impl true
+  def describe(_opts), do: "forbid setting member–user link unless actor is admin"
+
+  @impl true
+  def strict_check(actor, authorizer, _opts) do
+    # Nil actor: treat as non-admin (Actor.admin?(nil) returns false; no crash)
+    actor = if is_nil(actor), do: nil, else: Actor.ensure_loaded(actor)
+
+    if user_argument_present?(authorizer) and not Actor.admin?(actor) do
+      {:ok, true}
+    else
+      {:ok, false}
+    end
+  end
+
+  # Forbid when :user was passed at all (link, unlink via nil/empty, or invalid value).
+  # Check argument key presence (atom or string) for defense-in-depth.
+  defp user_argument_present?(authorizer) do
+    args = get_arguments(authorizer) || %{}
+    Map.has_key?(args, :user) or Map.has_key?(args, "user")
+  end
+
+  defp get_arguments(authorizer) do
+    subject = authorizer.changeset || authorizer.subject
+
+    cond do
+      is_struct(subject, Ash.Changeset) -> subject.arguments
+      is_struct(subject, Ash.ActionInput) -> subject.arguments
+      true -> %{}
+    end
+  end
+end

lib/mv/authorization/checks/has_permission.ex

@@ -50,6 +50,7 @@ defmodule Mv.Authorization.Checks.HasPermission do
   - **:linked** - Filters based on resource type:
     - Member: `id == actor.member_id` (User.member_id → Member.id, inverse relationship)
     - CustomFieldValue: `member_id == actor.member_id` (CustomFieldValue.member_id → Member.id → User.member_id)
+    - MemberGroup: `member_id == actor.member_id` (MemberGroup.member_id → Member.id → User.member_id)
 
   ## Error Handling
 
@@ -131,26 +132,10 @@ defmodule Mv.Authorization.Checks.HasPermission do
              resource_name
            ) do
         :authorized ->
-          # For :all scope, authorize directly
           {:ok, true}
 
         {:filter, filter_expr} ->
-          # For :own/:linked scope:
-          # - With a record, evaluate filter against record for strict authorization
-          # - Without a record (queries/lists), return false
-          #
-          # NOTE: Returning false here forces the use of expr-based bypass policies.
-          # This is necessary because Ash's policy evaluation doesn't reliably call auto_filter
-          # when strict_check returns :unknown. Instead, resources should use bypass policies
-          # with expr() directly for filter-based authorization (see User resource).
-          if record do
-            evaluate_filter_for_strict_check(filter_expr, actor, record, resource_name)
-          else
-            # No record yet (e.g., read/list queries) - deny at strict_check level
-            # Resources must use expr-based bypass policies for list filtering
-            # Create: use a dedicated check that does not return a filter (e.g. CustomFieldValueCreateScope)
-            {:ok, false}
-          end
+          strict_check_filter_scope(record, filter_expr, actor, resource_name)
 
         false ->
           {:ok, false}
@@ -174,6 +159,15 @@ defmodule Mv.Authorization.Checks.HasPermission do
     end
   end
 
+  # For :own/:linked scope: with record evaluate filter; without record deny (resources use bypass + expr).
+  defp strict_check_filter_scope(record, filter_expr, actor, resource_name) do
+    if record do
+      evaluate_filter_for_strict_check(filter_expr, actor, record, resource_name)
+    else
+      {:ok, false}
+    end
+  end
+
   @impl true
   def auto_filter(actor, authorizer, _opts) do
     resource = authorizer.resource
@@ -278,36 +272,28 @@ defmodule Mv.Authorization.Checks.HasPermission do
   # For :own scope with User resource: id == actor.id
   # For :linked scope with Member resource: id == actor.member_id
   defp evaluate_filter_for_strict_check(_filter_expr, actor, record, resource_name) do
+    result =
       case {resource_name, record} do
+        # Scope :own
         {"User", %{id: user_id}} when not is_nil(user_id) ->
-        # Check if this user's ID matches the actor's ID (scope :own)
-        if user_id == actor.id do
-          {:ok, true}
-        else
-          {:ok, false}
-        end
+          user_id == actor.id
 
+        # Scope :linked
         {"Member", %{id: member_id}} when not is_nil(member_id) ->
-        # Check if this member's ID matches the actor's member_id
-        if member_id == actor.member_id do
-          {:ok, true}
-        else
-          {:ok, false}
-        end
+          member_id == actor.member_id
 
         {"CustomFieldValue", %{member_id: cfv_member_id}} when not is_nil(cfv_member_id) ->
-        # Check if this CFV's member_id matches the actor's member_id
-        if cfv_member_id == actor.member_id do
-          {:ok, true}
-        else
-          {:ok, false}
-        end
+          cfv_member_id == actor.member_id
+
+        {"MemberGroup", %{member_id: mg_member_id}} when not is_nil(mg_member_id) ->
+          mg_member_id == actor.member_id
 
         _ ->
-        # For other cases or when record is not available, return :unknown
-        # This will cause Ash to use auto_filter instead
-        {:ok, :unknown}
+          :unknown
       end
+
+    out = if result == :unknown, do: {:ok, :unknown}, else: {:ok, result}
+    out
   end
 
   # Extract resource name from module (e.g., Mv.Membership.Member -> "Member")
@@ -347,24 +333,20 @@ defmodule Mv.Authorization.Checks.HasPermission do
   defp apply_scope(:linked, actor, resource_name) do
     case resource_name do
       "Member" ->
-        # User.member_id → Member.id (inverse relationship)
-        # Filter: member.id == actor.member_id
-        # If actor has no member_id, return no results (use false or impossible condition)
-        if is_nil(actor.member_id) do
-          {:filter, expr(false)}
-        else
-          {:filter, expr(id == ^actor.member_id)}
-        end
+        # User.member_id → Member.id (inverse relationship). Filter: member.id == actor.member_id
+        linked_filter_by_member_id(actor, :id)
 
       "CustomFieldValue" ->
         # CustomFieldValue.member_id → Member.id → User.member_id
-        # Filter: custom_field_value.member_id == actor.member_id
-        # If actor has no member_id, return no results
-        if is_nil(actor.member_id) do
-          {:filter, expr(false)}
-        else
-          {:filter, expr(member_id == ^actor.member_id)}
-        end
+        linked_filter_by_member_id(actor, :member_id)
+
+      "MemberGroup" ->
+        # MemberGroup.member_id → Member.id → User.member_id (own linked member's group associations)
+        linked_filter_by_member_id(actor, :member_id)
+
+      "MembershipFeeCycle" ->
+        # MembershipFeeCycle.member_id → Member.id → User.member_id (own linked member's cycles)
+        linked_filter_by_member_id(actor, :member_id)
 
       _ ->
         # Fallback for other resources
@@ -372,6 +354,17 @@ defmodule Mv.Authorization.Checks.HasPermission do
     end
   end
 
+  # Returns {:filter, expr(false)} if actor has no member_id; otherwise {:filter, expr(field == ^actor.member_id)}.
+  # Used for :linked scope on Member (field :id), CustomFieldValue and MemberGroup (field :member_id).
+  defp linked_filter_by_member_id(actor, _field) when is_nil(actor.member_id) do
+    {:filter, expr(false)}
+  end
+
+  defp linked_filter_by_member_id(actor, :id), do: {:filter, expr(id == ^actor.member_id)}
+
+  defp linked_filter_by_member_id(actor, :member_id),
+    do: {:filter, expr(member_id == ^actor.member_id)}
+
   # Log authorization failures for debugging (lazy evaluation)
   defp log_auth_failure(actor, resource, action, reason) do
     Logger.debug(fn ->

lib/mv/authorization/checks/member_group_read_linked_for_own_data.ex

@@ -0,0 +1,63 @@
+defmodule Mv.Authorization.Checks.MemberGroupReadLinkedForOwnData do
+  @moduledoc """
+  Policy check for MemberGroup read: true only when actor has permission set "own_data"
+  AND record.member_id == actor.member_id.
+
+  Used in a bypass so that own_data gets the linked filter (via auto_filter for list queries),
+  while admin with member_id does not match and gets :all from HasPermission.
+
+  - With a record (e.g. get by id): returns true only when own_data and member_id match.
+  - Without a record (list query): strict_check returns false; auto_filter adds filter when own_data.
+  """
+  use Ash.Policy.Check
+
+  alias Mv.Authorization.Checks.ActorPermissionSetIs
+
+  @impl true
+  def type, do: :filter
+
+  @impl true
+  def describe(_opts),
+    do: "own_data can read only member_groups where member_id == actor.member_id"
+
+  @impl true
+  def strict_check(actor, authorizer, _opts) do
+    record = get_record_from_authorizer(authorizer)
+    is_own_data = ActorPermissionSetIs.match?(actor, authorizer, permission_set_name: "own_data")
+
+    cond do
+      # List query + own_data: return :unknown so authorizer applies auto_filter (keyword list)
+      is_nil(record) and is_own_data ->
+        {:ok, :unknown}
+
+      is_nil(record) ->
+        {:ok, false}
+
+      not is_own_data ->
+        {:ok, false}
+
+      record.member_id == actor.member_id ->
+        {:ok, true}
+
+      true ->
+        {:ok, false}
+    end
+  end
+
+  @impl true
+  def auto_filter(actor, _authorizer, _opts) do
+    if ActorPermissionSetIs.match?(actor, nil, permission_set_name: "own_data") &&
+         Map.get(actor, :member_id) do
+      [member_id: actor.member_id]
+    else
+      []
+    end
+  end
+
+  defp get_record_from_authorizer(authorizer) do
+    case authorizer.subject do
+      %{data: data} when not is_nil(data) -> data
+      _ -> nil
+    end
+  end
+end

lib/mv/authorization/checks/membership_fee_cycle_read_linked_for_own_data.ex

@@ -0,0 +1,62 @@
+defmodule Mv.Authorization.Checks.MembershipFeeCycleReadLinkedForOwnData do
+  @moduledoc """
+  Policy check for MembershipFeeCycle read: true only when actor has permission set "own_data"
+  AND record.member_id == actor.member_id.
+
+  Used in a bypass so that own_data gets the linked filter (via auto_filter for list queries),
+  while admin with member_id does not match and gets :all from HasPermission.
+
+  - With a record (e.g. get by id): returns true only when own_data and member_id match.
+  - Without a record (list query): return :unknown so authorizer applies auto_filter.
+  """
+  use Ash.Policy.Check
+
+  alias Mv.Authorization.Checks.ActorPermissionSetIs
+
+  @impl true
+  def type, do: :filter
+
+  @impl true
+  def describe(_opts),
+    do: "own_data can read only membership_fee_cycles where member_id == actor.member_id"
+
+  @impl true
+  def strict_check(actor, authorizer, _opts) do
+    record = get_record_from_authorizer(authorizer)
+    is_own_data = ActorPermissionSetIs.match?(actor, authorizer, permission_set_name: "own_data")
+
+    cond do
+      is_nil(record) and is_own_data ->
+        {:ok, :unknown}
+
+      is_nil(record) ->
+        {:ok, false}
+
+      not is_own_data ->
+        {:ok, false}
+
+      record.member_id == actor.member_id ->
+        {:ok, true}
+
+      true ->
+        {:ok, false}
+    end
+  end
+
+  @impl true
+  def auto_filter(actor, _authorizer, _opts) do
+    if ActorPermissionSetIs.match?(actor, nil, permission_set_name: "own_data") &&
+         Map.get(actor, :member_id) do
+      [member_id: actor.member_id]
+    else
+      []
+    end
+  end
+
+  defp get_record_from_authorizer(authorizer) do
+    case authorizer.subject do
+      %{data: data} when not is_nil(data) -> data
+      _ -> nil
+    end
+  end
+end

lib/mv/authorization/checks/oidc_role_sync_context.ex

@@ -0,0 +1,18 @@
+defmodule Mv.Authorization.Checks.OidcRoleSyncContext do
+  @moduledoc """
+  Policy check: true when the action is run from OIDC role sync (context.private.oidc_role_sync).
+
+  Used to allow the internal set_role_from_oidc_sync action only when called by Mv.OidcRoleSync,
+  which sets context.private.oidc_role_sync when performing the update.
+  """
+  use Ash.Policy.SimpleCheck
+
+  @impl true
+  def describe(_opts), do: "called from OIDC role sync (context.private.oidc_role_sync)"
+
+  @impl true
+  def match?(_actor, authorizer, _opts) do
+    context = Map.get(authorizer, :context) || %{}
+    get_in(context, [:private, :oidc_role_sync]) == true
+  end
+end

lib/mv/authorization/permission_sets.ex

@@ -58,6 +58,28 @@ defmodule Mv.Authorization.PermissionSets do
           pages: [String.t()]
         }
 
+  # DRY helpers for shared resource permission lists (used in own_data, read_only, normal_user, admin)
+  defp perm(resource, action, scope),
+    do: %{resource: resource, action: action, scope: scope, granted: true}
+
+  # All four CRUD actions for a resource with scope :all (used for admin)
+  defp perm_all(resource),
+    do: [
+      perm(resource, :read, :all),
+      perm(resource, :create, :all),
+      perm(resource, :update, :all),
+      perm(resource, :destroy, :all)
+    ]
+
+  # User: read/update own credentials only (all non-admin sets allow password changes)
+  defp user_own_credentials, do: [perm("User", :read, :own), perm("User", :update, :own)]
+
+  defp group_read_all, do: [perm("Group", :read, :all)]
+  defp custom_field_read_all, do: [perm("CustomField", :read, :all)]
+  defp membership_fee_type_read_all, do: [perm("MembershipFeeType", :read, :all)]
+  defp membership_fee_cycle_read_all, do: [perm("MembershipFeeCycle", :read, :all)]
+  defp role_read_all, do: [perm("Role", :read, :all)]
+
   @doc """
   Returns the list of all valid permission set names.
 
@@ -94,29 +116,22 @@ defmodule Mv.Authorization.PermissionSets do
 
   def get_permissions(:own_data) do
     %{
-      resources: [
-        # User: Can read/update own credentials only
-        # IMPORTANT: "read_only" refers to member data, NOT user credentials.
-        # All permission sets grant User.update :own to allow password changes.
-        %{resource: "User", action: :read, scope: :own, granted: true},
-        %{resource: "User", action: :update, scope: :own, granted: true},
-
-        # Member: Can read/update linked member
-        %{resource: "Member", action: :read, scope: :linked, granted: true},
-        %{resource: "Member", action: :update, scope: :linked, granted: true},
-
-        # CustomFieldValue: Can read/update/create/destroy custom field values of linked member
-        %{resource: "CustomFieldValue", action: :read, scope: :linked, granted: true},
-        %{resource: "CustomFieldValue", action: :update, scope: :linked, granted: true},
-        %{resource: "CustomFieldValue", action: :create, scope: :linked, granted: true},
-        %{resource: "CustomFieldValue", action: :destroy, scope: :linked, granted: true},
-
-        # CustomField: Can read all (needed for forms)
-        %{resource: "CustomField", action: :read, scope: :all, granted: true},
-
-        # Group: Can read all (needed for viewing groups)
-        %{resource: "Group", action: :read, scope: :all, granted: true}
-      ],
+      resources:
+        user_own_credentials() ++
+          [
+            perm("Member", :read, :linked),
+            perm("Member", :update, :linked),
+            perm("CustomFieldValue", :read, :linked),
+            perm("CustomFieldValue", :update, :linked),
+            perm("CustomFieldValue", :create, :linked),
+            perm("CustomFieldValue", :destroy, :linked)
+          ] ++
+          custom_field_read_all() ++
+          group_read_all() ++
+          [perm("MemberGroup", :read, :linked)] ++
+          membership_fee_type_read_all() ++
+          [perm("MembershipFeeCycle", :read, :linked)] ++
+          role_read_all(),
       pages: [
         # No "/" - Mitglied must not see member index at root (same content as /members).
         # Own profile (sidebar links to /users/:id) and own user edit
@@ -133,33 +148,27 @@ defmodule Mv.Authorization.PermissionSets do
 
   def get_permissions(:read_only) do
     %{
-      resources: [
-        # User: Can read/update own credentials only
-        # IMPORTANT: "read_only" refers to member data, NOT user credentials.
-        # All permission sets grant User.update :own to allow password changes.
-        %{resource: "User", action: :read, scope: :own, granted: true},
-        %{resource: "User", action: :update, scope: :own, granted: true},
-
-        # Member: Can read all members, no modifications
-        %{resource: "Member", action: :read, scope: :all, granted: true},
-
-        # CustomFieldValue: Can read all custom field values
-        %{resource: "CustomFieldValue", action: :read, scope: :all, granted: true},
-
-        # CustomField: Can read all
-        %{resource: "CustomField", action: :read, scope: :all, granted: true},
-
-        # Group: Can read all
-        %{resource: "Group", action: :read, scope: :all, granted: true}
-      ],
+      resources:
+        user_own_credentials() ++
+          [
+            perm("Member", :read, :all),
+            perm("CustomFieldValue", :read, :all)
+          ] ++
+          custom_field_read_all() ++
+          group_read_all() ++
+          [perm("MemberGroup", :read, :all)] ++
+          membership_fee_type_read_all() ++
+          membership_fee_cycle_read_all() ++
+          role_read_all(),
       pages: [
         "/",
         # Own profile (sidebar links to /users/:id; redirect target must be allowed)
         "/users/:id",
         "/users/:id/edit",
         "/users/:id/show/edit",
-        # Member list
+        # Member list and CSV export
         "/members",
+        "/members/export.csv",
         # Member detail
         "/members/:id",
         # Custom field values overview
@@ -176,31 +185,38 @@ defmodule Mv.Authorization.PermissionSets do
 
   def get_permissions(:normal_user) do
     %{
-      resources: [
-        # User: Can read/update own credentials only
-        # IMPORTANT: "read_only" refers to member data, NOT user credentials.
-        # All permission sets grant User.update :own to allow password changes.
-        %{resource: "User", action: :read, scope: :own, granted: true},
-        %{resource: "User", action: :update, scope: :own, granted: true},
-
-        # Member: Full CRUD except destroy (safety)
-        %{resource: "Member", action: :read, scope: :all, granted: true},
-        %{resource: "Member", action: :create, scope: :all, granted: true},
-        %{resource: "Member", action: :update, scope: :all, granted: true},
-        # Note: destroy intentionally omitted for safety
-
-        # CustomFieldValue: Full CRUD
-        %{resource: "CustomFieldValue", action: :read, scope: :all, granted: true},
-        %{resource: "CustomFieldValue", action: :create, scope: :all, granted: true},
-        %{resource: "CustomFieldValue", action: :update, scope: :all, granted: true},
-        %{resource: "CustomFieldValue", action: :destroy, scope: :all, granted: true},
-
-        # CustomField: Read only (admin manages definitions)
-        %{resource: "CustomField", action: :read, scope: :all, granted: true},
-
-        # Group: Can read all
-        %{resource: "Group", action: :read, scope: :all, granted: true}
-      ],
+      resources:
+        user_own_credentials() ++
+          [
+            perm("Member", :read, :all),
+            perm("Member", :create, :all),
+            perm("Member", :update, :all),
+            # destroy intentionally omitted for safety
+            perm("CustomFieldValue", :read, :all),
+            perm("CustomFieldValue", :create, :all),
+            perm("CustomFieldValue", :update, :all),
+            perm("CustomFieldValue", :destroy, :all)
+          ] ++
+          custom_field_read_all() ++
+          [
+            perm("Group", :read, :all),
+            perm("Group", :create, :all),
+            perm("Group", :update, :all),
+            perm("Group", :destroy, :all)
+          ] ++
+          [
+            perm("MemberGroup", :read, :all),
+            perm("MemberGroup", :create, :all),
+            perm("MemberGroup", :destroy, :all)
+          ] ++
+          membership_fee_type_read_all() ++
+          [
+            perm("MembershipFeeCycle", :read, :all),
+            perm("MembershipFeeCycle", :create, :all),
+            perm("MembershipFeeCycle", :update, :all),
+            perm("MembershipFeeCycle", :destroy, :all)
+          ] ++
+          role_read_all(),
       pages: [
         "/",
         # Own profile (sidebar links to /users/:id; redirect target must be allowed)
@@ -208,6 +224,7 @@ defmodule Mv.Authorization.PermissionSets do
         "/users/:id/edit",
         "/users/:id/show/edit",
         "/members",
+        "/members/export.csv",
         # Create member
         "/members/new",
         "/members/:id",
@@ -221,52 +238,39 @@ defmodule Mv.Authorization.PermissionSets do
         "/custom_field_values/:id/edit",
         # Groups overview
         "/groups",
+        # Create group
+        "/groups/new",
         # Group detail
-        "/groups/:slug"
+        "/groups/:slug",
+        # Edit group
+        "/groups/:slug/edit"
       ]
     }
   end
 
   def get_permissions(:admin) do
+    # MemberGroup has no :update action in the domain; use read/create/destroy only
+    member_group_perms = [
+      perm("MemberGroup", :read, :all),
+      perm("MemberGroup", :create, :all),
+      perm("MemberGroup", :destroy, :all)
+    ]
+
     %{
-      resources: [
-        # User: Full management including other users
-        %{resource: "User", action: :read, scope: :all, granted: true},
-        %{resource: "User", action: :create, scope: :all, granted: true},
-        %{resource: "User", action: :update, scope: :all, granted: true},
-        %{resource: "User", action: :destroy, scope: :all, granted: true},
-
-        # Member: Full CRUD
-        %{resource: "Member", action: :read, scope: :all, granted: true},
-        %{resource: "Member", action: :create, scope: :all, granted: true},
-        %{resource: "Member", action: :update, scope: :all, granted: true},
-        %{resource: "Member", action: :destroy, scope: :all, granted: true},
-
-        # CustomFieldValue: Full CRUD
-        %{resource: "CustomFieldValue", action: :read, scope: :all, granted: true},
-        %{resource: "CustomFieldValue", action: :create, scope: :all, granted: true},
-        %{resource: "CustomFieldValue", action: :update, scope: :all, granted: true},
-        %{resource: "CustomFieldValue", action: :destroy, scope: :all, granted: true},
-
-        # CustomField: Full CRUD (admin manages custom field definitions)
-        %{resource: "CustomField", action: :read, scope: :all, granted: true},
-        %{resource: "CustomField", action: :create, scope: :all, granted: true},
-        %{resource: "CustomField", action: :update, scope: :all, granted: true},
-        %{resource: "CustomField", action: :destroy, scope: :all, granted: true},
-
-        # Role: Full CRUD (admin manages roles)
-        %{resource: "Role", action: :read, scope: :all, granted: true},
-        %{resource: "Role", action: :create, scope: :all, granted: true},
-        %{resource: "Role", action: :update, scope: :all, granted: true},
-        %{resource: "Role", action: :destroy, scope: :all, granted: true},
-
-        # Group: Full CRUD (admin manages groups)
-        %{resource: "Group", action: :read, scope: :all, granted: true},
-        %{resource: "Group", action: :create, scope: :all, granted: true},
-        %{resource: "Group", action: :update, scope: :all, granted: true},
-        %{resource: "Group", action: :destroy, scope: :all, granted: true}
-      ],
+      resources:
+        perm_all("User") ++
+          perm_all("Member") ++
+          perm_all("CustomFieldValue") ++
+          perm_all("CustomField") ++
+          perm_all("Role") ++
+          perm_all("Group") ++
+          member_group_perms ++
+          perm_all("MembershipFeeType") ++
+          perm_all("MembershipFeeCycle"),
       pages: [
+        # Explicit admin-only pages (for clarity and future restrictions)
+        "/settings",
+        "/membership_fee_settings",
         # Wildcard: Admin can access all pages
         "*"
       ]

lib/mv/authorization/role.ex

@@ -37,7 +37,8 @@ defmodule Mv.Authorization.Role do
   """
   use Ash.Resource,
     domain: Mv.Authorization,
-    data_layer: AshPostgres.DataLayer
+    data_layer: AshPostgres.DataLayer,
+    authorizers: [Ash.Policy.Authorizer]
 
   postgres do
     table "roles"
@@ -86,6 +87,13 @@ defmodule Mv.Authorization.Role do
     end
   end
 
+  policies do
+    policy action_type([:read, :create, :update, :destroy]) do
+      description "Role access: read for all permission sets, create/update/destroy for admin only (PermissionSets)"
+      authorize_if Mv.Authorization.Checks.HasPermission
+    end
+  end
+
   validations do
     validate one_of(
                :permission_set_name,
@@ -173,4 +181,18 @@ defmodule Mv.Authorization.Role do
     |> Ash.Query.filter(name == "Mitglied")
     |> Ash.read_one(authorize?: false, domain: Mv.Authorization)
   end
+
+  @doc """
+  Returns the Admin role if it exists.
+
+  Used by release tasks (e.g. seed_admin) and OIDC role sync to assign the admin role.
+  """
+  @spec get_admin_role() :: {:ok, t() | nil} | {:error, term()}
+  def get_admin_role do
+    require Ash.Query
+
+    __MODULE__
+    |> Ash.Query.filter(name == "Admin")
+    |> Ash.read_one(authorize?: false, domain: Mv.Authorization)
+  end
 end

lib/mv/email_sync/changes/sync_user_email_to_member.ex

@@ -27,6 +27,10 @@ defmodule Mv.EmailSync.Changes.SyncUserEmailToMember do
   Modified changeset with email synchronization applied, or original changeset
   if recursion detected.
   """
+  # Ash 3.12+ calls this to decide whether to run the change in certain contexts.
+  @impl true
+  def has_change?, do: true
+
   @impl true
   def change(changeset, _opts, context) do
     # Only recursion protection needed - trigger logic is in `where` clauses
@@ -40,24 +44,27 @@ defmodule Mv.EmailSync.Changes.SyncUserEmailToMember do
   defp sync_email(changeset) do
     Ash.Changeset.around_transaction(changeset, fn cs, callback ->
       result = callback.(cs)
+      apply_sync(result)
+    end)
+  end
 
+  defp apply_sync(result) do
     with {:ok, record} <- Helpers.extract_record(result),
          {:ok, user, member} <- get_user_and_member(record) do
-        # When called from Member-side, we need to update the member in the result
-        # When called from User-side, we update the linked member in DB only
-        case record do
-          %Mv.Membership.Member{} ->
-            # Member-side: Override member email in result with user email
-            Helpers.override_with_linked_email(result, user.email)
-
-          %Mv.Accounts.User{} ->
-            # User-side: Sync user email to linked member in DB
-            Helpers.sync_email_to_linked_record(result, member, user.email)
-        end
+      sync_by_record_type(result, record, user, member)
     else
       _ -> result
     end
-    end)
+  end
+
+  # When called from Member-side, we update the member in the result.
+  # When called from User-side, we sync user email to the linked member in DB.
+  defp sync_by_record_type(result, %Mv.Membership.Member{}, user, _member) do
+    Helpers.override_with_linked_email(result, user.email)
+  end
+
+  defp sync_by_record_type(result, %Mv.Accounts.User{}, user, member) do
+    Helpers.sync_email_to_linked_record(result, member, user.email)
   end
 
   # Retrieves user and member - works for both resource types

lib/mv/email_sync/loader.ex

@@ -3,13 +3,15 @@ defmodule Mv.EmailSync.Loader do
   Helper functions for loading linked records in email synchronization.
   Centralizes the logic for retrieving related User/Member entities.
 
-  ## Authorization
+  ## Authorization-independent link checks
 
-  This module runs systemically and uses the system actor for all operations.
-  This ensures that email synchronization always works, regardless of user permissions.
-
-  All functions use `Mv.Helpers.SystemActor.get_system_actor/0` to bypass
-  user permission checks, as email sync is a mandatory side effect.
+  All functions use the **system actor** for the load. Link existence
+  (linked vs not linked) is therefore determined **independently of the
+  current request actor**. This is required so that validations (e.g.
+  `EmailChangePermission`, `EmailNotUsedByOtherUser`) can correctly decide
+  "member is linked" even when the current user would not have read permission
+  on the related User. Using the request actor would otherwise allow
+  treating a linked member as unlinked and bypass the permission rule.
   """
   alias Mv.Helpers
   alias Mv.Helpers.SystemActor

lib/mv/helpers.ex

@@ -5,6 +5,8 @@ defmodule Mv.Helpers do
   Provides utilities that are not specific to a single domain or layer.
   """
 
+  require Ash.Query
+
   @doc """
   Converts an actor to Ash options list for authorization.
   Returns empty list if actor is nil.
@@ -24,4 +26,22 @@ defmodule Mv.Helpers do
   @spec ash_actor_opts(Mv.Accounts.User.t() | nil) :: keyword()
   def ash_actor_opts(nil), do: []
   def ash_actor_opts(actor) when not is_nil(actor), do: [actor: actor]
+
+  @doc """
+  Returns the query unchanged if `exclude_id` is nil; otherwise adds a filter `id != ^exclude_id`.
+
+  Used in uniqueness validations that must exclude the current record (e.g. name uniqueness
+  on update, duplicate association checks). Call with the record's primary key to exclude it
+  from the result set.
+
+  ## Examples
+
+      query
+      |> Ash.Query.filter(name == ^name)
+      |> Mv.Helpers.query_exclude_id(current_id)
+
+  """
+  @spec query_exclude_id(Ash.Query.t(), String.t() | nil) :: Ash.Query.t()
+  def query_exclude_id(query, nil), do: query
+  def query_exclude_id(query, id), do: Ash.Query.filter(query, id != ^id)
 end

lib/mv/membership/custom_field_value_formatter.ex

@@ -0,0 +1,55 @@
+defmodule Mv.Membership.CustomFieldValueFormatter do
+  @moduledoc """
+  Neutral formatter for custom field values (e.g. CSV export).
+
+  Same logic as the member overview Formatter but without Gettext or web helpers,
+  so it can be used from the Membership context. For boolean: "Yes"/"No";
+  for date: European format (dd.mm.yyyy).
+  """
+  @doc """
+  Formats a custom field value for plain text (e.g. CSV).
+
+  Handles nil, Ash.Union, JSONB map, and direct values. Uses custom_field.value_type
+  for typing. Boolean -> "Yes"/"No", Date -> dd.mm.yyyy.
+  """
+  def format_custom_field_value(nil, _custom_field), do: ""
+
+  def format_custom_field_value(%Ash.Union{value: value, type: type}, custom_field) do
+    format_value_by_type(value, type, custom_field)
+  end
+
+  def format_custom_field_value(value, custom_field) when is_map(value) do
+    type = Map.get(value, "type") || Map.get(value, "_union_type")
+    val = Map.get(value, "value") || Map.get(value, "_union_value")
+    format_value_by_type(val, type, custom_field)
+  end
+
+  def format_custom_field_value(value, custom_field) do
+    format_value_by_type(value, custom_field.value_type, custom_field)
+  end
+
+  defp format_value_by_type(value, :string, _), do: to_string(value)
+  defp format_value_by_type(value, :integer, _), do: to_string(value)
+
+  defp format_value_by_type(value, type, _) when type in [:string, :email] and is_binary(value) do
+    if String.trim(value) == "", do: "", else: value
+  end
+
+  defp format_value_by_type(value, :email, _), do: to_string(value)
+  defp format_value_by_type(value, :boolean, _) when value == true, do: "Yes"
+  defp format_value_by_type(value, :boolean, _) when value == false, do: "No"
+  defp format_value_by_type(value, :boolean, _), do: to_string(value)
+
+  defp format_value_by_type(%Date{} = date, :date, _) do
+    Calendar.strftime(date, "%d.%m.%Y")
+  end
+
+  defp format_value_by_type(value, :date, _) when is_binary(value) do
+    case Date.from_iso8601(value) do
+      {:ok, date} -> Calendar.strftime(date, "%d.%m.%Y")
+      _ -> value
+    end
+  end
+
+  defp format_value_by_type(value, _type, _), do: to_string(value)
+end

lib/mv/membership/import/import_runner.ex

@@ -0,0 +1,170 @@
+defmodule Mv.Membership.Import.ImportRunner do
+  @moduledoc """
+  Orchestrates CSV member import: file reading, progress tracking, chunk processing,
+  and error formatting. Used by `MvWeb.ImportExportLive` to keep LiveView thin.
+
+  This module does not depend on Phoenix or LiveView. It provides pure functions for
+  progress/merge and side-effectful helpers (read_file_entry, process_chunk) that
+  are called from the LiveView or from tasks started by it.
+  """
+
+  use Gettext, backend: MvWeb.Gettext
+
+  alias Mv.Membership.Import.MemberCSV
+
+  @default_max_errors 50
+
+  @doc """
+  Reads file content from a Phoenix LiveView upload entry (path).
+
+  Used as the callback for `consume_uploaded_entries/3`. Returns `{:ok, content}` or
+  `{:error, reason}` with a user-friendly string.
+  """
+  @spec read_file_entry(map(), map()) :: {:ok, String.t()} | {:error, String.t()}
+  def read_file_entry(%{path: path}, _entry) do
+    case File.read(path) do
+      {:ok, content} ->
+        {:ok, content}
+
+      {:error, reason} when is_atom(reason) ->
+        {:error, :file.format_error(reason)}
+
+      {:error, %File.Error{reason: reason}} ->
+        {:error, :file.format_error(reason)}
+
+      {:error, reason} ->
+        {:error, Exception.message(reason)}
+    end
+  end
+
+  @doc """
+  Normalizes the result of `consume_uploaded_entries/3` into `{:ok, content}` or `{:error, reason}`.
+
+  Handles both the standard `[{:ok, content}]` and test helpers that may return `[content]`.
+  """
+  @spec parse_consume_result(list()) :: {:ok, String.t()} | {:error, String.t()}
+  def parse_consume_result(raw) do
+    case raw do
+      [{:ok, content}] when is_binary(content) -> {:ok, content}
+      [content] when is_binary(content) -> {:ok, content}
+      [{:error, reason}] -> {:error, gettext("Failed to read file: %{reason}", reason: reason)}
+      [] -> {:error, gettext("No file was uploaded")}
+      _other -> {:error, gettext("Failed to read uploaded file: unexpected format")}
+    end
+  end
+
+  @doc """
+  Builds the initial progress map from a prepared import_state.
+  """
+  @spec initial_progress(map(), keyword()) :: map()
+  def initial_progress(import_state, opts \\ []) do
+    _max_errors = Keyword.get(opts, :max_errors, @default_max_errors)
+    total = length(import_state.chunks)
+
+    %{
+      inserted: 0,
+      failed: 0,
+      errors: [],
+      warnings: import_state.warnings || [],
+      status: :running,
+      current_chunk: 0,
+      total_chunks: total,
+      errors_truncated?: false
+    }
+  end
+
+  @doc """
+  Merges a chunk result into the current progress and returns updated progress.
+
+  Caps errors at `max_errors` (default 50). Sets `status` to `:done` when all chunks
+  have been processed.
+  """
+  @spec merge_progress(map(), map(), non_neg_integer(), keyword()) :: map()
+  def merge_progress(progress, chunk_result, current_chunk_idx, opts \\ []) do
+    max_errors = Keyword.get(opts, :max_errors, @default_max_errors)
+
+    all_errors = progress.errors ++ chunk_result.errors
+    new_errors = Enum.take(all_errors, max_errors)
+    errors_truncated? = length(all_errors) > max_errors
+    new_warnings = progress.warnings ++ Map.get(chunk_result, :warnings, [])
+
+    chunks_processed = current_chunk_idx + 1
+    new_status = if chunks_processed >= progress.total_chunks, do: :done, else: :running
+
+    %{
+      inserted: progress.inserted + chunk_result.inserted,
+      failed: progress.failed + chunk_result.failed,
+      errors: new_errors,
+      warnings: new_warnings,
+      status: new_status,
+      current_chunk: chunks_processed,
+      total_chunks: progress.total_chunks,
+      errors_truncated?: errors_truncated? || Map.get(chunk_result, :errors_truncated?, false)
+    }
+  end
+
+  @doc """
+  Returns the next action after processing a chunk: send the next chunk index or done.
+  """
+  @spec next_chunk_action(non_neg_integer(), non_neg_integer()) ::
+          {:send_chunk, non_neg_integer()} | :done
+  def next_chunk_action(current_idx, total_chunks) do
+    next_idx = current_idx + 1
+    if next_idx < total_chunks, do: {:send_chunk, next_idx}, else: :done
+  end
+
+  @doc """
+  Processes one chunk (validate + create members), then sends `{:chunk_done, idx, result}`
+  or `{:chunk_error, idx, reason}` to `live_view_pid`.
+
+  Options: `:custom_field_lookup`, `:existing_error_count`, `:max_errors`, `:actor`.
+  """
+  @spec process_chunk(
+          list(),
+          map(),
+          map(),
+          keyword(),
+          pid(),
+          non_neg_integer()
+        ) :: :ok
+  def process_chunk(chunk, column_map, custom_field_map, opts, live_view_pid, idx) do
+    result =
+      try do
+        MemberCSV.process_chunk(chunk, column_map, custom_field_map, opts)
+      rescue
+        e -> {:error, Exception.message(e)}
+      catch
+        :exit, reason -> {:error, inspect(reason)}
+        :throw, reason -> {:error, inspect(reason)}
+      end
+
+    case result do
+      {:ok, chunk_result} -> send(live_view_pid, {:chunk_done, idx, chunk_result})
+      {:error, reason} -> send(live_view_pid, {:chunk_error, idx, reason})
+    end
+
+    :ok
+  end
+
+  @doc """
+  Returns a user-facing error message for chunk failures (invalid index, missing state,
+  or processing failure).
+  """
+  @spec format_chunk_error(
+          :invalid_index | :missing_state | :processing_failed,
+          non_neg_integer(),
+          any()
+        ) ::
+          String.t()
+  def format_chunk_error(:invalid_index, idx, _reason) do
+    gettext("Invalid chunk index: %{idx}", idx: idx)
+  end
+
+  def format_chunk_error(:missing_state, idx, _reason) do
+    gettext("Import state is missing. Cannot process chunk %{idx}.", idx: idx)
+  end
+
+  def format_chunk_error(:processing_failed, idx, reason) do
+    gettext("Failed to process chunk %{idx}: %{reason}", idx: idx, reason: inspect(reason))
+  end
+end

lib/mv/membership/member/validations/email_change_permission.ex

@@ -0,0 +1,75 @@
+defmodule Mv.Membership.Member.Validations.EmailChangePermission do
+  @moduledoc """
+  Validates that only admins or the linked user may change a linked member's email.
+
+  This validation runs on member update when the email attribute is changing.
+  It allows the change only if:
+  - The member is not linked to a user, or
+  - The actor has the admin permission set (via `Mv.Authorization.Actor.admin?/1`), or
+  - The actor is the user linked to this member (actor.member_id == member.id).
+
+  This prevents non-admins from changing another user's linked member email,
+  which would sync to that user's account and break email synchronization.
+
+  Missing actor is not allowed; the system actor counts as admin (via `Actor.admin?/1`).
+  """
+  use Ash.Resource.Validation
+  use Gettext, backend: MvWeb.Gettext, otp_app: :mv
+
+  alias Mv.Authorization.Actor
+  alias Mv.EmailSync.Loader
+
+  @doc """
+  Validates that the actor may change the member's email when the member is linked.
+
+  Only runs when the email attribute is changing (checked inside). Skips when
+  member is not linked. Allows when actor is admin or owns the linked member.
+  """
+  @impl true
+  def validate(changeset, _opts, context) do
+    if Ash.Changeset.changing_attribute?(changeset, :email) do
+      validate_linked_member_email_change(changeset, context)
+    else
+      :ok
+    end
+  end
+
+  defp validate_linked_member_email_change(changeset, context) do
+    linked_user = Loader.get_linked_user(changeset.data)
+
+    if is_nil(linked_user) do
+      :ok
+    else
+      actor = resolve_actor(changeset, context)
+      member_id = changeset.data.id
+
+      if Actor.admin?(actor) or actor_owns_member?(actor, member_id) do
+        :ok
+      else
+        msg =
+          dgettext(
+            "default",
+            "Only administrators or the linked user can change the email for members linked to users"
+          )
+
+        {:error, field: :email, message: msg}
+      end
+    end
+  end
+
+  # Ash stores actor in changeset.context.private.actor; validation context has .actor; some callsites use context.actor
+  defp resolve_actor(changeset, context) do
+    ctx = changeset.context || %{}
+
+    get_in(ctx, [:private, :actor]) ||
+      Map.get(ctx, :actor) ||
+      (context && Map.get(context, :actor))
+  end
+
+  defp actor_owns_member?(nil, _member_id), do: false
+
+  defp actor_owns_member?(actor, member_id) do
+    actor_member_id = Map.get(actor, :member_id) || Map.get(actor, "member_id")
+    actor_member_id == member_id
+  end
+end

lib/mv/membership/member/validations/email_not_used_by_other_user.ex

@@ -8,6 +8,8 @@ defmodule Mv.Membership.Member.Validations.EmailNotUsedByOtherUser do
   This allows creating members with the same email as unlinked users.
   """
   use Ash.Resource.Validation
+
+  alias Mv.EmailSync.Loader
   alias Mv.Helpers
 
   require Logger
@@ -32,7 +34,8 @@ defmodule Mv.Membership.Member.Validations.EmailNotUsedByOtherUser do
   def validate(changeset, _opts, _context) do
     email_changing? = Ash.Changeset.changing_attribute?(changeset, :email)
 
-    linked_user_id = get_linked_user_id(changeset.data)
+    linked_user = Loader.get_linked_user(changeset.data)
+    linked_user_id = if linked_user, do: linked_user.id, else: nil
     is_linked? = not is_nil(linked_user_id)
 
     # Only validate if member is already linked AND email is changing
@@ -53,7 +56,7 @@ defmodule Mv.Membership.Member.Validations.EmailNotUsedByOtherUser do
     query =
       Mv.Accounts.User
       |> Ash.Query.filter(email == ^email)
-      |> maybe_exclude_id(exclude_user_id)
+      |> Mv.Helpers.query_exclude_id(exclude_user_id)
 
     system_actor = SystemActor.get_system_actor()
     opts = Helpers.ash_actor_opts(system_actor)
@@ -73,19 +76,4 @@ defmodule Mv.Membership.Member.Validations.EmailNotUsedByOtherUser do
         :ok
     end
   end
-
-  defp maybe_exclude_id(query, nil), do: query
-  defp maybe_exclude_id(query, id), do: Ash.Query.filter(query, id != ^id)
-
-  defp get_linked_user_id(member_data) do
-    alias Mv.Helpers.SystemActor
-
-    system_actor = SystemActor.get_system_actor()
-    opts = Helpers.ash_actor_opts(system_actor)
-
-    case Ash.load(member_data, :user, opts) do
-      {:ok, %{user: %{id: id}}} -> id
-      _ -> nil
-    end
-  end
 end

lib/mv/membership/member_export.ex

@@ -0,0 +1,450 @@
+defmodule Mv.Membership.MemberExport do
+  @moduledoc """
+  Builds member list and column specs for CSV export.
+
+  Used by `MvWeb.MemberExportController`. Does not perform translations;
+  the controller applies headers (e.g. via `MemberFields.label` / gettext)
+  and sends the download.
+  """
+
+  require Ash.Query
+  import Ash.Expr
+
+  alias Mv.Membership.CustomField
+  alias Mv.Membership.Member
+  alias Mv.Membership.MemberExportSort
+  alias MvWeb.MemberLive.Index.MembershipFeeStatus
+
+  @member_fields_allowlist (Mv.Constants.member_fields() |> Enum.map(&Atom.to_string/1)) ++
+                             ["membership_fee_status"]
+  @computed_export_fields ["membership_fee_status"]
+  @computed_insert_after "membership_fee_start_date"
+  @custom_field_prefix Mv.Constants.custom_field_prefix()
+  @domain_member_field_strings Mv.Constants.member_fields() |> Enum.map(&Atom.to_string/1)
+
+  @doc """
+  Fetches members and column specs for export.
+
+  - `actor` - Ash actor (e.g. current user)
+  - `parsed` - Map from controller's parse_and_validate (selected_ids, member_fields, etc.)
+
+  Returns `{:ok, members, column_specs}` or `{:error, :forbidden}`.
+  Column specs have `:kind`, `:key`, and for custom fields `:custom_field`;
+  the controller adds `:header` and optional computed columns to members before CSV export.
+  """
+  @spec fetch(struct(), map()) ::
+          {:ok, [struct()], [map()]} | {:error, :forbidden}
+  def fetch(actor, parsed) do
+    custom_field_ids_union =
+      (parsed.custom_field_ids ++ Map.keys(parsed.boolean_filters || %{})) |> Enum.uniq()
+
+    with {:ok, custom_fields_by_id} <- load_custom_fields_by_id(custom_field_ids_union, actor),
+         {:ok, members} <- load_members(actor, parsed, custom_fields_by_id) do
+      column_specs = build_column_specs(parsed, custom_fields_by_id)
+      {:ok, members, column_specs}
+    end
+  end
+
+  defp load_custom_fields_by_id([], _actor), do: {:ok, %{}}
+
+  defp load_custom_fields_by_id(custom_field_ids, actor) do
+    query =
+      CustomField
+      |> Ash.Query.filter(expr(id in ^custom_field_ids))
+      |> Ash.Query.select([:id, :name, :value_type])
+
+    case Ash.read(query, actor: actor) do
+      {:ok, custom_fields} ->
+        by_id = build_custom_fields_by_id(custom_field_ids, custom_fields)
+        {:ok, by_id}
+
+      {:error, %Ash.Error.Forbidden{}} ->
+        {:error, :forbidden}
+    end
+  end
+
+  defp build_custom_fields_by_id(custom_field_ids, custom_fields) do
+    Enum.reduce(custom_field_ids, %{}, fn id, acc ->
+      find_and_add_custom_field(acc, id, custom_fields)
+    end)
+  end
+
+  defp find_and_add_custom_field(acc, id, custom_fields) do
+    case Enum.find(custom_fields, fn cf -> to_string(cf.id) == to_string(id) end) do
+      nil -> acc
+      cf -> Map.put(acc, id, cf)
+    end
+  end
+
+  defp build_column_specs(parsed, custom_fields_by_id) do
+    member_specs = build_member_column_specs(parsed)
+    custom_specs = build_custom_column_specs(parsed, custom_fields_by_id)
+
+    member_specs ++ custom_specs
+  end
+
+  defp build_member_column_specs(parsed) do
+    Enum.map(parsed.member_fields, fn f ->
+      build_single_member_spec(f, parsed.selectable_member_fields)
+    end)
+    |> Enum.reject(&is_nil/1)
+  end
+
+  defp build_single_member_spec(field, selectable_member_fields) do
+    if field in selectable_member_fields do
+      %{kind: :member_field, key: field}
+    else
+      build_computed_spec(field)
+    end
+  end
+
+  defp build_computed_spec(field) do
+    # only allow known computed export fields to avoid crashing on unknown atoms
+    if field in @computed_export_fields do
+      %{kind: :computed, key: String.to_existing_atom(field)}
+    else
+      # ignore unknown non-selectable fields defensively
+      nil
+    end
+  end
+
+  defp build_custom_column_specs(parsed, custom_fields_by_id) do
+    parsed.custom_field_ids
+    |> Enum.map(fn id -> Map.get(custom_fields_by_id, id) end)
+    |> Enum.reject(&is_nil/1)
+    |> Enum.map(fn cf -> %{kind: :custom_field, key: cf.id, custom_field: cf} end)
+  end
+
+  defp load_members(actor, parsed, custom_fields_by_id) do
+    query = build_members_query(parsed, custom_fields_by_id)
+
+    case Ash.read(query, actor: actor) do
+      {:ok, members} ->
+        processed_members = process_loaded_members(members, parsed, custom_fields_by_id)
+        {:ok, processed_members}
+
+      {:error, %Ash.Error.Forbidden{}} ->
+        {:error, :forbidden}
+    end
+  end
+
+  defp build_members_query(parsed, _custom_fields_by_id) do
+    select_fields =
+      [:id] ++ Enum.map(parsed.selectable_member_fields, &String.to_existing_atom/1)
+
+    custom_field_ids_union = parsed.custom_field_ids ++ Map.keys(parsed.boolean_filters || %{})
+
+    need_cycles =
+      parsed.show_current_cycle or parsed.cycle_status_filter != nil or
+        parsed.computed_fields != [] or
+        "membership_fee_status" in parsed.member_fields
+
+    query =
+      Member
+      |> Ash.Query.new()
+      |> Ash.Query.select(select_fields)
+      |> load_custom_field_values_query(custom_field_ids_union)
+      |> maybe_load_cycles(need_cycles, parsed.show_current_cycle)
+
+    if parsed.selected_ids != [] do
+      Ash.Query.filter(query, expr(id in ^parsed.selected_ids))
+    else
+      query
+      |> apply_search(parsed.query)
+      |> then(fn q ->
+        {q, _sort_after_load} = maybe_sort(q, parsed.sort_field, parsed.sort_order)
+        q
+      end)
+    end
+  end
+
+  defp process_loaded_members(members, parsed, custom_fields_by_id) do
+    members
+    |> apply_post_load_filters(parsed, custom_fields_by_id)
+    |> apply_post_load_sorting(parsed, custom_fields_by_id)
+    |> add_computed_fields(parsed.computed_fields, parsed.show_current_cycle)
+  end
+
+  defp apply_post_load_filters(members, parsed, custom_fields_by_id) do
+    if parsed.selected_ids == [] do
+      members
+      |> apply_cycle_status_filter(parsed.cycle_status_filter, parsed.show_current_cycle)
+      |> MvWeb.MemberLive.Index.apply_boolean_custom_field_filters(
+        parsed.boolean_filters || %{},
+        Map.values(custom_fields_by_id)
+      )
+    else
+      members
+    end
+  end
+
+  defp apply_post_load_sorting(members, parsed, custom_fields_by_id) do
+    if parsed.selected_ids == [] and sort_after_load?(parsed.sort_field) do
+      sort_members_by_custom_field(
+        members,
+        parsed.sort_field,
+        parsed.sort_order,
+        Map.values(custom_fields_by_id)
+      )
+    else
+      members
+    end
+  end
+
+  defp load_custom_field_values_query(query, []), do: query
+
+  defp load_custom_field_values_query(query, custom_field_ids) do
+    cfv_query =
+      Mv.Membership.CustomFieldValue
+      |> Ash.Query.filter(expr(custom_field_id in ^custom_field_ids))
+      |> Ash.Query.load(custom_field: [:id, :name, :value_type])
+
+    Ash.Query.load(query, custom_field_values: cfv_query)
+  end
+
+  defp apply_search(query, nil), do: query
+  defp apply_search(query, ""), do: query
+
+  defp apply_search(query, q) when is_binary(q) do
+    if String.trim(q) != "" do
+      Member.fuzzy_search(query, %{query: q})
+    else
+      query
+    end
+  end
+
+  defp maybe_sort(query, nil, _order), do: {query, false}
+  defp maybe_sort(query, _field, nil), do: {query, false}
+
+  defp maybe_sort(query, field, order) when is_binary(field) do
+    if custom_field_sort?(field) do
+      {query, true}
+    else
+      field_atom = String.to_existing_atom(field)
+
+      if field_atom in (Mv.Constants.member_fields() -- [:notes]) do
+        {Ash.Query.sort(query, [{field_atom, String.to_existing_atom(order)}]), false}
+      else
+        {query, false}
+      end
+    end
+  rescue
+    ArgumentError -> {query, false}
+  end
+
+  defp sort_after_load?(field) when is_binary(field),
+    do: String.starts_with?(field, @custom_field_prefix)
+
+  defp sort_after_load?(_), do: false
+
+  defp sort_members_by_custom_field(members, _field, _order, _custom_fields) when members == [],
+    do: []
+
+  defp sort_members_by_custom_field(members, field, order, custom_fields) when is_binary(field) do
+    id_str = String.trim_leading(field, @custom_field_prefix)
+    custom_field = Enum.find(custom_fields, fn cf -> to_string(cf.id) == id_str end)
+    if is_nil(custom_field), do: members
+
+    key_fn = fn member ->
+      cfv = find_cfv(member, custom_field)
+      raw = if cfv, do: cfv.value, else: nil
+      MemberExportSort.custom_field_sort_key(custom_field.value_type, raw)
+    end
+
+    members
+    |> Enum.map(fn m -> {m, key_fn.(m)} end)
+    |> Enum.sort(fn {_, ka}, {_, kb} -> MemberExportSort.key_lt(ka, kb, order) end)
+    |> Enum.map(fn {m, _} -> m end)
+  end
+
+  defp find_cfv(member, custom_field) do
+    (member.custom_field_values || [])
+    |> Enum.find(fn cfv ->
+      to_string(cfv.custom_field_id) == to_string(custom_field.id) or
+        (Map.get(cfv, :custom_field) &&
+           to_string(cfv.custom_field.id) == to_string(custom_field.id))
+    end)
+  end
+
+  defp custom_field_sort?(field), do: String.starts_with?(field, @custom_field_prefix)
+
+  defp maybe_load_cycles(query, false, _show_current), do: query
+
+  defp maybe_load_cycles(query, true, show_current) do
+    MembershipFeeStatus.load_cycles_for_members(query, show_current)
+  end
+
+  defp apply_cycle_status_filter(members, nil, _show_current), do: members
+
+  defp apply_cycle_status_filter(members, status, show_current) when status in [:paid, :unpaid] do
+    MembershipFeeStatus.filter_members_by_cycle_status(members, status, show_current)
+  end
+
+  defp apply_cycle_status_filter(members, _status, _show_current), do: members
+
+  defp add_computed_fields(members, computed_fields, show_current_cycle) do
+    computed_fields = computed_fields || []
+
+    if "membership_fee_status" in computed_fields do
+      Enum.map(members, fn member ->
+        status = MembershipFeeStatus.get_cycle_status_for_member(member, show_current_cycle)
+        # <= Atom rein
+        Map.put(member, :membership_fee_status, status)
+      end)
+    else
+      members
+    end
+  end
+
+  # Called by controller to build parsed map from raw params (kept here so controller stays thin)
+  @doc """
+  Parses and validates export params (from JSON payload).
+
+  Returns a map with :selected_ids, :member_fields, :selectable_member_fields,
+  :computed_fields, :custom_field_ids, :query, :sort_field, :sort_order,
+  :show_current_cycle, :cycle_status_filter, :boolean_filters.
+  """
+  @spec parse_params(map()) :: map()
+  def parse_params(params) do
+    # DB fields come from "member_fields"
+    raw_member_fields = extract_list(params, "member_fields")
+    member_fields = filter_allowed_member_fields(raw_member_fields)
+
+    # computed fields can come from "computed_fields" (new payload) OR legacy inclusion in member_fields
+    computed_fields =
+      (extract_list(params, "computed_fields") ++ member_fields)
+      |> normalize_computed_fields()
+      |> Enum.filter(&(&1 in @computed_export_fields))
+      |> Enum.uniq()
+
+    # selectable DB fields: only real domain member fields, ordered like the table
+    selectable_member_fields =
+      member_fields
+      |> Enum.filter(&(&1 in @domain_member_field_strings))
+      |> order_member_fields_like_table()
+
+    # final member_fields list (used for column specs order): table order + computed inserted
+    ordered_member_fields =
+      selectable_member_fields
+      |> insert_computed_fields_like_table(computed_fields)
+
+    %{
+      selected_ids: filter_valid_uuids(extract_list(params, "selected_ids")),
+      member_fields: ordered_member_fields,
+      selectable_member_fields: selectable_member_fields,
+      computed_fields: computed_fields,
+      custom_field_ids: filter_valid_uuids(extract_list(params, "custom_field_ids")),
+      query: extract_string(params, "query"),
+      sort_field: extract_string(params, "sort_field"),
+      sort_order: extract_sort_order(params),
+      show_current_cycle: extract_boolean(params, "show_current_cycle"),
+      cycle_status_filter: extract_cycle_status_filter(params),
+      boolean_filters: extract_boolean_filters(params)
+    }
+  end
+
+  defp extract_boolean(params, key) do
+    case Map.get(params, key) do
+      true -> true
+      "true" -> true
+      _ -> false
+    end
+  end
+
+  defp extract_cycle_status_filter(params) do
+    case Map.get(params, "cycle_status_filter") do
+      "paid" -> :paid
+      "unpaid" -> :unpaid
+      _ -> nil
+    end
+  end
+
+  defp extract_boolean_filters(params) do
+    case Map.get(params, "boolean_filters") do
+      map when is_map(map) ->
+        map
+        |> Enum.filter(fn {k, v} ->
+          is_binary(k) and is_boolean(v) and match?({:ok, _}, Ecto.UUID.cast(k))
+        end)
+        |> Enum.into(%{})
+
+      _ ->
+        %{}
+    end
+  end
+
+  defp extract_list(params, key) do
+    case Map.get(params, key) do
+      list when is_list(list) -> list
+      _ -> []
+    end
+  end
+
+  defp extract_string(params, key) do
+    case Map.get(params, key) do
+      s when is_binary(s) -> s
+      _ -> nil
+    end
+  end
+
+  defp extract_sort_order(params) do
+    case Map.get(params, "sort_order") do
+      "asc" -> "asc"
+      "desc" -> "desc"
+      _ -> nil
+    end
+  end
+
+  defp filter_allowed_member_fields(field_list) do
+    allowlist = MapSet.new(@member_fields_allowlist)
+
+    field_list
+    |> Enum.filter(fn field -> is_binary(field) and MapSet.member?(allowlist, field) end)
+    |> Enum.uniq()
+  end
+
+  defp filter_valid_uuids(id_list) when is_list(id_list) do
+    id_list
+    |> Enum.filter(fn id ->
+      is_binary(id) and match?({:ok, _}, Ecto.UUID.cast(id))
+    end)
+    |> Enum.uniq()
+  end
+
+  defp order_member_fields_like_table(fields) when is_list(fields) do
+    table_order = Mv.Constants.member_fields() |> Enum.map(&Atom.to_string/1)
+    table_order |> Enum.filter(&(&1 in fields))
+  end
+
+  defp insert_computed_fields_like_table(db_fields_ordered, computed_fields) do
+    # Insert membership_fee_status right after membership_fee_start_date (if both selected),
+    # otherwise append at the end of DB fields.
+    computed_fields = computed_fields || []
+
+    db_with_insert =
+      Enum.flat_map(db_fields_ordered, fn f ->
+        if f == @computed_insert_after and "membership_fee_status" in computed_fields do
+          [f, "membership_fee_status"]
+        else
+          [f]
+        end
+      end)
+
+    remaining =
+      computed_fields
+      |> Enum.reject(&(&1 in db_with_insert))
+
+    db_with_insert ++ remaining
+  end
+
+  defp normalize_computed_fields(fields) when is_list(fields) do
+    fields
+    |> Enum.filter(&is_binary/1)
+    |> Enum.map(fn
+      "payment_status" -> "membership_fee_status"
+      other -> other
+    end)
+  end
+
+  defp normalize_computed_fields(_), do: []
+end

lib/mv/membership/member_export_sort.ex

@@ -0,0 +1,44 @@
+defmodule Mv.Membership.MemberExportSort do
+  @moduledoc """
+  Type-stable sort keys for CSV export custom-field sorting.
+
+  Used only by `MvWeb.MemberExportController` when sorting members by a custom field
+  after load. Nil values sort last in ascending order and first in descending order.
+  String and email comparison is case-insensitive.
+  """
+  @doc """
+  Returns a comparable sort key for (value_type, value).
+
+  - Nil: rank 1 so that in asc order nil sorts last, in desc nil sorts first.
+  - date: chronological (ISO8601 string).
+  - boolean: false < true (0 < 1).
+  - integer: numerical order.
+  - string / email: case-insensitive (downcased).
+
+  Handles Ash.Union in value; value_type is the custom field's value_type atom.
+  """
+  @spec custom_field_sort_key(:string | :integer | :boolean | :date | :email, term()) ::
+          {0 | 1, term()}
+  def custom_field_sort_key(_value_type, nil), do: {1, nil}
+
+  def custom_field_sort_key(value_type, %Ash.Union{value: value, type: _type}) do
+    custom_field_sort_key(value_type, value)
+  end
+
+  def custom_field_sort_key(:date, %Date{} = d), do: {0, Date.to_iso8601(d)}
+  def custom_field_sort_key(:boolean, true), do: {0, 1}
+  def custom_field_sort_key(:boolean, false), do: {0, 0}
+  def custom_field_sort_key(:integer, v) when is_integer(v), do: {0, v}
+  def custom_field_sort_key(:string, v) when is_binary(v), do: {0, String.downcase(v)}
+  def custom_field_sort_key(:email, v) when is_binary(v), do: {0, String.downcase(v)}
+  def custom_field_sort_key(_value_type, v), do: {0, to_string(v)}
+
+  @doc """
+  Returns true if key_a should sort before key_b for the given order.
+
+  "asc" -> nil last; "desc" -> nil first. No reverse of list needed.
+  """
+  @spec key_lt({0 | 1, term()}, {0 | 1, term()}, String.t()) :: boolean()
+  def key_lt(key_a, key_b, "asc"), do: key_a < key_b
+  def key_lt(key_a, key_b, "desc"), do: key_b < key_a
+end

lib/mv/membership/members_csv.ex

@@ -0,0 +1,100 @@
+defmodule Mv.Membership.MembersCSV do
+  @moduledoc """
+  Exports members to CSV (RFC 4180) as iodata.
+
+  Uses a column-based API: `export(members, columns)` where each column has
+  `header` (display string, e.g. from Web layer), `kind` (:member_field | :custom_field | :computed),
+  and `key` (member attribute name, custom_field id, or computed key). Custom field columns
+  include a `custom_field` struct for value formatting. Domain code does not use Gettext;
+  headers and computed values come from the caller (e.g. controller).
+  """
+  alias Mv.Membership.CustomFieldValueFormatter
+  alias NimbleCSV.RFC4180
+
+  @doc """
+  Exports a list of members to CSV iodata.
+
+  - `members` - List of member structs or maps (with optional `custom_field_values` loaded)
+  - `columns` - List of column specs: `%{header: String.t(), kind: :member_field | :custom_field | :computed, key: term()}`
+    For `:custom_field`, also pass `custom_field: %CustomField{}`. Header is used as-is (localized by caller).
+
+  Returns iodata suitable for `IO.iodata_to_binary/1` or sending as response body.
+  RFC 4180 escaping and formula-injection safe_cell are applied.
+  """
+  @spec export([struct() | map()], [map()]) :: iodata()
+  def export(members, columns) when is_list(members) do
+    header = build_header(columns)
+    rows = Enum.map(members, fn member -> build_row(member, columns) end)
+    RFC4180.dump_to_iodata([header | rows])
+  end
+
+  defp build_header(columns) do
+    columns
+    |> Enum.map(fn col -> col.header end)
+    |> Enum.map(&safe_cell/1)
+  end
+
+  defp build_row(member, columns) do
+    columns
+    |> Enum.map(fn col -> cell_value(member, col) end)
+    |> Enum.map(&safe_cell/1)
+  end
+
+  defp cell_value(member, %{kind: :member_field, key: key}) do
+    key_atom = key_to_atom(key)
+    value = Map.get(member, key_atom)
+    format_member_value(value)
+  end
+
+  defp cell_value(member, %{kind: :custom_field, key: id, custom_field: cf}) do
+    cfv = get_cfv_by_id(member, id)
+
+    if cfv,
+      do: CustomFieldValueFormatter.format_custom_field_value(cfv.value, cf),
+      else: ""
+  end
+
+  defp cell_value(member, %{kind: :computed, key: key}) do
+    value = Map.get(member, key_to_atom(key))
+    if is_binary(value), do: value, else: ""
+  end
+
+  defp key_to_atom(k) when is_atom(k), do: k
+
+  defp key_to_atom(k) when is_binary(k) do
+    try do
+      String.to_existing_atom(k)
+    rescue
+      ArgumentError -> k
+    end
+  end
+
+  defp get_cfv_by_id(member, id) do
+    values =
+      case Map.get(member, :custom_field_values) do
+        v when is_list(v) -> v
+        _ -> []
+      end
+
+    id_str = to_string(id)
+
+    Enum.find(values, fn cfv ->
+      to_string(cfv.custom_field_id) == id_str or
+        (Map.get(cfv, :custom_field) && to_string(cfv.custom_field.id) == id_str)
+    end)
+  end
+
+  @doc false
+  @spec safe_cell(String.t()) :: String.t()
+  def safe_cell(s) when is_binary(s) do
+    if String.starts_with?(s, ["=", "+", "-", "@", "\t"]), do: "'" <> s, else: s
+  end
+
+  defp format_member_value(nil), do: ""
+  defp format_member_value(true), do: "true"
+  defp format_member_value(false), do: "false"
+  defp format_member_value(%Date{} = d), do: Date.to_iso8601(d)
+  defp format_member_value(%DateTime{} = dt), do: DateTime.to_iso8601(dt)
+  defp format_member_value(%NaiveDateTime{} = dt), do: NaiveDateTime.to_iso8601(dt)
+  defp format_member_value(value), do: to_string(value)
+end

lib/mv/oidc_role_sync.ex

@@ -0,0 +1,148 @@
+defmodule Mv.OidcRoleSync do
+  @moduledoc """
+  Syncs user role from OIDC user_info (e.g. groups claim → Admin role).
+
+  Used after OIDC registration (register_with_rauthy) and on sign-in so that
+  users in the configured admin group get the Admin role; others get Mitglied.
+  Configure via OIDC_ADMIN_GROUP_NAME and OIDC_GROUPS_CLAIM (see OidcRoleSyncConfig).
+
+  Groups are read from user_info (ID token claims) first; if missing or empty,
+  the access_token from oauth_tokens is decoded as JWT and the groups claim is
+  read from there (e.g. Rauthy puts groups in the access token when scope
+  includes "groups").
+
+  ## JWT access token (security)
+
+  The access_token payload is read without signature verification (peek only).
+  We rely on the fact that `oauth_tokens` is only ever passed from the
+  verified OIDC callback (Assent/AshAuthentication after provider token
+  exchange). If callers passed untrusted or tampered tokens, group claims
+  could be forged and a user could be assigned the Admin role. Therefore:
+  do not call this module with user-supplied tokens; it is intended only
+  for the internal flow from the OIDC callback.
+  """
+  alias Mv.Accounts.User
+  alias Mv.Authorization.Role
+  alias Mv.OidcRoleSyncConfig
+
+  @doc """
+  Applies Admin or Mitglied role to the user based on OIDC groups claim.
+
+  - If OIDC_ADMIN_GROUP_NAME is not configured: no-op, returns :ok without changing the user.
+  - If groups (from user_info or access_token) contain the configured admin group: assigns Admin role.
+  - Otherwise: assigns Mitglied role (downgrade if user was Admin).
+
+  user_info is a map (e.g. from ID token claims); oauth_tokens is optional and may
+  contain "access_token" (JWT) from which the groups claim is read when not in user_info.
+  """
+  @spec apply_admin_role_from_user_info(User.t(), map(), map() | nil) :: :ok
+  def apply_admin_role_from_user_info(user, user_info, oauth_tokens \\ nil)
+      when is_map(user_info) do
+    admin_group = OidcRoleSyncConfig.oidc_admin_group_name()
+
+    if is_nil(admin_group) or admin_group == "" do
+      :ok
+    else
+      claim = OidcRoleSyncConfig.oidc_groups_claim()
+      groups = groups_from_user_info(user_info, claim)
+
+      groups =
+        if Enum.empty?(groups), do: groups_from_access_token(oauth_tokens, claim), else: groups
+
+      target_role = if admin_group in groups, do: :admin, else: :mitglied
+      set_user_role(user, target_role)
+    end
+  end
+
+  defp groups_from_user_info(user_info, claim) do
+    value = user_info[claim] || user_info[String.to_existing_atom(claim)]
+    normalize_groups(value)
+  rescue
+    ArgumentError -> normalize_groups(user_info[claim])
+  end
+
+  defp groups_from_access_token(nil, _claim), do: []
+  defp groups_from_access_token(oauth_tokens, _claim) when not is_map(oauth_tokens), do: []
+
+  defp groups_from_access_token(oauth_tokens, claim) do
+    access_token = oauth_tokens["access_token"] || oauth_tokens[:access_token]
+
+    if is_binary(access_token) do
+      case peek_jwt_claims(access_token) do
+        {:ok, claims} ->
+          value = claims[claim] || safe_get_atom(claims, claim)
+          normalize_groups(value)
+
+        _ ->
+          []
+      end
+    else
+      []
+    end
+  end
+
+  defp safe_get_atom(map, key) when is_binary(key) do
+    try do
+      Map.get(map, String.to_existing_atom(key))
+    rescue
+      ArgumentError -> nil
+    end
+  end
+
+  defp safe_get_atom(_map, _key), do: nil
+
+  defp peek_jwt_claims(token) do
+    parts = String.split(token, ".")
+
+    if length(parts) == 3 do
+      [_h, payload_b64, _sig] = parts
+
+      case Base.url_decode64(payload_b64, padding: false) do
+        {:ok, payload} -> Jason.decode(payload)
+        _ -> :error
+      end
+    else
+      :error
+    end
+  end
+
+  defp normalize_groups(nil), do: []
+  defp normalize_groups(list) when is_list(list), do: Enum.map(list, &to_string/1)
+  defp normalize_groups(single) when is_binary(single), do: [single]
+  defp normalize_groups(_), do: []
+
+  defp set_user_role(user, :admin) do
+    case Role.get_admin_role() do
+      {:ok, %Role{} = role} ->
+        do_set_role(user, role)
+
+      _ ->
+        :ok
+    end
+  end
+
+  defp set_user_role(user, :mitglied) do
+    case Role.get_mitglied_role() do
+      {:ok, %Role{} = role} ->
+        do_set_role(user, role)
+
+      _ ->
+        :ok
+    end
+  end
+
+  defp do_set_role(user, role) do
+    if user.role_id == role.id do
+      :ok
+    else
+      user
+      |> Ash.Changeset.for_update(:set_role_from_oidc_sync, %{role_id: role.id})
+      |> Ash.Changeset.set_context(%{private: %{oidc_role_sync: true}})
+      |> Ash.update(domain: Mv.Accounts, context: %{private: %{oidc_role_sync: true}})
+      |> case do
+        {:ok, _} -> :ok
+        {:error, _} -> :ok
+      end
+    end
+  end
+end

lib/mv/oidc_role_sync_config.ex

@@ -0,0 +1,24 @@
+defmodule Mv.OidcRoleSyncConfig do
+  @moduledoc """
+  Runtime configuration for OIDC group → role sync (e.g. admin group → Admin role).
+
+  Reads from Application config `:mv, :oidc_role_sync`:
+  - `:admin_group_name` – OIDC group name that maps to Admin role (optional; when nil, no sync).
+  - `:groups_claim` – JWT/user_info claim name for groups (default: `"groups"`).
+
+  Set via ENV in production: OIDC_ADMIN_GROUP_NAME, OIDC_GROUPS_CLAIM (see config/runtime.exs).
+  """
+  @doc "Returns the OIDC group name that maps to Admin role, or nil if not configured."
+  def oidc_admin_group_name do
+    get(:admin_group_name)
+  end
+
+  @doc "Returns the JWT/user_info claim name for groups; defaults to \"groups\"."
+  def oidc_groups_claim do
+    get(:groups_claim) || "groups"
+  end
+
+  defp get(key) do
+    Application.get_env(:mv, :oidc_role_sync, []) |> Keyword.get(key)
+  end
+end

lib/mv/release.ex

@@ -2,9 +2,22 @@ defmodule Mv.Release do
   @moduledoc """
   Used for executing DB release tasks when run in production without Mix
   installed.
+
+  ## Tasks
+
+  - `migrate/0` - Runs all pending Ecto migrations.
+  - `seed_admin/0` - Ensures an admin user exists from ENV (ADMIN_EMAIL, ADMIN_PASSWORD
+    or ADMIN_PASSWORD_FILE). Idempotent; can be run on every deployment or via shell
+    to update the admin password without redeploying.
   """
   @app :mv
 
+  alias Mv.Accounts
+  alias Mv.Accounts.User
+  alias Mv.Authorization.Role
+
+  require Ash.Query
+
   def migrate do
     load_app()
 
@@ -18,6 +31,158 @@ defmodule Mv.Release do
     {:ok, _, _} = Ecto.Migrator.with_repo(repo, &Ecto.Migrator.run(&1, :down, to: version))
   end
 
+  @doc """
+  Ensures an admin user exists from ENV (ADMIN_EMAIL, ADMIN_PASSWORD or ADMIN_PASSWORD_FILE).
+
+  Starts the application if not already running (required when called via `bin/mv eval`;
+  Ash/Telemetry need the running app). Idempotent.
+
+  - If ADMIN_EMAIL is unset: no-op (idempotent).
+  - If ADMIN_PASSWORD (and ADMIN_PASSWORD_FILE) are unset and the user does not exist:
+    no user is created (no fallback password in production).
+  - If both ADMIN_EMAIL and ADMIN_PASSWORD are set: creates or updates the user with
+    Admin role and the given password. Safe to run on every deployment or via
+    `bin/mv eval "Mv.Release.seed_admin()"` to change the admin password without redeploying.
+  """
+  def seed_admin do
+    # Ensure app (and Telemetry/Ash deps) are started when run via bin/mv eval
+    case Application.ensure_all_started(@app) do
+      {:ok, _} -> :ok
+      {:error, {app, reason}} -> raise "Failed to start #{inspect(app)}: #{inspect(reason)}"
+    end
+
+    admin_email = get_env("ADMIN_EMAIL", nil)
+    admin_password = get_env_or_file("ADMIN_PASSWORD", nil)
+
+    cond do
+      is_nil(admin_email) or admin_email == "" ->
+        :ok
+
+      is_nil(admin_password) or admin_password == "" ->
+        ensure_admin_role_only(admin_email)
+
+      true ->
+        ensure_admin_user(admin_email, admin_password)
+    end
+  end
+
+  defp ensure_admin_role_only(email) do
+    case Role.get_admin_role() do
+      {:ok, nil} ->
+        :ok
+
+      {:ok, %Role{} = admin_role} ->
+        case get_user_by_email(email) do
+          {:ok, %User{} = user} ->
+            user
+            |> Ash.Changeset.for_update(:update, %{})
+            |> Ash.Changeset.manage_relationship(:role, admin_role, type: :append_and_remove)
+            |> Ash.update!(authorize?: false)
+
+            :ok
+
+          _ ->
+            :ok
+        end
+
+      {:error, _} ->
+        :ok
+    end
+  end
+
+  defp ensure_admin_user(email, password) do
+    if is_nil(password) or password == "" do
+      :ok
+    else
+      do_ensure_admin_user(email, password)
+    end
+  end
+
+  defp do_ensure_admin_user(email, password) do
+    case Role.get_admin_role() do
+      {:ok, nil} ->
+        # Admin role does not exist (e.g. migrations not run); skip
+        :ok
+
+      {:ok, %Role{} = admin_role} ->
+        case get_user_by_email(email) do
+          {:ok, nil} ->
+            create_admin_user(email, password, admin_role)
+
+          {:ok, user} ->
+            update_admin_user(user, password, admin_role)
+
+          {:error, _} ->
+            :ok
+        end
+
+      {:error, _} ->
+        :ok
+    end
+  end
+
+  defp create_admin_user(email, password, admin_role) do
+    case Accounts.create_user(%{email: email}, authorize?: false) do
+      {:ok, user} ->
+        user
+        |> Ash.Changeset.for_update(:admin_set_password, %{password: password})
+        |> Ash.update!(authorize?: false)
+        |> then(fn u ->
+          u
+          |> Ash.Changeset.for_update(:update, %{})
+          |> Ash.Changeset.manage_relationship(:role, admin_role, type: :append_and_remove)
+          |> Ash.update!(authorize?: false)
+        end)
+
+        :ok
+
+      {:error, _} ->
+        :ok
+    end
+  end
+
+  defp update_admin_user(user, password, admin_role) do
+    user
+    |> Ash.Changeset.for_update(:admin_set_password, %{password: password})
+    |> Ash.update!(authorize?: false)
+    |> then(fn u ->
+      u
+      |> Ash.Changeset.for_update(:update, %{})
+      |> Ash.Changeset.manage_relationship(:role, admin_role, type: :append_and_remove)
+      |> Ash.update!(authorize?: false)
+    end)
+
+    :ok
+  end
+
+  defp get_user_by_email(email) do
+    User
+    |> Ash.Query.filter(email == ^email)
+    |> Ash.read_one(authorize?: false, domain: Mv.Accounts)
+  end
+
+  defp get_env(key, default) do
+    System.get_env(key, default)
+  end
+
+  defp get_env_or_file(var_name, default) do
+    file_var = "#{var_name}_FILE"
+
+    case System.get_env(file_var) do
+      nil ->
+        System.get_env(var_name, default)
+
+      file_path ->
+        case File.read(file_path) do
+          {:ok, content} ->
+            String.trim_trailing(content)
+
+          {:error, _} ->
+            default
+        end
+    end
+  end
+
   defp repos do
     Application.fetch_env!(@app, :ecto_repos)
   end

lib/mv_web/authorization.ex

@@ -97,12 +97,18 @@ defmodule MvWeb.Authorization do
   @doc """
   Checks if user can access a specific page.
 
+  Nil-safe: returns false when user is nil (e.g. unauthenticated or layout
+  assigns regression), so callers do not need to guard.
+
   ## Examples
 
       iex> admin = %{role: %{permission_set_name: "admin"}}
       iex> can_access_page?(admin, "/admin/roles")
       true
 
+      iex> can_access_page?(nil, "/members")
+      false
+
       iex> mitglied = %{role: %{permission_set_name: "own_data"}}
       iex> can_access_page?(mitglied, "/members")
       false

lib/mv_web/components/core_components.ex

@@ -97,12 +97,13 @@ defmodule MvWeb.CoreComponents do
       <.button navigate={~p"/"}>Home</.button>
       <.button disabled={true}>Disabled</.button>
   """
-  attr :rest, :global, include: ~w(href navigate patch method)
+  attr :rest, :global, include: ~w(href navigate patch method data-testid)
   attr :variant, :string, values: ~w(primary)
   attr :disabled, :boolean, default: false, doc: "Whether the button is disabled"
   slot :inner_block, required: true
 
-  def button(%{rest: rest} = assigns) do
+  def button(assigns) do
+    rest = assigns.rest
     variants = %{"primary" => "btn-primary", nil => "btn-primary btn-soft"}
     assigns = assign(assigns, :class, Map.fetch!(variants, assigns[:variant]))
 
@@ -178,7 +179,8 @@ defmodule MvWeb.CoreComponents do
         aria-haspopup="menu"
         aria-expanded={@open}
         aria-controls={@id}
-        class="btn"
+        aria-label={@button_label}
+        class="btn focus:outline-none focus-visible:ring-2 focus-visible:ring-offset-2 focus-visible:ring-base-content/20"
         phx-click="toggle_dropdown"
         phx-target={@phx_target}
         data-testid="dropdown-button"
@@ -232,11 +234,12 @@ defmodule MvWeb.CoreComponents do
             <button
               type="button"
               role={if @checkboxes, do: "menuitemcheckbox", else: "menuitem"}
+              aria-label={item.label}
               aria-checked={
                 if @checkboxes, do: to_string(Map.get(@selected, item.value, true)), else: nil
               }
               tabindex="0"
-              class="flex items-center gap-2 px-2 py-1 rounded cursor-pointer hover:bg-base-200 w-full text-left"
+              class="flex items-center gap-2 px-2 py-1 rounded cursor-pointer hover:bg-base-200 w-full text-left focus:outline-none focus-visible:ring-2 focus-visible:ring-base-content/20 focus-visible:ring-inset"
               phx-click="select_item"
               phx-keydown="select_item"
               phx-key="Enter"
@@ -247,7 +250,7 @@ defmodule MvWeb.CoreComponents do
                 <input
                   type="checkbox"
                   checked={Map.get(@selected, item.value, true)}
-                  class="checkbox checkbox-sm checkbox-primary"
+                  class="checkbox checkbox-sm checkbox-primary pointer-events-none"
                   tabindex="-1"
                   aria-hidden="true"
                 />
@@ -544,6 +547,9 @@ defmodule MvWeb.CoreComponents do
     attr :label, :string
     attr :class, :string
     attr :col_click, :any, doc: "optional column-specific click handler that overrides row_click"
+
+    attr :sort_field, :any,
+      doc: "optional; when equal to table sort_field, aria-sort is set on this th"
   end
 
   slot :action, doc: "the slot for showing user actions in the last table column"
@@ -559,7 +565,13 @@ defmodule MvWeb.CoreComponents do
       <table class="table table-zebra">
         <thead>
           <tr>
-            <th :for={col <- @col} class={Map.get(col, :class)}>{col[:label]}</th>
+            <th
+              :for={col <- @col}
+              class={Map.get(col, :class)}
+              aria-sort={table_th_aria_sort(col, @sort_field, @sort_order)}
+            >
+              {col[:label]}
+            </th>
             <th :for={dyn_col <- @dynamic_cols}>
               <.live_component
                 module={MvWeb.Components.SortHeaderComponent}
@@ -645,6 +657,16 @@ defmodule MvWeb.CoreComponents do
     """
   end
 
+  defp table_th_aria_sort(col, sort_field, sort_order) do
+    col_sort = Map.get(col, :sort_field)
+
+    if not is_nil(col_sort) and col_sort == sort_field and sort_order in [:asc, :desc] do
+      if sort_order == :asc, do: "ascending", else: "descending"
+    else
+      nil
+    end
+  end
+
   @doc """
   Renders a data list.
 

lib/mv_web/components/layouts/sidebar.ex

@@ -4,6 +4,8 @@ defmodule MvWeb.Layouts.Sidebar do
   """
   use MvWeb, :html
 
+  alias MvWeb.PagePaths
+
   attr :current_user, :map, default: nil, doc: "The current user"
   attr :club_name, :string, required: true, doc: "The name of the club"
   attr :mobile, :boolean, default: false, doc: "Whether this is mobile view"
@@ -70,33 +72,57 @@ defmodule MvWeb.Layouts.Sidebar do
   defp sidebar_menu(assigns) do
     ~H"""
     <ul class="menu flex-1 w-full p-2" role="menubar">
+      <%= if can_access_page?(@current_user, PagePaths.members()) do %>
         <.menu_item
           href={~p"/members"}
           icon="hero-users"
           label={gettext("Members")}
         />
+      <% end %>
 
+      <%= if can_access_page?(@current_user, PagePaths.membership_fee_types()) do %>
         <.menu_item
           href={~p"/membership_fee_types"}
           icon="hero-currency-euro"
           label={gettext("Fee Types")}
         />
+      <% end %>
 
-    <!-- Nested Admin Menu -->
-      <.menu_group icon="hero-cog-6-tooth" label={gettext("Administration")}>
+      <%= if admin_menu_visible?(@current_user) do %>
+        <.menu_group
+          icon="hero-cog-6-tooth"
+          label={gettext("Administration")}
+          testid="sidebar-administration"
+        >
+          <%= if can_access_page?(@current_user, PagePaths.users()) do %>
             <.menu_subitem href={~p"/users"} label={gettext("Users")} />
+          <% end %>
+          <%= if can_access_page?(@current_user, PagePaths.groups()) do %>
             <.menu_subitem href={~p"/groups"} label={gettext("Groups")} />
+          <% end %>
+          <%= if can_access_page?(@current_user, PagePaths.admin_roles()) do %>
             <.menu_subitem href={~p"/admin/roles"} label={gettext("Roles")} />
+          <% end %>
+          <%= if can_access_page?(@current_user, PagePaths.membership_fee_settings()) do %>
             <.menu_subitem
               href={~p"/membership_fee_settings"}
               label={gettext("Fee Settings")}
             />
+          <% end %>
+          <%= if can_access_page?(@current_user, PagePaths.settings()) do %>
+            <.menu_subitem href={~p"/admin/import-export"} label={gettext("Import/Export")} />
             <.menu_subitem href={~p"/settings"} label={gettext("Settings")} />
+          <% end %>
         </.menu_group>
+      <% end %>
     </ul>
     """
   end
 
+  defp admin_menu_visible?(user) do
+    Enum.any?(PagePaths.admin_menu_paths(), &can_access_page?(user, &1))
+  end
+
   attr :href, :string, required: true, doc: "Navigation path"
   attr :icon, :string, required: true, doc: "Heroicon name"
   attr :label, :string, required: true, doc: "Menu item label"
@@ -119,12 +145,13 @@ defmodule MvWeb.Layouts.Sidebar do
 
   attr :icon, :string, required: true, doc: "Heroicon name for the menu group"
   attr :label, :string, required: true, doc: "Menu group label"
+  attr :testid, :string, default: nil, doc: "data-testid for stable test selectors"
   slot :inner_block, required: true, doc: "Submenu items"
 
   defp menu_group(assigns) do
     ~H"""
     <!-- Expanded Mode: Always open div structure -->
-    <li role="none" class="expanded-menu-group">
+    <li role="none" class="expanded-menu-group" data-testid={@testid}>
       <div
         class="flex items-center gap-3"
         role="group"
@@ -138,7 +165,7 @@ defmodule MvWeb.Layouts.Sidebar do
       </ul>
     </li>
     <!-- Collapsed Mode: Dropdown -->
-    <div class="collapsed-menu-group dropdown dropdown-right">
+    <div class="collapsed-menu-group dropdown dropdown-right" data-testid={@testid}>
       <button
         type="button"
         tabindex="0"

lib/mv_web/components/table_components.ex

@@ -20,7 +20,6 @@ defmodule MvWeb.TableComponents do
       type="button"
       phx-click="sort"
       phx-value-field={@field}
-      aria-sort={aria_sort(@sort_field, @sort_order, @field)}
       class="flex items-center gap-1 hover:underline focus:outline-none"
     >
       <span>{@label}</span>
@@ -33,12 +32,4 @@ defmodule MvWeb.TableComponents do
     </button>
     """
   end
-
-  defp aria_sort(current_field, current_order, this_field) do
-    cond do
-      current_field != this_field -> "none"
-      current_order == :asc -> "ascending"
-      true -> "descending"
-    end
-  end
 end

lib/mv_web/controllers/member_export_controller.ex

@@ -0,0 +1,519 @@
+defmodule MvWeb.MemberExportController do
+  @moduledoc """
+  Controller for CSV export of members.
+
+  POST /members/export.csv with form param "payload" (JSON string).
+  Same permission and actor context as the member overview; 403 if unauthorized.
+  """
+  use MvWeb, :controller
+
+  require Ash.Query
+  import Ash.Expr
+
+  alias Mv.Authorization.Actor
+  alias Mv.Membership.CustomField
+  alias Mv.Membership.Member
+  alias Mv.Membership.MembersCSV
+  alias MvWeb.Translations.MemberFields
+  alias MvWeb.MemberLive.Index.MembershipFeeStatus
+  use Gettext, backend: MvWeb.Gettext
+
+  @member_fields_allowlist Mv.Constants.member_fields() |> Enum.map(&Atom.to_string/1)
+  @computed_export_fields ["membership_fee_status"]
+  @custom_field_prefix Mv.Constants.custom_field_prefix()
+
+  def export(conn, params) do
+    actor = current_actor(conn)
+    if is_nil(actor), do: return_forbidden(conn)
+
+    case params["payload"] do
+      nil ->
+        conn
+        |> put_status(400)
+        |> put_resp_content_type("application/json")
+        |> json(%{error: "payload required"})
+
+      payload when is_binary(payload) ->
+        case Jason.decode(payload) do
+          {:ok, decoded} when is_map(decoded) ->
+            parsed = parse_and_validate(decoded)
+            run_export(conn, actor, parsed)
+
+          _ ->
+            conn
+            |> put_status(400)
+            |> put_resp_content_type("application/json")
+            |> json(%{error: "invalid JSON"})
+        end
+    end
+  end
+
+  defp current_actor(conn) do
+    conn.assigns[:current_user]
+    |> Actor.ensure_loaded()
+  end
+
+  defp return_forbidden(conn) do
+    conn
+    |> put_status(403)
+    |> put_resp_content_type("application/json")
+    |> json(%{error: "Forbidden"})
+    |> halt()
+  end
+
+  defp parse_and_validate(params) do
+    member_fields = filter_allowed_member_fields(extract_list(params, "member_fields"))
+    {selectable_member_fields, computed_fields} = split_member_fields(member_fields)
+
+    %{
+      selected_ids: filter_valid_uuids(extract_list(params, "selected_ids")),
+      member_fields: member_fields,
+      selectable_member_fields: selectable_member_fields,
+      computed_fields:
+        computed_fields ++ filter_existing_atoms(extract_list(params, "computed_fields")),
+      custom_field_ids: filter_valid_uuids(extract_list(params, "custom_field_ids")),
+      query: extract_string(params, "query"),
+      sort_field: extract_string(params, "sort_field"),
+      sort_order: extract_sort_order(params),
+      show_current_cycle: extract_boolean(params, "show_current_cycle")
+    }
+  end
+
+  defp split_member_fields(member_fields) do
+    domain_fields = Mv.Constants.member_fields() |> Enum.map(&Atom.to_string/1)
+    selectable = Enum.filter(member_fields, fn f -> f in domain_fields end)
+    computed = Enum.filter(member_fields, fn f -> f in @computed_export_fields end)
+    {selectable, computed}
+  end
+
+  defp extract_boolean(params, key) do
+    case Map.get(params, key) do
+      true -> true
+      "true" -> true
+      _ -> false
+    end
+  end
+
+  defp filter_existing_atoms(list) when is_list(list) do
+    list
+    |> Enum.filter(fn name ->
+      is_binary(name) and atom_exists?(name)
+    end)
+    |> Enum.uniq()
+  end
+
+  defp atom_exists?(name) do
+    try do
+      _ = String.to_existing_atom(name)
+      true
+    rescue
+      ArgumentError -> false
+    end
+  end
+
+  defp extract_list(params, key) do
+    case Map.get(params, key) do
+      list when is_list(list) -> list
+      _ -> []
+    end
+  end
+
+  defp extract_string(params, key) do
+    case Map.get(params, key) do
+      s when is_binary(s) -> s
+      _ -> nil
+    end
+  end
+
+  defp extract_sort_order(params) do
+    case Map.get(params, "sort_order") do
+      "asc" -> "asc"
+      "desc" -> "desc"
+      _ -> nil
+    end
+  end
+
+  defp filter_allowed_member_fields(field_list) do
+    allowlist = MapSet.new(@member_fields_allowlist)
+
+    field_list
+    |> Enum.filter(fn field -> is_binary(field) and MapSet.member?(allowlist, field) end)
+    |> Enum.uniq()
+  end
+
+  defp filter_valid_uuids(id_list) when is_list(id_list) do
+    id_list
+    |> Enum.filter(fn id ->
+      is_binary(id) and match?({:ok, _}, Ecto.UUID.cast(id))
+    end)
+    |> Enum.uniq()
+  end
+
+  defp run_export(conn, actor, parsed) do
+    # FIX: Wenn nach einem Custom Field sortiert wird, muss dieses Feld geladen werden,
+    # auch wenn es nicht exportiert wird (sonst kann Export nicht korrekt sortieren).
+    parsed =
+      parsed
+      |> ensure_sort_custom_field_loaded()
+
+    with {:ok, custom_fields_by_id} <- load_custom_fields_by_id(parsed.custom_field_ids, actor),
+         {:ok, members} <- load_members_for_export(actor, parsed, custom_fields_by_id) do
+      columns = build_columns(conn, parsed, custom_fields_by_id)
+      csv_iodata = MembersCSV.export(members, columns)
+      filename = "members-#{Date.utc_today()}.csv"
+
+      send_download(
+        conn,
+        {:binary, IO.iodata_to_binary(csv_iodata)},
+        filename: filename,
+        content_type: "text/csv; charset=utf-8"
+      )
+    else
+      {:error, :forbidden} ->
+        return_forbidden(conn)
+    end
+  end
+
+  defp ensure_sort_custom_field_loaded(%{custom_field_ids: ids, sort_field: sort_field} = parsed) do
+    case extract_sort_custom_field_id(sort_field) do
+      nil ->
+        parsed
+
+      id ->
+        %{parsed | custom_field_ids: Enum.uniq([id | ids])}
+    end
+  end
+
+  defp extract_sort_custom_field_id(field) when is_binary(field) do
+    if String.starts_with?(field, @custom_field_prefix) do
+      String.trim_leading(field, @custom_field_prefix)
+    else
+      nil
+    end
+  end
+
+  defp extract_sort_custom_field_id(_), do: nil
+
+  defp load_custom_fields_by_id([], _actor), do: {:ok, %{}}
+
+  defp load_custom_fields_by_id(custom_field_ids, actor) do
+    query =
+      CustomField
+      |> Ash.Query.filter(expr(id in ^custom_field_ids))
+      |> Ash.Query.select([:id, :name, :value_type])
+
+    query
+    |> Ash.read(actor: actor)
+    |> handle_custom_fields_read_result(custom_field_ids)
+  end
+
+  defp handle_custom_fields_read_result({:ok, custom_fields}, custom_field_ids) do
+    by_id = build_custom_fields_by_id(custom_field_ids, custom_fields)
+    {:ok, by_id}
+  end
+
+  defp handle_custom_fields_read_result({:error, %Ash.Error.Forbidden{}}, _custom_field_ids) do
+    {:error, :forbidden}
+  end
+
+  defp build_custom_fields_by_id(custom_field_ids, custom_fields) do
+    Enum.reduce(custom_field_ids, %{}, fn id, acc ->
+      find_and_add_custom_field(acc, id, custom_fields)
+    end)
+  end
+
+  defp find_and_add_custom_field(acc, id, custom_fields) do
+    case Enum.find(custom_fields, fn cf -> to_string(cf.id) == to_string(id) end) do
+      nil -> acc
+      cf -> Map.put(acc, id, cf)
+    end
+  end
+
+  defp load_members_for_export(actor, parsed, custom_fields_by_id) do
+    select_fields = [:id] ++ Enum.map(parsed.selectable_member_fields, &String.to_existing_atom/1)
+
+    need_cycles =
+      parsed.computed_fields != [] and "membership_fee_status" in parsed.computed_fields
+
+    query =
+      Member
+      |> Ash.Query.new()
+      |> Ash.Query.select(select_fields)
+      |> load_custom_field_values_query(parsed.custom_field_ids)
+      |> maybe_load_cycles(need_cycles, parsed.show_current_cycle)
+
+    query =
+      if parsed.selected_ids != [] do
+        # selected export: filtert die Menge, aber die Sortierung muss trotzdem wie in der Tabelle angewandt werden
+        Ash.Query.filter(query, expr(id in ^parsed.selected_ids))
+      else
+        query
+        |> apply_search_export(parsed.query)
+      end
+
+    # FIX: Sortierung IMMER anwenden (auch bei selected_ids)
+    {query, sort_after_load} = maybe_sort_export(query, parsed.sort_field, parsed.sort_order)
+
+    case Ash.read(query, actor: actor) do
+      {:ok, members} ->
+        members =
+          if sort_after_load do
+            sort_members_by_custom_field_export(
+              members,
+              parsed.sort_field,
+              parsed.sort_order,
+              Map.values(custom_fields_by_id)
+            )
+          else
+            members
+          end
+
+        # Calculate membership_fee_status for computed fields
+        members = add_computed_fields(members, parsed.computed_fields, parsed.show_current_cycle)
+
+        {:ok, members}
+
+      {:error, %Ash.Error.Forbidden{}} ->
+        {:error, :forbidden}
+    end
+  end
+
+  defp maybe_load_cycles(query, false, _show_current), do: query
+
+  defp maybe_load_cycles(query, true, show_current) do
+    MembershipFeeStatus.load_cycles_for_members(query, show_current)
+  end
+
+  # Adds computed field values to members (e.g. membership_fee_status)
+  defp add_computed_fields(members, computed_fields, show_current_cycle) do
+    if "membership_fee_status" in computed_fields do
+      Enum.map(members, fn member ->
+        status = MembershipFeeStatus.get_cycle_status_for_member(member, show_current_cycle)
+        status_string = format_membership_fee_status(status)
+        Map.put(member, :membership_fee_status, status_string)
+      end)
+    else
+      members
+    end
+  end
+
+  # Formats membership fee status as German string
+  defp format_membership_fee_status(:paid), do: gettext("paid")
+  defp format_membership_fee_status(:unpaid), do: gettext("unpaid")
+  defp format_membership_fee_status(:suspended), do: gettext("suspended")
+  defp format_membership_fee_status(nil), do: ""
+
+  defp load_custom_field_values_query(query, []), do: query
+
+  defp load_custom_field_values_query(query, custom_field_ids) do
+    cfv_query =
+      Mv.Membership.CustomFieldValue
+      |> Ash.Query.filter(expr(custom_field_id in ^custom_field_ids))
+      |> Ash.Query.load(custom_field: [:id, :name, :value_type])
+
+    Ash.Query.load(query, custom_field_values: cfv_query)
+  end
+
+  defp apply_search_export(query, nil), do: query
+  defp apply_search_export(query, ""), do: query
+
+  defp apply_search_export(query, q) when is_binary(q) do
+    if String.trim(q) != "" do
+      Member.fuzzy_search(query, %{query: q})
+    else
+      query
+    end
+  end
+
+  defp maybe_sort_export(query, nil, _order), do: {query, false}
+  defp maybe_sort_export(query, _field, nil), do: {query, false}
+
+  defp maybe_sort_export(query, field, order) when is_binary(field) do
+    if custom_field_sort?(field) do
+      # Custom field sort → in-memory nach dem Read (wie Tabelle)
+      {query, true}
+    else
+      field_atom = String.to_existing_atom(field)
+
+      if field_atom in (Mv.Constants.member_fields() -- [:notes]) do
+        {Ash.Query.sort(query, [{field_atom, String.to_existing_atom(order)}]), false}
+      else
+        {query, false}
+      end
+    end
+  rescue
+    ArgumentError -> {query, false}
+  end
+
+  defp custom_field_sort?(field), do: String.starts_with?(field, @custom_field_prefix)
+
+  # ------------------------------------------------------------------
+  # Custom field sorting (match member table behavior)
+  # ------------------------------------------------------------------
+
+  defp sort_members_by_custom_field_export(members, _field, _order, _custom_fields)
+       when members == [],
+       do: []
+
+  defp sort_members_by_custom_field_export(members, field, order, custom_fields)
+       when is_binary(field) do
+    order = order || "asc"
+    id_str = String.trim_leading(field, @custom_field_prefix)
+
+    custom_field =
+      Enum.find(custom_fields, fn cf -> to_string(cf.id) == id_str end)
+
+    if is_nil(custom_field) do
+      members
+    else
+      # Match table:
+      # 1) values first, empty last
+      # 2) sort only values
+      # 3) for desc, reverse only the values-part
+      {with_values, without_values} =
+        Enum.split_with(members, fn member ->
+          has_non_empty_custom_field_value?(member, custom_field)
+        end)
+
+      sorted_with_values =
+        Enum.sort_by(with_values, fn member ->
+          extract_member_sort_value(member, custom_field)
+        end)
+
+      sorted_with_values =
+        if order == "desc", do: Enum.reverse(sorted_with_values), else: sorted_with_values
+
+      sorted_with_values ++ without_values
+    end
+  end
+
+  defp has_non_empty_custom_field_value?(member, custom_field) do
+    case find_cfv(member, custom_field) do
+      nil ->
+        false
+
+      cfv ->
+        extracted = extract_sort_value(cfv.value, custom_field.value_type)
+        not empty_value?(extracted, custom_field.value_type)
+    end
+  end
+
+  defp empty_value?(nil, _type), do: true
+
+  defp empty_value?(value, type) when type in [:string, :email] and is_binary(value) do
+    String.trim(value) == ""
+  end
+
+  defp empty_value?(_value, _type), do: false
+
+  defp find_cfv(member, custom_field) do
+    (member.custom_field_values || [])
+    |> Enum.find(fn cfv ->
+      to_string(cfv.custom_field_id) == to_string(custom_field.id) or
+        (Map.get(cfv, :custom_field) &&
+           to_string(cfv.custom_field.id) == to_string(custom_field.id))
+    end)
+  end
+
+  defp extract_member_sort_value(member, custom_field) do
+    case find_cfv(member, custom_field) do
+      nil -> nil
+      cfv -> extract_sort_value(cfv.value, custom_field.value_type)
+    end
+  end
+
+  defp build_columns(conn, parsed, custom_fields_by_id) do
+    member_cols =
+      Enum.map(parsed.selectable_member_fields, fn field ->
+        %{
+          header: member_field_header(conn, field),
+          kind: :member_field,
+          key: field
+        }
+      end)
+
+    computed_cols =
+      Enum.map(parsed.computed_fields, fn key ->
+        %{
+          header: computed_field_header(conn, key),
+          kind: :computed,
+          key: String.to_existing_atom(key)
+        }
+      end)
+
+    custom_cols =
+      parsed.custom_field_ids
+      |> Enum.map(fn id ->
+        cf = Map.get(custom_fields_by_id, id) || Map.get(custom_fields_by_id, to_string(id))
+
+        if cf do
+          %{
+            header: custom_field_header(conn, cf),
+            kind: :custom_field,
+            key: to_string(id),
+            custom_field: cf
+          }
+        else
+          nil
+        end
+      end)
+      |> Enum.reject(&is_nil/1)
+
+    member_cols ++ computed_cols ++ custom_cols
+  end
+
+  # --- headers: use MemberFields.label for translations ---
+  defp member_field_header(_conn, field) when is_binary(field) do
+    field
+    |> String.to_existing_atom()
+    |> MemberFields.label()
+  rescue
+    ArgumentError ->
+      # Fallback for unknown fields
+      humanize_field(field)
+  end
+
+  defp computed_field_header(_conn, key) when is_atom(key) do
+    # Map export-only alias to canonical UI key for translation
+    atom_key = if key == :payment_status, do: :membership_fee_status, else: key
+    MemberFields.label(atom_key)
+  end
+
+  defp computed_field_header(_conn, key) when is_binary(key) do
+    # Map export-only alias to canonical UI key for translation
+    atom_key =
+      case key do
+        "payment_status" -> :membership_fee_status
+        _ -> String.to_existing_atom(key)
+      end
+
+    MemberFields.label(atom_key)
+  rescue
+    ArgumentError ->
+      # Fallback for unknown computed fields
+      humanize_field(key)
+  end
+
+  defp custom_field_header(_conn, cf) do
+    # Custom fields: meist ist cf.name bereits der Display Name
+    cf.name
+  end
+
+  defp humanize_field(str) do
+    str
+    |> String.replace("_", " ")
+    |> String.split()
+    |> Enum.map_join(" ", &String.capitalize/1)
+  end
+
+  defp extract_sort_value(%Ash.Union{value: value, type: type}, _),
+    do: extract_sort_value(value, type)
+
+  defp extract_sort_value(nil, _), do: nil
+  defp extract_sort_value(value, :string) when is_binary(value), do: value
+  defp extract_sort_value(value, :integer) when is_integer(value), do: value
+  defp extract_sort_value(value, :boolean) when is_boolean(value), do: value
+  defp extract_sort_value(%Date{} = d, :date), do: d
+  defp extract_sort_value(value, :email) when is_binary(value), do: value
+  defp extract_sort_value(value, _), do: to_string(value)
+end

lib/mv_web/helpers/user_helpers.ex

@@ -0,0 +1,58 @@
+defmodule MvWeb.Helpers.UserHelpers do
+  @moduledoc """
+  Helper functions for user-related display in the web layer.
+
+  Provides utilities for showing authentication status without exposing
+  sensitive attributes (e.g. hashed_password).
+  """
+
+  @doc """
+  Returns whether the user has password authentication set.
+
+  Only returns true when `hashed_password` is a non-empty string. This avoids
+  treating `nil`, empty string, or forbidden/redacted values (e.g. when the
+  attribute is not visible to the actor) as "has password".
+
+  ## Examples
+
+      iex> user = %{hashed_password: nil}
+      iex> MvWeb.Helpers.UserHelpers.has_password?(user)
+      false
+
+      iex> user = %{hashed_password: "$2b$12$..."}
+      iex> MvWeb.Helpers.UserHelpers.has_password?(user)
+      true
+
+      iex> user = %{hashed_password: ""}
+      iex> MvWeb.Helpers.UserHelpers.has_password?(user)
+      false
+  """
+  @spec has_password?(map() | struct()) :: boolean()
+  def has_password?(user) when is_map(user) do
+    case Map.get(user, :hashed_password) do
+      hash when is_binary(hash) and byte_size(hash) > 0 -> true
+      _ -> false
+    end
+  end
+
+  @doc """
+  Returns whether the user is linked via OIDC/SSO (has a non-empty oidc_id).
+
+  ## Examples
+
+      iex> user = %{oidc_id: nil}
+      iex> MvWeb.Helpers.UserHelpers.has_oidc?(user)
+      false
+
+      iex> user = %{oidc_id: "sub-from-rauthy"}
+      iex> MvWeb.Helpers.UserHelpers.has_oidc?(user)
+      true
+  """
+  @spec has_oidc?(map() | struct()) :: boolean()
+  def has_oidc?(user) when is_map(user) do
+    case Map.get(user, :oidc_id) do
+      id when is_binary(id) and byte_size(id) > 0 -> true
+      _ -> false
+    end
+  end
+end

lib/mv_web/live/components/field_visibility_dropdown_component.ex

@@ -47,7 +47,7 @@ defmodule MvWeb.Components.FieldVisibilityDropdownComponent do
     custom_fields = assigns.custom_fields || []
 
     all_items =
-      Enum.map(extract_member_field_keys(all_fields), fn field ->
+      (Enum.map(extract_member_field_keys(all_fields), fn field ->
          %{
            value: field_to_string(field),
            label: format_field_label(field)
@@ -58,7 +58,8 @@ defmodule MvWeb.Components.FieldVisibilityDropdownComponent do
              value: field,
              label: format_custom_field_label(field, custom_fields)
            }
-        end)
+         end))
+      |> Enum.uniq_by(fn item -> item.value end)
 
     assigns = assign(assigns, :all_items, all_items)
 

lib/mv_web/live/global_settings_live.ex

@@ -7,7 +7,6 @@ defmodule MvWeb.GlobalSettingsLive do
   - Manage custom fields
   - Real-time form validation
   - Success/error feedback
-  - CSV member import (admin only)
 
   ## Settings
   - `club_name` - The name of the association/club (required)
@@ -15,47 +14,19 @@ defmodule MvWeb.GlobalSettingsLive do
   ## Events
   - `validate` - Real-time form validation
   - `save` - Save settings changes
-  - `start_import` - Start CSV member import (admin only)
-
-  ## CSV Import
-
-  The CSV import feature allows administrators to upload CSV files and import members.
-
-  ### File Upload
-
-  Files are uploaded automatically when selected (`auto_upload: true`). No manual
-  upload trigger is required.
-
-  ### Rate Limiting
-
-  Currently, there is no rate limiting for CSV imports. Administrators can start
-  multiple imports in quick succession. This is intentional for bulk data migration
-  scenarios, but should be monitored in production.
-
-  ### Limits
-
-  - Maximum file size: configurable via `config :mv, csv_import: [max_file_size_mb: ...]`
-  - Maximum rows: configurable via `config :mv, csv_import: [max_rows: ...]` (excluding header)
-  - Processing: chunks of 200 rows
-  - Errors: capped at 50 per import
 
   ## Note
   Settings is a singleton resource - there is only one settings record.
   The club_name can also be set via the `ASSOCIATION_NAME` environment variable.
+
+  CSV member import has been moved to the Import/Export page (`/admin/import-export`).
   """
   use MvWeb, :live_view
 
-  alias Mv.Authorization.Actor
-  alias Mv.Config
   alias Mv.Membership
-  alias Mv.Membership.Import.MemberCSV
-  alias MvWeb.Authorization
 
   on_mount {MvWeb.LiveHelpers, :ensure_user_role_loaded}
 
-  # CSV Import configuration constants
-  @max_errors 50
-
   @impl true
   def mount(_params, session, socket) do
     {:ok, settings} = Membership.get_settings()
@@ -69,22 +40,8 @@ defmodule MvWeb.GlobalSettingsLive do
       |> assign(:page_title, gettext("Settings"))
       |> assign(:settings, settings)
       |> assign(:active_editing_section, nil)
-      |> assign(:import_state, nil)
-      |> assign(:import_progress, nil)
-      |> assign(:import_status, :idle)
       |> assign(:locale, locale)
-      |> assign(:max_errors, @max_errors)
-      |> assign(:csv_import_max_rows, Config.csv_import_max_rows())
-      |> assign(:csv_import_max_file_size_mb, Config.csv_import_max_file_size_mb())
       |> assign_form()
-      # Configure file upload with auto-upload enabled
-      # Files are uploaded automatically when selected, no need for manual trigger
-      |> allow_upload(:csv_file,
-        accept: ~w(.csv),
-        max_entries: 1,
-        max_file_size: Config.csv_import_max_file_size_bytes(),
-        auto_upload: true
-      )
 
     {:ok, socket}
   end
@@ -133,211 +90,6 @@ defmodule MvWeb.GlobalSettingsLive do
           actor={@current_user}
         />
       </.form_section>
-
-      <%!-- CSV Import Section (Admin only) --%>
-      <%= if Authorization.can?(@current_user, :create, Mv.Membership.Member) do %>
-        <.form_section title={gettext("Import Members (CSV)")}>
-          <div role="note" class="alert alert-info mb-4">
-            <.icon name="hero-information-circle" class="size-5" aria-hidden="true" />
-            <div>
-              <p class="text-sm mb-2">
-                {gettext(
-                  "Use the data field name as the CSV column header in your file. Data fields must exist in Mila before importing, so they must be listed in the list of memberdate (like e-mail or first name). Unknown data field columns will be ignored with a warning."
-                )}
-              </p>
-              <p class="text-sm">
-                <.link
-                  href="#custom_fields"
-                  class="link"
-                  data-testid="custom-fields-link"
-                >
-                  {gettext("Manage Memberdata")}
-                </.link>
-              </p>
-            </div>
-          </div>
-
-          <div class="mb-4">
-            <p class="text-sm text-base-content/70 mb-2">
-              {gettext("Download CSV templates:")}
-            </p>
-            <ul class="list-disc list-inside space-y-1">
-              <li>
-                <.link
-                  href={~p"/templates/member_import_en.csv"}
-                  download="member_import_en.csv"
-                  class="link link-primary"
-                >
-                  {gettext("English Template")}
-                </.link>
-              </li>
-              <li>
-                <.link
-                  href={~p"/templates/member_import_de.csv"}
-                  download="member_import_de.csv"
-                  class="link link-primary"
-                >
-                  {gettext("German Template")}
-                </.link>
-              </li>
-            </ul>
-          </div>
-
-          <.form
-            id="csv-upload-form"
-            for={%{}}
-            multipart={true}
-            phx-change="validate_csv_upload"
-            phx-submit="start_import"
-            data-testid="csv-upload-form"
-          >
-            <div class="form-control">
-              <label for="csv_file" class="label">
-                <span class="label-text">
-                  {gettext("CSV File")}
-                </span>
-              </label>
-              <.live_file_input
-                upload={@uploads.csv_file}
-                id="csv_file"
-                class="file-input file-input-bordered w-full"
-                aria-describedby="csv_file_help"
-              />
-              <label class="label" id="csv_file_help">
-                <span class="label-text-alt">
-                  {gettext("CSV files only, maximum %{size} MB", size: @csv_import_max_file_size_mb)}
-                </span>
-              </label>
-            </div>
-
-            <.button
-              type="submit"
-              phx-disable-with={gettext("Starting import...")}
-              variant="primary"
-              disabled={
-                @import_status == :running or
-                  Enum.empty?(@uploads.csv_file.entries) or
-                  @uploads.csv_file.entries |> List.first() |> then(&(&1 && not &1.done?))
-              }
-              data-testid="start-import-button"
-            >
-              {gettext("Start Import")}
-            </.button>
-          </.form>
-
-          <%= if @import_status == :running or @import_status == :done do %>
-            <%= if @import_progress do %>
-              <div
-                role="status"
-                aria-live="polite"
-                class="mt-4"
-                data-testid="import-progress-container"
-              >
-                <%= if @import_progress.status == :running do %>
-                  <p class="text-sm" data-testid="import-progress-text">
-                    {gettext("Processing chunk %{current} of %{total}...",
-                      current: @import_progress.current_chunk,
-                      total: @import_progress.total_chunks
-                    )}
-                  </p>
-                <% end %>
-
-                <%= if @import_progress.status == :done do %>
-                  <section class="space-y-4" data-testid="import-results-panel">
-                    <h2 class="text-lg font-semibold">
-                      {gettext("Import Results")}
-                    </h2>
-
-                    <div class="space-y-4">
-                      <div>
-                        <h3 class="text-sm font-semibold mb-2">
-                          {gettext("Summary")}
-                        </h3>
-                        <div class="text-sm space-y-2">
-                          <p>
-                            <.icon
-                              name="hero-check-circle"
-                              class="size-4 inline mr-1"
-                              aria-hidden="true"
-                            />
-                            {gettext("Successfully inserted: %{count} member(s)",
-                              count: @import_progress.inserted
-                            )}
-                          </p>
-                          <%= if @import_progress.failed > 0 do %>
-                            <p>
-                              <.icon
-                                name="hero-exclamation-circle"
-                                class="size-4 inline mr-1"
-                                aria-hidden="true"
-                              />
-                              {gettext("Failed: %{count} row(s)", count: @import_progress.failed)}
-                            </p>
-                          <% end %>
-                          <%= if @import_progress.errors_truncated? do %>
-                            <p>
-                              <.icon
-                                name="hero-information-circle"
-                                class="size-4 inline mr-1"
-                                aria-hidden="true"
-                              />
-                              {gettext("Error list truncated to %{count} entries",
-                                count: @max_errors
-                              )}
-                            </p>
-                          <% end %>
-                        </div>
-                      </div>
-
-                      <%= if length(@import_progress.errors) > 0 do %>
-                        <div data-testid="import-error-list">
-                          <h3 class="text-sm font-semibold mb-2">
-                            <.icon
-                              name="hero-exclamation-circle"
-                              class="size-4 inline mr-1"
-                              aria-hidden="true"
-                            />
-                            {gettext("Errors")}
-                          </h3>
-                          <ul class="list-disc list-inside space-y-1 text-sm">
-                            <%= for error <- @import_progress.errors do %>
-                              <li>
-                                {gettext("Line %{line}: %{message}",
-                                  line: error.csv_line_number || "?",
-                                  message: error.message || gettext("Unknown error")
-                                )}
-                                <%= if error.field do %>
-                                  {gettext(" (Field: %{field})", field: error.field)}
-                                <% end %>
-                              </li>
-                            <% end %>
-                          </ul>
-                        </div>
-                      <% end %>
-
-                      <%= if length(@import_progress.warnings) > 0 do %>
-                        <div class="alert alert-warning">
-                          <.icon name="hero-information-circle" class="size-5" aria-hidden="true" />
-                          <div>
-                            <h3 class="font-semibold mb-2">
-                              {gettext("Warnings")}
-                            </h3>
-                            <ul class="list-disc list-inside space-y-1 text-sm">
-                              <%= for warning <- @import_progress.warnings do %>
-                                <li>{warning}</li>
-                              <% end %>
-                            </ul>
-                          </div>
-                        </div>
-                      <% end %>
-                    </div>
-                  </section>
-                <% end %>
-              </div>
-            <% end %>
-          <% end %>
-        </.form_section>
-      <% end %>
     </Layouts.app>
     """
   end
@@ -370,115 +122,6 @@ defmodule MvWeb.GlobalSettingsLive do
     end
   end
 
-  @impl true
-  def handle_event("validate_csv_upload", _params, socket) do
-    {:noreply, socket}
-  end
-
-  @impl true
-  def handle_event("start_import", _params, socket) do
-    case check_import_prerequisites(socket) do
-      {:error, message} ->
-        {:noreply, put_flash(socket, :error, message)}
-
-      :ok ->
-        process_csv_upload(socket)
-    end
-  end
-
-  # Checks if import can be started (admin permission, status, upload ready)
-  defp check_import_prerequisites(socket) do
-    # Ensure user role is loaded before authorization check
-    user = socket.assigns[:current_user]
-    user_with_role = Actor.ensure_loaded(user)
-
-    cond do
-      not Authorization.can?(user_with_role, :create, Mv.Membership.Member) ->
-        {:error, gettext("Only administrators can import members from CSV files.")}
-
-      socket.assigns.import_status == :running ->
-        {:error, gettext("Import is already running. Please wait for it to complete.")}
-
-      Enum.empty?(socket.assigns.uploads.csv_file.entries) ->
-        {:error, gettext("Please select a CSV file to import.")}
-
-      not List.first(socket.assigns.uploads.csv_file.entries).done? ->
-        {:error,
-         gettext("Please wait for the file upload to complete before starting the import.")}
-
-      true ->
-        :ok
-    end
-  end
-
-  # Processes CSV upload and starts import
-  defp process_csv_upload(socket) do
-    actor = MvWeb.LiveHelpers.current_actor(socket)
-
-    with {:ok, content} <- consume_and_read_csv(socket),
-         {:ok, import_state} <-
-           MemberCSV.prepare(content, max_rows: Config.csv_import_max_rows(), actor: actor) do
-      start_import(socket, import_state)
-    else
-      {:error, reason} when is_binary(reason) ->
-        {:noreply,
-         put_flash(
-           socket,
-           :error,
-           gettext("Failed to prepare CSV import: %{reason}", reason: reason)
-         )}
-
-      {:error, error} ->
-        error_message = format_error_message(error)
-
-        {:noreply,
-         put_flash(
-           socket,
-           :error,
-           gettext("Failed to prepare CSV import: %{error}", error: error_message)
-         )}
-    end
-  end
-
-  # Starts the import process
-  defp start_import(socket, import_state) do
-    progress = initialize_import_progress(import_state)
-
-    socket =
-      socket
-      |> assign(:import_state, import_state)
-      |> assign(:import_progress, progress)
-      |> assign(:import_status, :running)
-
-    send(self(), {:process_chunk, 0})
-
-    {:noreply, socket}
-  end
-
-  # Initializes import progress structure
-  defp initialize_import_progress(import_state) do
-    %{
-      inserted: 0,
-      failed: 0,
-      errors: [],
-      warnings: import_state.warnings || [],
-      status: :running,
-      current_chunk: 0,
-      total_chunks: length(import_state.chunks),
-      errors_truncated?: false
-    }
-  end
-
-  # Formats error messages for display
-  defp format_error_message(error) do
-    case error do
-      %{message: msg} when is_binary(msg) -> msg
-      %{errors: errors} when is_list(errors) -> inspect(errors)
-      reason when is_binary(reason) -> reason
-      other -> inspect(other)
-    end
-  end
-
   @impl true
   def handle_info({:custom_field_saved, _custom_field, action}, socket) do
     send_update(MvWeb.CustomFieldLive.IndexComponent,
@@ -558,139 +201,6 @@ defmodule MvWeb.GlobalSettingsLive do
     {:noreply, assign(socket, :settings, updated_settings)}
   end
 
-  @impl true
-  def handle_info({:process_chunk, idx}, socket) do
-    case socket.assigns do
-      %{import_state: import_state, import_progress: progress}
-      when is_map(import_state) and is_map(progress) ->
-        if idx >= 0 and idx < length(import_state.chunks) do
-          start_chunk_processing_task(socket, import_state, progress, idx)
-        else
-          handle_chunk_error(socket, :invalid_index, idx)
-        end
-
-      _ ->
-        # Missing required assigns - mark as error
-        handle_chunk_error(socket, :missing_state, idx)
-    end
-  end
-
-  @impl true
-  def handle_info({:chunk_done, idx, result}, socket) do
-    case socket.assigns do
-      %{import_state: import_state, import_progress: progress}
-      when is_map(import_state) and is_map(progress) ->
-        handle_chunk_result(socket, import_state, progress, idx, result)
-
-      _ ->
-        # Missing required assigns - mark as error
-        handle_chunk_error(socket, :missing_state, idx)
-    end
-  end
-
-  @impl true
-  def handle_info({:chunk_error, idx, reason}, socket) do
-    handle_chunk_error(socket, :processing_failed, idx, reason)
-  end
-
-  # Starts async task to process a chunk
-  # In tests (SQL sandbox mode), runs synchronously to avoid Ecto Sandbox issues
-  defp start_chunk_processing_task(socket, import_state, progress, idx) do
-    chunk = Enum.at(import_state.chunks, idx)
-    # Ensure user role is loaded before using as actor
-    user = socket.assigns[:current_user]
-    actor = Actor.ensure_loaded(user)
-    live_view_pid = self()
-
-    # Process chunk with existing error count for capping
-    opts = [
-      custom_field_lookup: import_state.custom_field_lookup,
-      existing_error_count: length(progress.errors),
-      max_errors: @max_errors,
-      actor: actor
-    ]
-
-    # Get locale from socket for translations in background tasks
-    locale = socket.assigns[:locale] || "de"
-    Gettext.put_locale(MvWeb.Gettext, locale)
-
-    if Config.sql_sandbox?() do
-      # Run synchronously in tests to avoid Ecto Sandbox issues with async tasks
-      {:ok, chunk_result} =
-        MemberCSV.process_chunk(
-          chunk,
-          import_state.column_map,
-          import_state.custom_field_map,
-          opts
-        )
-
-      # In test mode, send the message - it will be processed when render() is called
-      # in the test. The test helper wait_for_import_completion() handles message processing
-      send(live_view_pid, {:chunk_done, idx, chunk_result})
-    else
-      # Start async task to process chunk in production
-      # Use start_child for fire-and-forget: no monitor, no Task messages
-      # We only use our own send/2 messages for communication
-      Task.Supervisor.start_child(Mv.TaskSupervisor, fn ->
-        # Set locale in task process for translations
-        Gettext.put_locale(MvWeb.Gettext, locale)
-
-        {:ok, chunk_result} =
-          MemberCSV.process_chunk(
-            chunk,
-            import_state.column_map,
-            import_state.custom_field_map,
-            opts
-          )
-
-        send(live_view_pid, {:chunk_done, idx, chunk_result})
-      end)
-    end
-
-    {:noreply, socket}
-  end
-
-  # Handles chunk processing result from async task
-  defp handle_chunk_result(socket, import_state, progress, idx, chunk_result) do
-    # Merge progress
-    new_progress = merge_progress(progress, chunk_result, idx)
-
-    socket =
-      socket
-      |> assign(:import_progress, new_progress)
-      |> assign(:import_status, new_progress.status)
-
-    # Schedule next chunk or mark as done
-    socket = schedule_next_chunk(socket, idx, length(import_state.chunks))
-
-    {:noreply, socket}
-  end
-
-  # Handles chunk processing errors
-  defp handle_chunk_error(socket, error_type, idx, reason \\ nil) do
-    error_message =
-      case error_type do
-        :invalid_index ->
-          gettext("Invalid chunk index: %{idx}", idx: idx)
-
-        :missing_state ->
-          gettext("Import state is missing. Cannot process chunk %{idx}.", idx: idx)
-
-        :processing_failed ->
-          gettext("Failed to process chunk %{idx}: %{reason}",
-            idx: idx,
-            reason: inspect(reason)
-          )
-      end
-
-    socket =
-      socket
-      |> assign(:import_status, :error)
-      |> put_flash(:error, error_message)
-
-    {:noreply, socket}
-  end
-
   defp assign_form(%{assigns: %{settings: settings}} = socket) do
     form =
       AshPhoenix.Form.for_update(
@@ -703,71 +213,4 @@ defmodule MvWeb.GlobalSettingsLive do
 
     assign(socket, form: to_form(form))
   end
-
-  defp consume_and_read_csv(socket) do
-    result =
-      consume_uploaded_entries(socket, :csv_file, fn %{path: path}, _entry ->
-        case File.read(path) do
-          {:ok, content} -> {:ok, content}
-          {:error, reason} -> {:error, Exception.message(reason)}
-        end
-      end)
-
-    result
-    |> case do
-      [content] when is_binary(content) ->
-        {:ok, content}
-
-      [{:ok, content}] when is_binary(content) ->
-        {:ok, content}
-
-      [{:error, reason}] ->
-        {:error, gettext("Failed to read file: %{reason}", reason: reason)}
-
-      [] ->
-        {:error, gettext("No file was uploaded")}
-
-      _other ->
-        {:error, gettext("Failed to read uploaded file")}
-    end
-  end
-
-  defp merge_progress(progress, chunk_result, current_chunk_idx) do
-    # Merge errors with cap of @max_errors overall
-    all_errors = progress.errors ++ chunk_result.errors
-    new_errors = Enum.take(all_errors, @max_errors)
-    errors_truncated? = length(all_errors) > @max_errors
-
-    # Merge warnings (optional dedupe - simple append for now)
-    new_warnings = progress.warnings ++ Map.get(chunk_result, :warnings, [])
-
-    # Update status based on whether we're done
-    # current_chunk_idx is 0-based, so after processing chunk 0, we've processed 1 chunk
-    chunks_processed = current_chunk_idx + 1
-    new_status = if chunks_processed >= progress.total_chunks, do: :done, else: :running
-
-    %{
-      inserted: progress.inserted + chunk_result.inserted,
-      failed: progress.failed + chunk_result.failed,
-      errors: new_errors,
-      warnings: new_warnings,
-      status: new_status,
-      current_chunk: chunks_processed,
-      total_chunks: progress.total_chunks,
-      errors_truncated?: errors_truncated? || chunk_result.errors_truncated?
-    }
-  end
-
-  defp schedule_next_chunk(socket, current_idx, total_chunks) do
-    next_idx = current_idx + 1
-
-    if next_idx < total_chunks do
-      # Schedule next chunk
-      send(self(), {:process_chunk, next_idx})
-      socket
-    else
-      # All chunks processed - status already set to :done in merge_progress
-      socket
-    end
-  end
 end

lib/mv_web/live/import_export_live.ex

@@ -0,0 +1,464 @@
+defmodule MvWeb.ImportExportLive do
+  @moduledoc """
+  LiveView for importing and exporting members via CSV.
+
+  ## Features
+  - CSV member import (admin only)
+  - Real-time import progress tracking
+  - Error and warning reporting
+  - Custom fields support
+
+  ## CSV Import
+
+  The CSV import feature allows administrators to upload CSV files and import members.
+
+  ### File Upload
+
+  Files are uploaded automatically when selected (`auto_upload: true`). No manual
+  upload trigger is required.
+
+  ### Rate Limiting
+
+  Currently, there is no rate limiting for CSV imports. Administrators can start
+  multiple imports in quick succession. This is intentional for bulk data migration
+  scenarios, but should be monitored in production.
+
+  ### Limits
+
+  - Maximum file size: configurable via `config :mv, csv_import: [max_file_size_mb: ...]`
+  - Maximum rows: configurable via `config :mv, csv_import: [max_rows: ...]` (excluding header)
+  - Processing: chunks of 200 rows
+  - Errors: capped at 50 per import
+  """
+  use MvWeb, :live_view
+
+  alias Mv.Authorization.Actor
+  alias Mv.Config
+  alias Mv.Membership
+  alias Mv.Membership.Import.ImportRunner
+  alias Mv.Membership.Import.MemberCSV
+  alias MvWeb.Authorization
+  alias MvWeb.ImportExportLive.Components
+
+  on_mount {MvWeb.LiveHelpers, :ensure_user_role_loaded}
+
+  # Maximum number of errors to collect per import to prevent memory issues
+  # and keep error display manageable. Additional errors are silently dropped
+  # after this limit is reached.
+  @max_errors 50
+
+  # Maximum length for error messages before truncation
+  @max_error_message_length 200
+
+  @impl true
+  def mount(_params, session, socket) do
+    # Get locale from session for translations
+    locale = session["locale"] || "de"
+    Gettext.put_locale(MvWeb.Gettext, locale)
+
+    # Get club name from settings
+    club_name =
+      case Membership.get_settings() do
+        {:ok, settings} -> settings.club_name
+        _ -> "Mitgliederverwaltung"
+      end
+
+    socket =
+      socket
+      |> assign(:page_title, gettext("Import/Export"))
+      |> assign(:club_name, club_name)
+      |> assign(:import_state, nil)
+      |> assign(:import_progress, nil)
+      |> assign(:import_status, :idle)
+      |> assign(:locale, locale)
+      |> assign(:max_errors, @max_errors)
+      |> assign(:csv_import_max_rows, Config.csv_import_max_rows())
+      |> assign(:csv_import_max_file_size_mb, Config.csv_import_max_file_size_mb())
+      # Configure file upload with auto-upload enabled
+      # Files are uploaded automatically when selected, no need for manual trigger
+      |> allow_upload(:csv_file,
+        accept: ~w(.csv),
+        max_entries: 1,
+        max_file_size: Config.csv_import_max_file_size_bytes(),
+        auto_upload: true
+      )
+
+    {:ok, socket}
+  end
+
+  @impl true
+  def render(assigns) do
+    ~H"""
+    <Layouts.app flash={@flash} current_user={@current_user} club_name={@club_name}>
+      <.header>
+        {gettext("Import/Export")}
+        <:subtitle>
+          {gettext("Import members from CSV files or export member data.")}
+        </:subtitle>
+      </.header>
+
+      <%= if Authorization.can?(@current_user, :create, Mv.Membership.Member) do %>
+        <%!-- CSV Import Section --%>
+        <.form_section title={gettext("Import Members (CSV)")}>
+          <Components.custom_fields_notice {assigns} />
+          <Components.template_links {assigns} />
+          <Components.import_form {assigns} />
+          <%= if @import_status == :running or @import_status == :done or @import_status == :error do %>
+            <Components.import_progress {assigns} />
+          <% end %>
+        </.form_section>
+
+        <%!-- Export Section (Placeholder) --%>
+        <.form_section title={gettext("Export Members (CSV)")}>
+          <div role="note" class="alert alert-info">
+            <.icon name="hero-information-circle" class="size-5" aria-hidden="true" />
+            <div>
+              <p class="text-sm">
+                {gettext("Export functionality will be available in a future release.")}
+              </p>
+            </div>
+          </div>
+        </.form_section>
+      <% else %>
+        <div role="alert" class="alert alert-error">
+          <.icon name="hero-exclamation-circle" class="size-5" aria-hidden="true" />
+          <div>
+            <p>{gettext("You do not have permission to access this page.")}</p>
+          </div>
+        </div>
+      <% end %>
+    </Layouts.app>
+    """
+  end
+
+  @impl true
+  def handle_event("validate_csv_upload", _params, socket) do
+    {:noreply, socket}
+  end
+
+  @impl true
+  def handle_event("start_import", _params, socket) do
+    case check_import_prerequisites(socket) do
+      {:error, message} ->
+        {:noreply, put_flash(socket, :error, message)}
+
+      :ok ->
+        process_csv_upload(socket)
+    end
+  end
+
+  # Checks if all prerequisites for starting an import are met.
+  #
+  # Validates:
+  # - User has admin permissions
+  # - No import is currently running
+  # - CSV file is uploaded and ready
+  #
+  # Returns `:ok` if all checks pass, `{:error, message}` otherwise.
+  #
+  # Note: on_mount :ensure_user_role_loaded already guarantees the role is loaded,
+  # so ensure_actor_loaded is primarily for clarity.
+  @spec check_import_prerequisites(Phoenix.LiveView.Socket.t()) ::
+          :ok | {:error, String.t()}
+  defp check_import_prerequisites(socket) do
+    # on_mount already ensures role is loaded, but we keep this for clarity
+    user_with_role = ensure_actor_loaded(socket)
+
+    cond do
+      not Authorization.can?(user_with_role, :create, Mv.Membership.Member) ->
+        {:error, gettext("Only administrators can import members from CSV files.")}
+
+      socket.assigns.import_status == :running ->
+        {:error, gettext("Import is already running. Please wait for it to complete.")}
+
+      Enum.empty?(socket.assigns.uploads.csv_file.entries) ->
+        {:error, gettext("Please select a CSV file to import.")}
+
+      not List.first(socket.assigns.uploads.csv_file.entries).done? ->
+        {:error,
+         gettext("Please wait for the file upload to complete before starting the import.")}
+
+      true ->
+        :ok
+    end
+  end
+
+  # Processes CSV upload and starts import process.
+  #
+  # Reads the uploaded CSV file, prepares it for import, and initiates
+  # the chunked processing workflow.
+  @spec process_csv_upload(Phoenix.LiveView.Socket.t()) ::
+          {:noreply, Phoenix.LiveView.Socket.t()}
+  defp process_csv_upload(socket) do
+    actor = MvWeb.LiveHelpers.current_actor(socket)
+
+    with {:ok, content} <- consume_and_read_csv(socket),
+         {:ok, import_state} <-
+           MemberCSV.prepare(content, max_rows: Config.csv_import_max_rows(), actor: actor) do
+      start_import(socket, import_state)
+    else
+      {:error, reason} when is_binary(reason) ->
+        {:noreply,
+         put_flash(
+           socket,
+           :error,
+           gettext("Failed to prepare CSV import: %{reason}", reason: reason)
+         )}
+
+      {:error, error} ->
+        error_message = format_error_message(error)
+
+        {:noreply,
+         put_flash(
+           socket,
+           :error,
+           gettext("Failed to prepare CSV import: %{reason}", reason: error_message)
+         )}
+    end
+  end
+
+  # Starts the import process by initializing progress tracking and scheduling the first chunk.
+  @spec start_import(Phoenix.LiveView.Socket.t(), map()) ::
+          {:noreply, Phoenix.LiveView.Socket.t()}
+  defp start_import(socket, import_state) do
+    progress = ImportRunner.initial_progress(import_state, max_errors: @max_errors)
+
+    socket =
+      socket
+      |> assign(:import_state, import_state)
+      |> assign(:import_progress, progress)
+      |> assign(:import_status, :running)
+
+    send(self(), {:process_chunk, 0})
+
+    {:noreply, socket}
+  end
+
+  # Formats error messages for user-friendly display.
+  #
+  # Handles various error types including Ash errors, maps with message fields,
+  # lists of errors, and fallback formatting for unknown types.
+  @spec format_error_message(any()) :: String.t()
+  defp format_error_message(error) do
+    case error do
+      %Ash.Error.Invalid{} = ash_error ->
+        format_ash_error(ash_error)
+
+      %{message: msg} when is_binary(msg) ->
+        msg
+
+      %{errors: errors} when is_list(errors) ->
+        format_error_list(errors)
+
+      reason when is_binary(reason) ->
+        reason
+
+      other ->
+        format_unknown_error(other)
+    end
+  end
+
+  # Formats Ash validation errors for display
+  defp format_ash_error(%Ash.Error.Invalid{errors: errors}) when is_list(errors) do
+    Enum.map_join(errors, ", ", &format_single_error/1)
+  end
+
+  defp format_ash_error(error) do
+    format_unknown_error(error)
+  end
+
+  # Formats a list of errors into a readable string
+  defp format_error_list(errors) do
+    Enum.map_join(errors, ", ", &format_single_error/1)
+  end
+
+  # Formats a single error item
+  defp format_single_error(error) when is_map(error) do
+    Map.get(error, :message) || Map.get(error, :field) || inspect(error, limit: :infinity)
+  end
+
+  defp format_single_error(error) do
+    to_string(error)
+  end
+
+  # Formats unknown error types with truncation for very long messages
+  defp format_unknown_error(other) do
+    error_str = inspect(other, limit: :infinity, pretty: true)
+
+    if String.length(error_str) > @max_error_message_length do
+      String.slice(error_str, 0, @max_error_message_length - 3) <> "..."
+    else
+      error_str
+    end
+  end
+
+  @impl true
+  def handle_info({:process_chunk, idx}, socket) do
+    case socket.assigns do
+      %{import_state: import_state, import_progress: progress}
+      when is_map(import_state) and is_map(progress) ->
+        if idx < length(import_state.chunks) do
+          start_chunk_processing_task(socket, import_state, progress, idx)
+        else
+          handle_chunk_error(socket, :invalid_index, idx)
+        end
+
+      _ ->
+        # Missing required assigns - mark as error
+        handle_chunk_error(socket, :missing_state, idx)
+    end
+  end
+
+  @impl true
+  def handle_info({:chunk_done, idx, result}, socket) do
+    case socket.assigns do
+      %{import_state: import_state, import_progress: progress}
+      when is_map(import_state) and is_map(progress) ->
+        handle_chunk_result(socket, import_state, progress, idx, result)
+
+      _ ->
+        # Missing required assigns - mark as error
+        handle_chunk_error(socket, :missing_state, idx)
+    end
+  end
+
+  @impl true
+  def handle_info({:chunk_error, idx, reason}, socket) do
+    handle_chunk_error(socket, :processing_failed, idx, reason)
+  end
+
+  # Starts async task to process a chunk of CSV rows (or runs synchronously in test sandbox).
+  # Locale must be set in the process that runs the chunk (Gettext is process-local); see run_chunk_with_locale/7.
+  @spec start_chunk_processing_task(
+          Phoenix.LiveView.Socket.t(),
+          map(),
+          map(),
+          non_neg_integer()
+        ) :: {:noreply, Phoenix.LiveView.Socket.t()}
+  defp start_chunk_processing_task(socket, import_state, progress, idx) do
+    chunk = Enum.at(import_state.chunks, idx)
+    actor = ensure_actor_loaded(socket)
+    live_view_pid = self()
+    locale = socket.assigns[:locale] || "de"
+
+    opts = [
+      custom_field_lookup: import_state.custom_field_lookup,
+      existing_error_count: length(progress.errors),
+      max_errors: @max_errors,
+      actor: actor
+    ]
+
+    if Config.sql_sandbox?() do
+      run_chunk_with_locale(
+        locale,
+        chunk,
+        import_state.column_map,
+        import_state.custom_field_map,
+        opts,
+        live_view_pid,
+        idx
+      )
+    else
+      Task.Supervisor.start_child(
+        Mv.TaskSupervisor,
+        fn ->
+          run_chunk_with_locale(
+            locale,
+            chunk,
+            import_state.column_map,
+            import_state.custom_field_map,
+            opts,
+            live_view_pid,
+            idx
+          )
+        end
+      )
+    end
+
+    {:noreply, socket}
+  end
+
+  # Sets Gettext locale in the current process, then processes the chunk.
+  # Must be called in the process that runs the chunk (sync: LiveView process; async: Task process).
+  defp run_chunk_with_locale(
+         locale,
+         chunk,
+         column_map,
+         custom_field_map,
+         opts,
+         live_view_pid,
+         idx
+       ) do
+    Gettext.put_locale(MvWeb.Gettext, locale)
+    ImportRunner.process_chunk(chunk, column_map, custom_field_map, opts, live_view_pid, idx)
+  end
+
+  # Handles chunk processing result from async task and schedules the next chunk.
+  @spec handle_chunk_result(
+          Phoenix.LiveView.Socket.t(),
+          map(),
+          map(),
+          non_neg_integer(),
+          map()
+        ) :: {:noreply, Phoenix.LiveView.Socket.t()}
+  defp handle_chunk_result(socket, import_state, progress, idx, chunk_result) do
+    new_progress =
+      ImportRunner.merge_progress(progress, chunk_result, idx, max_errors: @max_errors)
+
+    socket =
+      socket
+      |> assign(:import_progress, new_progress)
+      |> assign(:import_status, new_progress.status)
+      |> maybe_send_next_chunk(idx, length(import_state.chunks))
+
+    {:noreply, socket}
+  end
+
+  defp maybe_send_next_chunk(socket, current_idx, total_chunks) do
+    case ImportRunner.next_chunk_action(current_idx, total_chunks) do
+      {:send_chunk, next_idx} ->
+        send(self(), {:process_chunk, next_idx})
+        socket
+
+      :done ->
+        socket
+    end
+  end
+
+  # Handles chunk processing errors and updates socket with error status.
+  @spec handle_chunk_error(
+          Phoenix.LiveView.Socket.t(),
+          :invalid_index | :missing_state | :processing_failed,
+          non_neg_integer(),
+          any()
+        ) :: {:noreply, Phoenix.LiveView.Socket.t()}
+  defp handle_chunk_error(socket, error_type, idx, reason \\ nil) do
+    message = ImportRunner.format_chunk_error(error_type, idx, reason)
+
+    socket =
+      socket
+      |> assign(:import_status, :error)
+      |> put_flash(:error, message)
+
+    {:noreply, socket}
+  end
+
+  # Consumes uploaded CSV file entries and reads the file content.
+  @spec consume_and_read_csv(Phoenix.LiveView.Socket.t()) ::
+          {:ok, String.t()} | {:error, String.t()}
+  defp consume_and_read_csv(socket) do
+    raw = consume_uploaded_entries(socket, :csv_file, &ImportRunner.read_file_entry/2)
+    ImportRunner.parse_consume_result(raw)
+  end
+
+  # Ensures the actor (user with role) is loaded from socket assigns.
+  #
+  # Note: on_mount :ensure_user_role_loaded already guarantees the role is loaded,
+  # so this is primarily for clarity and defensive programming.
+  @spec ensure_actor_loaded(Phoenix.LiveView.Socket.t()) :: Mv.Accounts.User.t() | nil
+  defp ensure_actor_loaded(socket) do
+    user = socket.assigns[:current_user]
+    # on_mount already ensures role is loaded, but we keep this for clarity
+    Actor.ensure_loaded(user)
+  end
+end

lib/mv_web/live/import_export_live/components.ex

@@ -0,0 +1,272 @@
+defmodule MvWeb.ImportExportLive.Components do
+  @moduledoc """
+  Function components for the Import/Export LiveView: import form, progress, results,
+  custom fields notice, and template links. Keeps the main LiveView focused on
+  mount/handle_event/handle_info and glue code.
+  """
+  use Phoenix.Component
+  use Gettext, backend: MvWeb.Gettext
+
+  import MvWeb.CoreComponents
+
+  use Phoenix.VerifiedRoutes,
+    endpoint: MvWeb.Endpoint,
+    router: MvWeb.Router,
+    statics: MvWeb.static_paths()
+
+  @doc """
+  Renders the info box explaining that data fields must exist before import
+  and linking to Manage Member Data (custom fields).
+  """
+  def custom_fields_notice(assigns) do
+    ~H"""
+    <div role="note" class="alert alert-info mb-4">
+      <.icon name="hero-information-circle" class="size-5" aria-hidden="true" />
+      <div>
+        <p class="text-sm mb-2">
+          {gettext(
+            "Use the data field name as the CSV column header in your file. Data fields must exist in Mila before importing, so they must be listed in the list of member data (like e-mail or first name). Unknown data field columns will be ignored with a warning."
+          )}
+        </p>
+        <p class="text-sm">
+          <.link
+            href={~p"/settings#custom_fields"}
+            class="link"
+            data-testid="custom-fields-link"
+          >
+            {gettext("Manage Member Data")}
+          </.link>
+        </p>
+      </div>
+    </div>
+    """
+  end
+
+  @doc """
+  Renders download links for English and German CSV templates.
+  """
+  def template_links(assigns) do
+    ~H"""
+    <div class="mb-4">
+      <p class="text-sm text-base-content/70 mb-2">
+        {gettext("Download CSV templates:")}
+      </p>
+      <ul class="list-disc list-inside space-y-1">
+        <li>
+          <.link
+            href={~p"/templates/member_import_en.csv"}
+            download="member_import_en.csv"
+            class="link link-primary"
+          >
+            {gettext("English Template")}
+          </.link>
+        </li>
+        <li>
+          <.link
+            href={~p"/templates/member_import_de.csv"}
+            download="member_import_de.csv"
+            class="link link-primary"
+          >
+            {gettext("German Template")}
+          </.link>
+        </li>
+      </ul>
+    </div>
+    """
+  end
+
+  @doc """
+  Renders the CSV file upload form and Start Import button.
+  """
+  def import_form(assigns) do
+    ~H"""
+    <.form
+      id="csv-upload-form"
+      for={%{}}
+      multipart={true}
+      phx-change="validate_csv_upload"
+      phx-submit="start_import"
+      data-testid="csv-upload-form"
+    >
+      <div class="form-control">
+        <label for="csv_file" class="label">
+          <span class="label-text">
+            {gettext("CSV File")}
+          </span>
+        </label>
+        <.live_file_input
+          upload={@uploads.csv_file}
+          id="csv_file"
+          class="file-input file-input-bordered w-full"
+          aria-describedby="csv_file_help"
+        />
+        <p class="label-text-alt mt-1" id="csv_file_help">
+          {gettext("CSV files only, maximum %{size} MB", size: @csv_import_max_file_size_mb)}
+        </p>
+      </div>
+
+      <.button
+        type="submit"
+        phx-disable-with={gettext("Starting import...")}
+        variant="primary"
+        disabled={import_button_disabled?(@import_status, @uploads.csv_file.entries)}
+        data-testid="start-import-button"
+      >
+        {gettext("Start Import")}
+      </.button>
+    </.form>
+    """
+  end
+
+  @doc """
+  Renders import progress text and, when done or aborted, the import results section.
+  """
+  def import_progress(assigns) do
+    ~H"""
+    <%= if @import_progress do %>
+      <div
+        role="status"
+        aria-live="polite"
+        aria-atomic="true"
+        class="mt-4"
+        data-testid="import-progress-container"
+      >
+        <%= if @import_progress.status == :running do %>
+          <p class="text-sm" data-testid="import-progress-text">
+            {gettext("Processing chunk %{current} of %{total}...",
+              current: @import_progress.current_chunk,
+              total: @import_progress.total_chunks
+            )}
+          </p>
+        <% end %>
+
+        <%= if @import_progress.status == :done or @import_status == :error do %>
+          <.import_results {assigns} />
+        <% end %>
+      </div>
+    <% end %>
+    """
+  end
+
+  @doc """
+  Renders import results summary, error list, and warnings.
+  Shown when import is done or aborted (:error); heading reflects state.
+  """
+  def import_results(assigns) do
+    ~H"""
+    <section
+      class="space-y-4"
+      data-testid="import-results-panel"
+      aria-labelledby="import-results-heading"
+    >
+      <h2
+        id="import-results-heading"
+        class="text-lg font-semibold"
+        data-testid="import-results-heading"
+      >
+        <%= if @import_status == :error do %>
+          {gettext("Import aborted")}
+        <% else %>
+          {gettext("Import Results")}
+        <% end %>
+      </h2>
+
+      <div class="space-y-4">
+        <div data-testid="import-summary">
+          <h3 class="text-sm font-semibold mb-2">
+            {gettext("Summary")}
+          </h3>
+          <div class="text-sm space-y-2">
+            <p>
+              <.icon
+                name="hero-check-circle"
+                class="size-4 inline mr-1"
+                aria-hidden="true"
+              />
+              {gettext("Successfully inserted: %{count} member(s)",
+                count: @import_progress.inserted
+              )}
+            </p>
+            <%= if @import_progress.failed > 0 do %>
+              <p>
+                <.icon
+                  name="hero-exclamation-circle"
+                  class="size-4 inline mr-1"
+                  aria-hidden="true"
+                />
+                {gettext("Failed: %{count} row(s)", count: @import_progress.failed)}
+              </p>
+            <% end %>
+            <%= if @import_progress.errors_truncated? do %>
+              <p>
+                <.icon
+                  name="hero-information-circle"
+                  class="size-4 inline mr-1"
+                  aria-hidden="true"
+                />
+                {gettext("Error list truncated to %{count} entries", count: @max_errors)}
+              </p>
+            <% end %>
+          </div>
+        </div>
+
+        <%= if length(@import_progress.errors) > 0 do %>
+          <div
+            role="alert"
+            aria-live="assertive"
+            aria-atomic="true"
+            data-testid="import-error-list"
+          >
+            <h3 class="text-sm font-semibold mb-2">
+              <.icon
+                name="hero-exclamation-circle"
+                class="size-4 inline mr-1"
+                aria-hidden="true"
+              />
+              {gettext("Errors")}
+            </h3>
+            <ul class="list-disc list-inside space-y-1 text-sm">
+              <%= for error <- @import_progress.errors do %>
+                <li>
+                  {gettext("Line %{line}: %{message}",
+                    line: error.csv_line_number || "?",
+                    message: error.message || gettext("Unknown error")
+                  )}
+                  <%= if error.field do %>
+                    {gettext(" (Field: %{field})", field: error.field)}
+                  <% end %>
+                </li>
+              <% end %>
+            </ul>
+          </div>
+        <% end %>
+
+        <%= if length(@import_progress.warnings) > 0 do %>
+          <div class="alert alert-warning" role="alert" data-testid="import-warnings">
+            <.icon name="hero-information-circle" class="size-5" aria-hidden="true" />
+            <div>
+              <h3 class="font-semibold mb-2">
+                {gettext("Warnings")}
+              </h3>
+              <ul class="list-disc list-inside space-y-1 text-sm">
+                <%= for warning <- @import_progress.warnings do %>
+                  <li>{warning}</li>
+                <% end %>
+              </ul>
+            </div>
+          </div>
+        <% end %>
+      </div>
+    </section>
+    """
+  end
+
+  @doc """
+  Returns whether the Start Import button should be disabled.
+  """
+  @spec import_button_disabled?(:idle | :running | :done | :error, [map()]) :: boolean()
+  def import_button_disabled?(:running, _entries), do: true
+  def import_button_disabled?(_status, []), do: true
+  def import_button_disabled?(_status, [entry | _]) when not entry.done?, do: true
+  def import_button_disabled?(_status, _entries), do: false
+end

lib/mv_web/live/member_live/form.ex

@@ -177,7 +177,8 @@ defmodule MvWeb.MemberLive.Form do
                   phx-change="validate"
                   value={@form[:membership_fee_type_id].value || ""}
                 >
-                  <option value="">{gettext("None")}</option>
+                  <%!-- No "None" option: a membership fee type is required (validated in Member resource). --%>
+                  <option value="">{gettext("Select a membership fee type")}</option>
                   <%= for fee_type <- @available_fee_types do %>
                     <option
                       value={fee_type.id}
@@ -189,7 +190,8 @@ defmodule MvWeb.MemberLive.Form do
                     </option>
                   <% end %>
                 </select>
-                <%= for {msg, _opts} <- @form.errors[:membership_fee_type_id] || [] do %>
+                <%= for error <- List.wrap(@form.errors[:membership_fee_type_id] || []) do %>
+                  <% {msg, _opts} = if is_tuple(error), do: error, else: {error, []} %>
                   <p class="text-error text-sm mt-1">{msg}</p>
                 <% end %>
                 <%= if @interval_warning do %>

lib/mv_web/live/member_live/index.html.heex

@@ -2,6 +2,20 @@
   <.header>
     {gettext("Members")}
     <:actions>
+      <form method="post" action={~p"/members/export.csv"} target="_blank" class="inline">
+        <input type="hidden" name="_csrf_token" value={Plug.CSRFProtection.get_csrf_token()} />
+        <input type="hidden" name="payload" value={@export_payload_json} />
+        <button
+          type="submit"
+          class="btn btn-secondary gap-2"
+          aria-label={gettext("Export members to CSV")}
+        >
+          <.icon name="hero-arrow-down-tray" />
+          {gettext("Export to CSV")} ({if @selected_count == 0,
+            do: gettext("all"),
+            else: @selected_count})
+        </button>
+      </form>
       <.button
         class="secondary"
         id="copy-emails-btn"
@@ -23,9 +37,11 @@
         <.icon name="hero-envelope" />
         {gettext("Open in email program")}
       </.button>
-      <.button variant="primary" navigate={~p"/members/new"}>
+      <%= if can?(@current_user, :create, Mv.Membership.Member) do %>
+        <.button variant="primary" navigate={~p"/members/new"} data-testid="member-new">
           <.icon name="hero-plus" /> {gettext("New Member")}
         </.button>
+      <% end %>
     </:actions>
   </.header>
 
@@ -84,6 +100,7 @@
   <.table
     id="members"
     rows={@members}
+    row_id={fn member -> "row-#{member.id}" end}
     row_click={fn member -> JS.navigate(~p"/members/#{member}") end}
     dynamic_cols={@dynamic_cols}
     sort_field={@sort_field}
@@ -279,6 +296,7 @@
     </:col>
     <:col
       :let={member}
+      :if={:membership_fee_status in @member_fields_visible}
       label={gettext("Membership Fee Status")}
     >
       <%= if badge = MvWeb.MemberLive.Index.MembershipFeeStatus.format_cycle_status_badge(
@@ -297,16 +315,23 @@
         <.link navigate={~p"/members/#{member}"}>{gettext("Show")}</.link>
       </div>
 
-      <.link navigate={~p"/members/#{member}/edit"}>{gettext("Edit")}</.link>
+      <%= if can?(@current_user, :update, member) do %>
+        <.link navigate={~p"/members/#{member}/edit"} data-testid="member-edit">
+          {gettext("Edit")}
+        </.link>
+      <% end %>
     </:action>
 
     <:action :let={member}>
+      <%= if can?(@current_user, :destroy, member) do %>
         <.link
           phx-click={JS.push("delete", value: %{id: member.id}) |> hide("#row-#{member.id}")}
           data-confirm={gettext("Are you sure?")}
+          data-testid="member-delete"
         >
           {gettext("Delete")}
         </.link>
+      <% end %>
     </:action>
   </.table>
 </Layouts.app>

lib/mv_web/live/member_live/index/field_visibility.ex

@@ -18,10 +18,25 @@ defmodule MvWeb.MemberLive.Index.FieldVisibility do
   1. User-specific selection (from URL/Session/Cookie)
   2. Global settings (from database)
   3. Default (all fields visible)
+
+  ## Pseudo Member Fields
+
+  Overview-only fields that are not in `Mv.Constants.member_fields()` (e.g. computed/UI-only).
+  They appear in the field dropdown and in `member_fields_visible` but are not domain attributes.
   """
 
   alias Mv.Membership.Helpers.VisibilityConfig
 
+  # Single UI key for "Membership Fee Status"; only this appears in the dropdown.
+  @pseudo_member_fields [:membership_fee_status]
+
+  # Export/API may accept this as alias; must not appear in the UI options list.
+  @export_only_alias :payment_status
+
+  defp overview_member_fields do
+    Mv.Constants.member_fields() ++ @pseudo_member_fields
+  end
+
   @doc """
   Gets all available fields for selection.
 
@@ -39,7 +54,10 @@ defmodule MvWeb.MemberLive.Index.FieldVisibility do
   """
   @spec get_all_available_fields([struct()]) :: [atom() | String.t()]
   def get_all_available_fields(custom_fields) do
-    member_fields = Mv.Constants.member_fields()
+    member_fields =
+      overview_member_fields()
+      |> Enum.reject(fn field -> field == @export_only_alias end)
+
     custom_field_names = Enum.map(custom_fields, &"custom_field_#{&1.id}")
 
     member_fields ++ custom_field_names
@@ -115,6 +133,7 @@ defmodule MvWeb.MemberLive.Index.FieldVisibility do
     field_selection
     |> Enum.filter(fn {_field, visible} -> visible end)
     |> Enum.map(fn {field_string, _visible} -> to_field_identifier(field_string) end)
+    |> Enum.uniq()
   end
 
   def get_visible_fields(_), do: []
@@ -132,7 +151,7 @@ defmodule MvWeb.MemberLive.Index.FieldVisibility do
   """
   @spec get_visible_member_fields(%{String.t() => boolean()}) :: [atom()]
   def get_visible_member_fields(field_selection) when is_map(field_selection) do
-    member_fields = Mv.Constants.member_fields()
+    member_fields = overview_member_fields()
 
     field_selection
     |> Enum.filter(fn {field_string, visible} ->
@@ -140,10 +159,61 @@ defmodule MvWeb.MemberLive.Index.FieldVisibility do
       visible && field_atom in member_fields
     end)
     |> Enum.map(fn {field_string, _visible} -> to_field_identifier(field_string) end)
+    |> Enum.uniq()
   end
 
   def get_visible_member_fields(_), do: []
 
+  @doc """
+  Returns the list of computed (UI-only) member field atoms.
+
+  These fields are not in the database; they must not be used for Ash query
+  select/sort. Use this to filter sort options and validate sort_field.
+  """
+  @spec computed_member_fields() :: [atom()]
+  def computed_member_fields, do: @pseudo_member_fields
+
+  @doc """
+  Visible member fields that are real DB attributes (from `Mv.Constants.member_fields()`).
+
+  Use for query select/sort. Not for rendering column visibility (use
+  `get_visible_member_fields/1` for that).
+  """
+  @spec get_visible_member_fields_db(%{String.t() => boolean()}) :: [atom()]
+  def get_visible_member_fields_db(field_selection) when is_map(field_selection) do
+    db_fields = MapSet.new(Mv.Constants.member_fields())
+
+    field_selection
+    |> Enum.filter(fn {field_string, visible} ->
+      field_atom = to_field_identifier(field_string)
+      visible && field_atom in db_fields
+    end)
+    |> Enum.map(fn {field_string, _visible} -> to_field_identifier(field_string) end)
+    |> Enum.uniq()
+  end
+
+  def get_visible_member_fields_db(_), do: []
+
+  @doc """
+  Visible member fields that are computed/UI-only (e.g. membership_fee_status).
+
+  Use for rendering; do not use for query select or sort.
+  """
+  @spec get_visible_member_fields_computed(%{String.t() => boolean()}) :: [atom()]
+  def get_visible_member_fields_computed(field_selection) when is_map(field_selection) do
+    computed_set = MapSet.new(@pseudo_member_fields)
+
+    field_selection
+    |> Enum.filter(fn {field_string, visible} ->
+      field_atom = to_field_identifier(field_string)
+      visible && field_atom in computed_set
+    end)
+    |> Enum.map(fn {field_string, _visible} -> to_field_identifier(field_string) end)
+    |> Enum.uniq()
+  end
+
+  def get_visible_member_fields_computed(_), do: []
+
   @doc """
   Gets visible custom fields from field selection.
 
@@ -176,20 +246,24 @@ defmodule MvWeb.MemberLive.Index.FieldVisibility do
     Map.merge(member_visibility, custom_field_visibility)
   end
 
-  # Gets member field visibility from settings
+  # Gets member field visibility from settings (domain fields from settings, pseudo fields default true)
   defp get_member_field_visibility_from_settings(settings) do
     visibility_config =
       VisibilityConfig.normalize(Map.get(settings, :member_field_visibility, %{}))
 
-    member_fields = Mv.Constants.member_fields()
+    domain_fields = Mv.Constants.member_fields()
 
-    Enum.reduce(member_fields, %{}, fn field, acc ->
+    domain_map =
+      Enum.reduce(domain_fields, %{}, fn field, acc ->
         field_string = Atom.to_string(field)
-      # exit_date defaults to false (hidden), all other fields default to true
         default_visibility = if field == :exit_date, do: false, else: true
         show_in_overview = Map.get(visibility_config, field, default_visibility)
         Map.put(acc, field_string, show_in_overview)
       end)
+
+    Enum.reduce(@pseudo_member_fields, domain_map, fn field, acc ->
+      Map.put(acc, Atom.to_string(field), true)
+    end)
   end
 
   # Gets custom field visibility (all custom fields with show_in_overview=true are visible)
@@ -203,16 +277,20 @@ defmodule MvWeb.MemberLive.Index.FieldVisibility do
     end)
   end
 
-  # Converts field string to atom (for member fields) or keeps as string (for custom fields)
+  # Converts field string to atom (for member fields) or keeps as string (for custom fields).
+  # Maps export-only alias to canonical UI key so only one option controls the column.
   defp to_field_identifier(field_string) when is_binary(field_string) do
     if String.starts_with?(field_string, Mv.Constants.custom_field_prefix()) do
       field_string
     else
+      atom =
         try do
           String.to_existing_atom(field_string)
         rescue
           ArgumentError -> field_string
         end
+
+      if atom == @export_only_alias, do: :membership_fee_status, else: atom
     end
   end
 

lib/mv_web/live/member_live/show.ex

@@ -39,9 +39,15 @@ defmodule MvWeb.MemberLive.Show do
           {MvWeb.Helpers.MemberHelpers.display_name(@member)}
         </h1>
 
-        <.button variant="primary" navigate={~p"/members/#{@member}/edit?return_to=show"}>
+        <%= if can?(@current_user, :update, @member) do %>
+          <.button
+            variant="primary"
+            navigate={~p"/members/#{@member}/edit?return_to=show"}
+            data-testid="member-edit"
+          >
             {gettext("Edit Member")}
           </.button>
+        <% end %>
       </div>
 
       <%!-- Tab Navigation --%>
@@ -119,7 +125,10 @@ defmodule MvWeb.MemberLive.Show do
                   />
                 </div>
 
-                <%!-- Linked User --%>
+                <%!-- Linked User: only show when current user can see other users (e.g. admin).
+                  read_only cannot see linked user, so hide the section to avoid "No user linked" when
+                  a user is linked but not visible. --%>
+                <%= if can_access_page?(@current_user, "/users") do %>
                   <div>
                     <.data_field label={gettext("Linked User")}>
                       <%= if @member.user do %>
@@ -135,6 +144,7 @@ defmodule MvWeb.MemberLive.Show do
                       <% end %>
                     </.data_field>
                   </div>
+                <% end %>
 
                 <%!-- Notes --%>
                 <%= if @member.notes && String.trim(@member.notes) != "" do %>
@@ -281,6 +291,23 @@ defmodule MvWeb.MemberLive.Show do
     {:noreply, assign(socket, :active_tab, :membership_fees)}
   end
 
+  # Flash set in LiveComponent is not shown in parent layout; child sends this to display flash
+  @impl true
+  def handle_info({:put_flash, type, message}, socket) do
+    {:noreply, put_flash(socket, type, message)}
+  end
+
+  # MembershipFeesComponent sends this after cycles are created/deleted/regenerated so parent keeps member in sync
+  @impl true
+  def handle_info({:member_updated, updated_member}, socket) do
+    member =
+      updated_member
+      |> Map.put(:last_cycle_status, get_last_cycle_status(updated_member))
+      |> Map.put(:current_cycle_status, get_current_cycle_status(updated_member))
+
+    {:noreply, assign(socket, :member, member)}
+  end
+
   defp page_title(:show), do: gettext("Show Member")
   defp page_title(:edit), do: gettext("Edit Member")
 

lib/mv_web/live/member_live/show/membership_fees_component.ex

@@ -14,6 +14,7 @@ defmodule MvWeb.MemberLive.Show.MembershipFeesComponent do
 
   require Ash.Query
   import MvWeb.LiveHelpers, only: [current_actor: 1]
+  import MvWeb.Authorization, only: [can?: 3]
 
   alias Mv.Membership
   alias Mv.MembershipFees
@@ -49,9 +50,10 @@ defmodule MvWeb.MemberLive.Show.MembershipFeesComponent do
           <% end %>
         </div>
 
-        <%!-- Action Buttons --%>
+        <%!-- Action Buttons (only when user has permission) --%>
         <div class="flex gap-2 mb-4">
           <.button
+            :if={@member.membership_fee_type != nil and @can_create_cycle}
             phx-click="regenerate_cycles"
             phx-target={@myself}
             class={["btn btn-sm btn-outline", if(@regenerating, do: "btn-disabled", else: "")]}
@@ -61,7 +63,7 @@ defmodule MvWeb.MemberLive.Show.MembershipFeesComponent do
             {if(@regenerating, do: gettext("Regenerating..."), else: gettext("Regenerate Cycles"))}
           </.button>
           <.button
-            :if={Enum.any?(@cycles)}
+            :if={Enum.any?(@cycles) and @can_destroy_cycle}
             phx-click="delete_all_cycles"
             phx-target={@myself}
             class="btn btn-sm btn-error btn-outline"
@@ -71,7 +73,7 @@ defmodule MvWeb.MemberLive.Show.MembershipFeesComponent do
             {gettext("Delete All Cycles")}
           </.button>
           <.button
-            :if={@member.membership_fee_type}
+            :if={@member.membership_fee_type != nil and @can_create_cycle}
             phx-click="open_create_cycle_modal"
             phx-target={@myself}
             class="btn btn-sm btn-primary"
@@ -103,6 +105,7 @@ defmodule MvWeb.MemberLive.Show.MembershipFeesComponent do
             </:col>
 
             <:col :let={cycle} label={gettext("Amount")}>
+              <%= if @can_update_cycle do %>
                 <span
                   class="font-mono cursor-pointer hover:text-primary"
                   phx-click="edit_cycle_amount"
@@ -112,6 +115,9 @@ defmodule MvWeb.MemberLive.Show.MembershipFeesComponent do
                 >
                   {MembershipFeeHelpers.format_currency(cycle.amount)}
                 </span>
+              <% else %>
+                <span class="font-mono">{MembershipFeeHelpers.format_currency(cycle.amount)}</span>
+              <% end %>
             </:col>
 
             <:col :let={cycle} label={gettext("Status")}>
@@ -125,6 +131,7 @@ defmodule MvWeb.MemberLive.Show.MembershipFeesComponent do
 
             <:action :let={cycle}>
               <div class="flex gap-1">
+                <%= if @can_update_cycle do %>
                   <button
                     :if={cycle.status != :paid}
                     type="button"
@@ -164,6 +171,8 @@ defmodule MvWeb.MemberLive.Show.MembershipFeesComponent do
                     <.icon name="hero-x-circle" class="size-4" />
                     {gettext("Unpaid")}
                   </button>
+                <% end %>
+                <%= if @can_destroy_cycle do %>
                   <button
                     type="button"
                     phx-click="delete_cycle"
@@ -175,6 +184,7 @@ defmodule MvWeb.MemberLive.Show.MembershipFeesComponent do
                     <.icon name="hero-trash" class="size-4" />
                     {gettext("Delete")}
                   </button>
+                <% end %>
               </div>
             </:action>
           </.table>
@@ -408,11 +418,19 @@ defmodule MvWeb.MemberLive.Show.MembershipFeesComponent do
     # Get available fee types (filtered to same interval if member has a type)
     available_fee_types = get_available_fee_types(member, actor)
 
+    # Permission flags for cycle actions (so read_only does not see create/update/destroy UI)
+    can_create_cycle = can?(actor, :create, MembershipFeeCycle)
+    can_destroy_cycle = can?(actor, :destroy, MembershipFeeCycle)
+    can_update_cycle = can?(actor, :update, MembershipFeeCycle)
+
     {:ok,
      socket
      |> assign(assigns)
      |> assign(:cycles, cycles)
      |> assign(:available_fee_types, available_fee_types)
+     |> assign(:can_create_cycle, can_create_cycle)
+     |> assign(:can_destroy_cycle, can_destroy_cycle)
+     |> assign(:can_update_cycle, can_update_cycle)
      |> assign_new(:interval_warning, fn -> nil end)
      |> assign_new(:editing_cycle, fn -> nil end)
      |> assign_new(:deleting_cycle, fn -> nil end)
@@ -439,7 +457,7 @@ defmodule MvWeb.MemberLive.Show.MembershipFeesComponent do
          |> assign(:cycles, [])
          |> assign(
            :available_fee_types,
-           get_available_fee_types(updated_member, current_actor(socket))
+           get_available_fee_types(updated_member, actor)
          )
          |> assign(:interval_warning, nil)
          |> put_flash(:info, gettext("Membership fee type removed"))}
@@ -470,13 +488,9 @@ defmodule MvWeb.MemberLive.Show.MembershipFeesComponent do
     if interval_warning do
       {:noreply, assign(socket, :interval_warning, interval_warning)}
     else
-      actor = current_actor(socket)
-
       case update_member_fee_type(member, fee_type_id, actor) do
         {:ok, updated_member} ->
           # Reload member with cycles
-          actor = current_actor(socket)
-
           updated_member =
             updated_member
             |> Ash.load!(
@@ -502,7 +516,7 @@ defmodule MvWeb.MemberLive.Show.MembershipFeesComponent do
            |> assign(:cycles, cycles)
            |> assign(
              :available_fee_types,
-             get_available_fee_types(updated_member, current_actor(socket))
+             get_available_fee_types(updated_member, actor)
            )
            |> assign(:interval_warning, nil)
            |> put_flash(:info, gettext("Membership fee type updated. Cycles regenerated."))}
@@ -554,17 +568,15 @@ defmodule MvWeb.MemberLive.Show.MembershipFeesComponent do
   end
 
   def handle_event("regenerate_cycles", _params, socket) do
+    # Server-side authorization: do not rely on UI hiding the button (e.g. read_only could trigger via DevTools).
     actor = current_actor(socket)
 
-    # SECURITY: Only admins can manually regenerate cycles via UI
-    # Cycle generation itself uses system actor, but UI access should be restricted
-    if actor.role && actor.role.permission_set_name == "admin" do
+    if can?(actor, :create, MembershipFeeCycle) do
       socket = assign(socket, :regenerating, true)
       member = socket.assigns.member
 
       case CycleGenerator.generate_cycles_for_member(member.id) do
         {:ok, _new_cycles, _notifications} ->
-          # Reload member with cycles
           actor = current_actor(socket)
 
           updated_member =
@@ -602,7 +614,8 @@ defmodule MvWeb.MemberLive.Show.MembershipFeesComponent do
     else
       {:noreply,
        socket
-       |> put_flash(:error, gettext("Only administrators can regenerate cycles"))}
+       |> assign(:regenerating, false)
+       |> put_flash(:error, format_error(%Ash.Error.Forbidden{}))}
     end
   end
 
@@ -722,61 +735,31 @@ defmodule MvWeb.MemberLive.Show.MembershipFeesComponent do
     confirmation = String.trim(String.downcase(socket.assigns.delete_all_confirmation))
     expected = String.downcase(gettext("Yes"))
 
-    if confirmation != expected do
+    if confirmation == expected do
+      member = socket.assigns.member
+      actor = current_actor(socket)
+      cycles = socket.assigns.cycles
+
+      reset_modal = fn s ->
+        s
+        |> assign(:deleting_all_cycles, false)
+        |> assign(:delete_all_confirmation, "")
+      end
+
+      if can?(actor, :destroy, MembershipFeeCycle) do
+        do_delete_all_cycles(socket, member, actor, cycles, reset_modal)
+      else
+        {:noreply,
+         socket
+         |> reset_modal.()
+         |> put_flash(:error, format_error(%Ash.Error.Forbidden{}))}
+      end
+    else
       {:noreply,
        socket
        |> assign(:deleting_all_cycles, false)
        |> assign(:delete_all_confirmation, "")
        |> put_flash(:error, gettext("Confirmation text does not match"))}
-    else
-      member = socket.assigns.member
-
-      # Delete all cycles atomically using Ecto query
-      import Ecto.Query
-
-      deleted_count =
-        Mv.Repo.delete_all(
-          from c in Mv.MembershipFees.MembershipFeeCycle,
-            where: c.member_id == ^member.id
-        )
-
-      if deleted_count > 0 do
-        # Reload member to get updated cycles
-        actor = current_actor(socket)
-
-        updated_member =
-          member
-          |> Ash.load!(
-            [
-              :membership_fee_type,
-              membership_fee_cycles: [:membership_fee_type]
-            ],
-            actor: actor
-          )
-
-        updated_cycles =
-          Enum.sort_by(
-            updated_member.membership_fee_cycles || [],
-            & &1.cycle_start,
-            {:desc, Date}
-          )
-
-        send(self(), {:member_updated, updated_member})
-
-        {:noreply,
-         socket
-         |> assign(:member, updated_member)
-         |> assign(:cycles, updated_cycles)
-         |> assign(:deleting_all_cycles, false)
-         |> assign(:delete_all_confirmation, "")
-         |> put_flash(:info, gettext("All cycles deleted"))}
-      else
-        {:noreply,
-         socket
-         |> assign(:deleting_all_cycles, false)
-         |> assign(:delete_all_confirmation, "")
-         |> put_flash(:info, gettext("No cycles to delete"))}
-      end
     end
   end
 
@@ -895,6 +878,55 @@ defmodule MvWeb.MemberLive.Show.MembershipFeesComponent do
 
   # Helper functions
 
+  defp do_delete_all_cycles(socket, member, actor, cycles, reset_modal) do
+    result =
+      Enum.reduce_while(cycles, {:ok, 0}, fn cycle, {:ok, count} ->
+        case Ash.destroy(cycle, domain: MembershipFees, actor: actor) do
+          :ok -> {:cont, {:ok, count + 1}}
+          {:ok, _} -> {:cont, {:ok, count + 1}}
+          {:error, error} -> {:halt, {:error, error}}
+        end
+      end)
+
+    case result do
+      {:ok, deleted_count} when deleted_count > 0 ->
+        updated_member =
+          member
+          |> Ash.load!(
+            [:membership_fee_type, membership_fee_cycles: [:membership_fee_type]],
+            actor: actor
+          )
+
+        updated_cycles =
+          Enum.sort_by(
+            updated_member.membership_fee_cycles || [],
+            & &1.cycle_start,
+            {:desc, Date}
+          )
+
+        send(self(), {:member_updated, updated_member})
+
+        {:noreply,
+         socket
+         |> assign(:member, updated_member)
+         |> assign(:cycles, updated_cycles)
+         |> reset_modal.()
+         |> put_flash(:info, gettext("All cycles deleted"))}
+
+      {:ok, _} ->
+        {:noreply,
+         socket
+         |> reset_modal.()
+         |> put_flash(:info, gettext("No cycles to delete"))}
+
+      {:error, error} ->
+        {:noreply,
+         socket
+         |> reset_modal.()
+         |> put_flash(:error, format_error(error))}
+    end
+  end
+
   defp get_available_fee_types(member, actor) do
     all_types =
       MembershipFeeType
@@ -940,6 +972,10 @@ defmodule MvWeb.MemberLive.Show.MembershipFeesComponent do
     Enum.map_join(error.errors, ", ", fn e -> e.message end)
   end
 
+  defp format_error(%Ash.Error.Forbidden{}) do
+    gettext("You are not allowed to perform this action.")
+  end
+
   defp format_error(error) when is_binary(error), do: error
   defp format_error(_error), do: gettext("An error occurred")
 

lib/mv_web/live/membership_fee_settings_live.ex

@@ -8,17 +8,20 @@ defmodule MvWeb.MembershipFeeSettingsLive do
   """
   use MvWeb, :live_view
 
+  import MvWeb.LiveHelpers, only: [current_actor: 1]
+
   alias Mv.Membership
   alias Mv.MembershipFees.MembershipFeeType
 
   @impl true
   def mount(_params, _session, socket) do
+    actor = current_actor(socket)
     {:ok, settings} = Membership.get_settings()
 
     membership_fee_types =
       MembershipFeeType
       |> Ash.Query.sort(name: :asc)
-      |> Ash.read!()
+      |> Ash.read!(domain: Mv.MembershipFees, actor: actor)
 
     {:ok,
      socket

lib/mv_web/live/membership_fee_type_live/form.ex

@@ -200,10 +200,12 @@ defmodule MvWeb.MembershipFeeTypeLive.Form do
 
   @impl true
   def mount(params, _session, socket) do
+    actor = current_actor(socket)
+
     membership_fee_type =
       case params["id"] do
         nil -> nil
-        id -> Ash.get!(MembershipFeeType, id, domain: MembershipFees)
+        id -> Ash.get!(MembershipFeeType, id, domain: MembershipFees, actor: actor)
       end
 
     page_title =

lib/mv_web/live/user_live/form.ex

@@ -35,6 +35,8 @@ defmodule MvWeb.UserLive.Form do
 
   require Jason
 
+  alias Mv.Authorization
+
   import MvWeb.LiveHelpers, only: [current_actor: 1, submit_form: 3]
   import MvWeb.Authorization, only: [can?: 3]
 
@@ -50,6 +52,18 @@ defmodule MvWeb.UserLive.Form do
       <.form class="max-w-xl" for={@form} id="user-form" phx-change="validate" phx-submit="save">
         <.input field={@form[:email]} label={gettext("Email")} required type="email" />
 
+        <%= if @user && @can_assign_role do %>
+          <div class="mt-4">
+            <.input
+              field={@form[:role_id]}
+              type="select"
+              label={gettext("Role")}
+              options={Enum.map(@roles, &{&1.name, &1.id})}
+              prompt={gettext("Select role...")}
+            />
+          </div>
+        <% end %>
+        
     <!-- Password Section -->
         <div class="mt-6">
           <label class="flex items-center space-x-2">
@@ -67,6 +81,18 @@ defmodule MvWeb.UserLive.Form do
 
           <%= if @show_password_fields do %>
             <div class="p-4 mt-4 space-y-4 rounded-lg bg-gray-50">
+              <%= if @user && MvWeb.Helpers.UserHelpers.has_oidc?(@user) do %>
+                <div class="p-3 mb-4 border border-red-300 rounded-lg bg-red-50" role="alert">
+                  <p class="text-sm font-semibold text-red-800">
+                    {gettext("SSO / OIDC user")}
+                  </p>
+                  <p class="mt-1 text-sm text-red-700">
+                    {gettext(
+                      "This user is linked via SSO (Single Sign-On). A password set or changed here only affects login with email and password in this application. It does not change the password in your identity provider (e.g. Authentik). To change the SSO password, use the identity provider or your organization's IT."
+                    )}
+                  </p>
+                </div>
+              <% end %>
               <.input
                 field={@form[:password]}
                 label={gettext("Password")}
@@ -300,6 +326,9 @@ defmodule MvWeb.UserLive.Form do
 
     # Only admins can link/unlink users to members (permission docs; prevents privilege escalation).
     can_manage_member_linking = can?(actor, :destroy, Mv.Accounts.User)
+    # Only admins can assign user roles (Role update permission).
+    can_assign_role = can?(actor, :update, Mv.Authorization.Role)
+    roles = if can_assign_role, do: load_roles(actor), else: []
 
     {:ok,
      socket
@@ -307,6 +336,8 @@ defmodule MvWeb.UserLive.Form do
      |> assign(user: user)
      |> assign(:page_title, page_title)
      |> assign(:can_manage_member_linking, can_manage_member_linking)
+     |> assign(:can_assign_role, can_assign_role)
+     |> assign(:roles, roles)
      |> assign(:show_password_fields, false)
      |> assign(:member_search_query, "")
      |> assign(:available_members, [])
@@ -357,7 +388,10 @@ defmodule MvWeb.UserLive.Form do
   def handle_event("save", %{"user" => user_params}, socket) do
     actor = current_actor(socket)
 
-    # First save the user without member changes
+    # Include current member in params when not linking/unlinking so update_user's
+    # manage_relationship(on_missing: :unrelate) does not accidentally unlink.
+    user_params = params_with_member_if_unchanged(socket, user_params)
+
     case submit_form(socket.assigns.form, user_params, actor) do
       {:ok, user} ->
         handle_member_linking(socket, user, actor)
@@ -529,6 +563,20 @@ defmodule MvWeb.UserLive.Form do
   defp get_action_name(:update), do: gettext("updated")
   defp get_action_name(other), do: to_string(other)
 
+  # When user has a linked member and we are not linking/unlinking, include current member in params
+  # so update_user's manage_relationship(on_missing: :unrelate) does not unlink the member.
+  defp params_with_member_if_unchanged(socket, params) do
+    user = socket.assigns.user
+    linking = socket.assigns.selected_member_id
+    unlinking = socket.assigns[:unlink_member]
+
+    if user && user.member_id && !linking && !unlinking do
+      Map.put(params, "member", %{"id" => user.member_id})
+    else
+      params
+    end
+  end
+
   defp handle_member_link_error(socket, error) do
     error_message = extract_error_message(error)
 
@@ -572,7 +620,8 @@ defmodule MvWeb.UserLive.Form do
            assigns: %{
              user: user,
              show_password_fields: show_password_fields,
-             can_manage_member_linking: can_manage_member_linking
+             can_manage_member_linking: can_manage_member_linking,
+             can_assign_role: can_assign_role
            }
          } = socket
        ) do
@@ -580,16 +629,25 @@ defmodule MvWeb.UserLive.Form do
 
     form =
       if user do
-        # For existing users: admin uses update_user (email + member); non-admin uses update (email only).
+        # For existing users: admin uses update_user (email + member + role_id); non-admin uses update (email only).
         # Password change uses admin_set_password for both.
         action =
           cond do
             show_password_fields -> :admin_set_password
-            can_manage_member_linking -> :update_user
+            can_manage_member_linking or can_assign_role -> :update_user
             true -> :update
           end
 
+        form =
           AshPhoenix.Form.for_update(user, action, domain: Mv.Accounts, as: "user", actor: actor)
+
+        # Ensure role_id is always included on submit when role dropdown is shown (AshPhoenix.Form
+        # only submits keys in touched_forms; marking as touched avoids role change being dropped).
+        if can_assign_role and action == :update_user do
+          AshPhoenix.Form.touch(form, [:role_id])
+        else
+          form
+        end
       else
         # For new users, use password registration if password fields are shown
         action = if show_password_fields, do: :register_with_password, else: :create_user
@@ -668,6 +726,14 @@ defmodule MvWeb.UserLive.Form do
     Mv.Membership.Member.filter_by_email_match(members, user_email_str)
   end
 
+  @spec load_roles(any()) :: [Mv.Authorization.Role.t()]
+  defp load_roles(actor) do
+    case Authorization.list_roles(actor: actor) do
+      {:ok, roles} -> roles
+      {:error, _} -> []
+    end
+  end
+
   # Extract user-friendly error message from Ash.Error
   @spec extract_error_message(any()) :: String.t()
   defp extract_error_message(%Ash.Error.Invalid{errors: errors}) when is_list(errors) do

lib/mv_web/live/user_live/index.ex

@@ -35,7 +35,7 @@ defmodule MvWeb.UserLive.Index do
     users =
       Mv.Accounts.User
       |> Ash.Query.filter(email != ^Mv.Helpers.SystemActor.system_user_email())
-      |> Ash.read!(domain: Mv.Accounts, load: [:member], actor: actor)
+      |> Ash.read!(domain: Mv.Accounts, load: [:member, :role], actor: actor)
 
     sorted = Enum.sort_by(users, & &1.email)
 

lib/mv_web/live/user_live/index.html.heex

@@ -2,13 +2,22 @@
   <.header>
     {gettext("Listing Users")}
     <:actions>
-      <.button variant="primary" navigate={~p"/users/new"}>
+      <%= if can?(@current_user, :create, Mv.Accounts.User) do %>
+        <.button variant="primary" navigate={~p"/users/new"} data-testid="user-new">
           <.icon name="hero-plus" /> {gettext("New User")}
         </.button>
+      <% end %>
     </:actions>
   </.header>
 
-  <.table id="users" rows={@users} row_click={fn user -> JS.navigate(~p"/users/#{user}") end}>
+  <.table
+    id="users"
+    rows={@users}
+    row_id={fn user -> "row-#{user.id}" end}
+    row_click={fn user -> JS.navigate(~p"/users/#{user}") end}
+    sort_field={@sort_field}
+    sort_order={@sort_order}
+  >
     <:col
       :let={user}
       label={
@@ -38,6 +47,7 @@
     </:col>
     <:col
       :let={user}
+      sort_field={:email}
       label={
         sort_button(%{
           field: :email,
@@ -49,11 +59,28 @@
     >
       {user.email}
     </:col>
+    <:col :let={user} label={gettext("Role")}>
+      {user.role.name}
+    </:col>
     <:col :let={user} label={gettext("Linked Member")}>
       <%= if user.member do %>
         {MvWeb.Helpers.MemberHelpers.display_name(user.member)}
       <% else %>
-        <span class="text-base-content/50">{gettext("No member linked")}</span>
+        <span class="text-base-content/70">{gettext("No member linked")}</span>
+      <% end %>
+    </:col>
+    <:col :let={user} label={gettext("Password")}>
+      <%= if MvWeb.Helpers.UserHelpers.has_password?(user) do %>
+        <span>{gettext("Enabled")}</span>
+      <% else %>
+        <span class="text-base-content/70">—</span>
+      <% end %>
+    </:col>
+    <:col :let={user} label={gettext("OIDC")}>
+      <%= if MvWeb.Helpers.UserHelpers.has_oidc?(user) do %>
+        <span>{gettext("Linked")}</span>
+      <% else %>
+        <span class="text-base-content/70">—</span>
       <% end %>
     </:col>
 
@@ -62,16 +89,23 @@
         <.link navigate={~p"/users/#{user}"}>{gettext("Show")}</.link>
       </div>
 
-      <.link navigate={~p"/users/#{user}/edit"}>{gettext("Edit")}</.link>
+      <%= if can?(@current_user, :update, user) do %>
+        <.link navigate={~p"/users/#{user}/edit"} data-testid="user-edit">
+          {gettext("Edit")}
+        </.link>
+      <% end %>
     </:action>
 
     <:action :let={user}>
+      <%= if can?(@current_user, :destroy, user) do %>
         <.link
           phx-click={JS.push("delete", value: %{id: user.id}) |> hide("#row-#{user.id}")}
           data-confirm={gettext("Are you sure?")}
+          data-testid="user-delete"
         >
           {gettext("Delete")}
         </.link>
+      <% end %>
     </:action>
   </.table>
 </Layouts.app>

lib/mv_web/live/user_live/show.ex

@@ -41,16 +41,30 @@ defmodule MvWeb.UserLive.Show do
             <.icon name="hero-arrow-left" />
             <span class="sr-only">{gettext("Back to users list")}</span>
           </.button>
-          <.button variant="primary" navigate={~p"/users/#{@user}/edit?return_to=show"}>
+          <%= if can?(@current_user, :update, @user) do %>
+            <.button
+              variant="primary"
+              navigate={~p"/users/#{@user}/edit?return_to=show"}
+              data-testid="user-edit"
+            >
               <.icon name="hero-pencil-square" /> {gettext("Edit User")}
             </.button>
+          <% end %>
         </:actions>
       </.header>
 
       <.list>
         <:item title={gettext("Email")}>{@user.email}</:item>
+        <:item title={gettext("Role")}>{@user.role.name}</:item>
         <:item title={gettext("Password Authentication")}>
-          {if @user.hashed_password, do: gettext("Enabled"), else: gettext("Not enabled")}
+          {if MvWeb.Helpers.UserHelpers.has_password?(@user),
+            do: gettext("Enabled"),
+            else: gettext("Not enabled")}
+        </:item>
+        <:item title={gettext("OIDC")}>
+          {if MvWeb.Helpers.UserHelpers.has_oidc?(@user),
+            do: gettext("Linked"),
+            else: gettext("Not linked")}
         </:item>
         <:item title={gettext("Linked Member")}>
           <%= if @user.member do %>
@@ -73,7 +87,9 @@ defmodule MvWeb.UserLive.Show do
   @impl true
   def mount(%{"id" => id}, _session, socket) do
     actor = current_actor(socket)
-    user = Ash.get!(Mv.Accounts.User, id, domain: Mv.Accounts, load: [:member], actor: actor)
+
+    user =
+      Ash.get!(Mv.Accounts.User, id, domain: Mv.Accounts, load: [:member, :role], actor: actor)
 
     if Mv.Helpers.SystemActor.system_user?(user) do
       {:ok,

lib/mv_web/page_paths.ex

@@ -0,0 +1,42 @@
+defmodule MvWeb.PagePaths do
+  @moduledoc """
+  Central path strings for UI authorization and sidebar menu.
+
+  Keep in sync with `MvWeb.Router`. Used by Sidebar and `can_access_page?/2`
+  so route changes (prefix, rename) are updated in one place.
+  """
+
+  # Sidebar top-level menu paths
+  @members "/members"
+  @membership_fee_types "/membership_fee_types"
+
+  # Administration submenu paths (all must match router)
+  @users "/users"
+  @groups "/groups"
+  @admin_roles "/admin/roles"
+  @membership_fee_settings "/membership_fee_settings"
+  @settings "/settings"
+
+  @admin_page_paths [
+    @users,
+    @groups,
+    @admin_roles,
+    @membership_fee_settings,
+    @settings
+  ]
+
+  @doc "Path for Members index (sidebar and page permission check)."
+  def members, do: @members
+
+  @doc "Path for Membership Fee Types index (sidebar and page permission check)."
+  def membership_fee_types, do: @membership_fee_types
+
+  @doc "Paths for Administration menu; show group if user can access any of these."
+  def admin_menu_paths, do: @admin_page_paths
+
+  def users, do: @users
+  def groups, do: @groups
+  def admin_roles, do: @admin_roles
+  def membership_fee_settings, do: @membership_fee_settings
+  def settings, do: @settings
+end

lib/mv_web/router.ex

@@ -88,6 +88,10 @@ defmodule MvWeb.Router do
       live "/admin/roles/:id", RoleLive.Show, :show
       live "/admin/roles/:id/edit", RoleLive.Form, :edit
 
+      # Import/Export (Admin only)
+      live "/admin/import-export", ImportExportLive
+
+      post "/members/export.csv", MemberExportController, :export
       post "/set_locale", LocaleController, :set_locale
     end
 

lib/mv_web/translations/member_fields.ex

@@ -28,6 +28,7 @@ defmodule MvWeb.Translations.MemberFields do
   def label(:house_number), do: gettext("House Number")
   def label(:postal_code), do: gettext("Postal Code")
   def label(:membership_fee_start_date), do: gettext("Membership Fee Start Date")
+  def label(:membership_fee_status), do: gettext("Membership Fee Status")
 
   # Fallback for unknown fields
   def label(field) do

mix.exs

@@ -38,7 +38,7 @@ defmodule Mv.MixProject do
     [
       {:tidewave, "~> 0.5", only: [:dev]},
       {:sourceror, "~> 1.8", only: [:dev, :test]},
-      {:live_debugger, "~> 0.5", only: [:dev]},
+      {:live_debugger, "~> 0.6", only: [:dev]},
       {:ash_admin, "~> 0.13"},
       {:ash_postgres, "~> 2.0"},
       {:ash_phoenix, "~> 2.0"},

mix.lock

@@ -1,22 +1,22 @@
 %{
-  "ash": {:hex, :ash, "3.12.0", "5b78000df650d86b446d88977ef8aa5c9d9f7ffa1193fa3c4b901c60bff2d130", [:mix], [{:crux, ">= 0.1.2 and < 1.0.0-0", [hex: :crux, repo: "hexpm", optional: false]}, {:decimal, "~> 2.0", [hex: :decimal, repo: "hexpm", optional: false]}, {:ecto, "~> 3.7", [hex: :ecto, repo: "hexpm", optional: false]}, {:ets, "~> 0.8", [hex: :ets, repo: "hexpm", optional: false]}, {:igniter, ">= 0.6.29 and < 1.0.0-0", [hex: :igniter, repo: "hexpm", optional: true]}, {:jason, ">= 1.0.0", [hex: :jason, repo: "hexpm", optional: false]}, {:picosat_elixir, "~> 0.2", [hex: :picosat_elixir, repo: "hexpm", optional: true]}, {:plug, ">= 0.0.0", [hex: :plug, repo: "hexpm", optional: true]}, {:reactor, "~> 0.11", [hex: :reactor, repo: "hexpm", optional: false]}, {:simple_sat, ">= 0.1.1 and < 1.0.0-0", [hex: :simple_sat, repo: "hexpm", optional: true]}, {:spark, ">= 2.3.14 and < 3.0.0-0", [hex: :spark, repo: "hexpm", optional: false]}, {:splode, ">= 0.2.6 and < 1.0.0-0", [hex: :splode, repo: "hexpm", optional: false]}, {:stream_data, "~> 1.0", [hex: :stream_data, repo: "hexpm", optional: false]}, {:telemetry, "~> 1.1", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm", "7cf45b4eb83aa0ab5e6707d6e4ea4a10c29ab20613c87f06344f7953b2ca5e18"},
+  "ash": {:hex, :ash, "3.16.0", "6389927b322ca7fa7990a75730133db44fcff6368adb63f41cf9eec7a5d38862", [:mix], [{:crux, ">= 0.1.2 and < 1.0.0-0", [hex: :crux, repo: "hexpm", optional: false]}, {:decimal, "~> 2.0", [hex: :decimal, repo: "hexpm", optional: false]}, {:ecto, "~> 3.7", [hex: :ecto, repo: "hexpm", optional: false]}, {:ets, "~> 0.8", [hex: :ets, repo: "hexpm", optional: false]}, {:igniter, ">= 0.6.29 and < 1.0.0-0", [hex: :igniter, repo: "hexpm", optional: true]}, {:jason, ">= 1.0.0", [hex: :jason, repo: "hexpm", optional: false]}, {:picosat_elixir, "~> 0.2", [hex: :picosat_elixir, repo: "hexpm", optional: true]}, {:plug, ">= 0.0.0", [hex: :plug, repo: "hexpm", optional: true]}, {:reactor, "~> 1.0", [hex: :reactor, repo: "hexpm", optional: false]}, {:simple_sat, ">= 0.1.1 and < 1.0.0-0", [hex: :simple_sat, repo: "hexpm", optional: true]}, {:spark, ">= 2.3.14 and < 3.0.0-0", [hex: :spark, repo: "hexpm", optional: false]}, {:splode, "~> 0.3", [hex: :splode, repo: "hexpm", optional: false]}, {:stream_data, "~> 1.0", [hex: :stream_data, repo: "hexpm", optional: false]}, {:telemetry, "~> 1.1", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm", "1ea69d932ea2ae6cc2971b92576d8ac2721218a8f2f3599e0e25305edb56949b"},
   "ash_admin": {:hex, :ash_admin, "0.13.24", "4fafddc7b4450a92878b58630688c55cab20b0c27e35cad68f29811f73815816", [:mix], [{:ash, ">= 3.4.63 and < 4.0.0-0", [hex: :ash, repo: "hexpm", optional: false]}, {:ash_phoenix, ">= 2.1.8 and < 3.0.0-0", [hex: :ash_phoenix, repo: "hexpm", optional: false]}, {:gettext, "~> 0.26 or ~> 1.0", [hex: :gettext, repo: "hexpm", optional: false]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: false]}, {:phoenix, "~> 1.7", [hex: :phoenix, repo: "hexpm", optional: false]}, {:phoenix_html, "~> 4.1", [hex: :phoenix_html, repo: "hexpm", optional: false]}, {:phoenix_live_view, "~> 1.1-rc", [hex: :phoenix_live_view, repo: "hexpm", optional: false]}, {:phoenix_view, "~> 2.0", [hex: :phoenix_view, repo: "hexpm", optional: false]}], "hexpm", "8f298cf6cb6635744ed75dd401295ed52513ea4df169f0f89d6a9a75dc4de4dc"},
-  "ash_authentication": {:hex, :ash_authentication, "4.13.6", "95b17f0bfc00bd6e229145b90c7026f784ae81639e832de4b5c96a738de5ed46", [:mix], [{:argon2_elixir, "~> 4.0", [hex: :argon2_elixir, repo: "hexpm", optional: true]}, {:ash, "~> 3.7", [hex: :ash, repo: "hexpm", optional: false]}, {:ash_postgres, ">= 2.6.8 and < 3.0.0-0", [hex: :ash_postgres, repo: "hexpm", optional: true]}, {:assent, "> 0.2.0 and < 0.3.0", [hex: :assent, repo: "hexpm", optional: false]}, {:bcrypt_elixir, "~> 3.0", [hex: :bcrypt_elixir, repo: "hexpm", optional: false]}, {:castore, "~> 1.0", [hex: :castore, repo: "hexpm", optional: false]}, {:finch, "~> 0.19", [hex: :finch, repo: "hexpm", optional: false]}, {:igniter, "~> 0.4", [hex: :igniter, repo: "hexpm", optional: true]}, {:jason, "~> 1.4", [hex: :jason, repo: "hexpm", optional: false]}, {:joken, "~> 2.5", [hex: :joken, repo: "hexpm", optional: false]}, {:plug, "~> 1.13", [hex: :plug, repo: "hexpm", optional: false]}, {:spark, "~> 2.0", [hex: :spark, repo: "hexpm", optional: false]}, {:splode, "~> 0.2", [hex: :splode, repo: "hexpm", optional: false]}], "hexpm", "27ded84bdc61fd267794dee17a6cbe6e52d0f365d3e8ea0460d95977b82ac6f1"},
-  "ash_authentication_phoenix": {:hex, :ash_authentication_phoenix, "2.14.1", "60d127a73c2144b39fa3dab045cc3f7fce0c3ccd2dd3e8534288f5da65f0c1db", [:mix], [{:ash, "~> 3.0", [hex: :ash, repo: "hexpm", optional: false]}, {:ash_authentication, "~> 4.10", [hex: :ash_authentication, repo: "hexpm", optional: false]}, {:ash_phoenix, ">= 2.3.11 and < 3.0.0-0", [hex: :ash_phoenix, repo: "hexpm", optional: false]}, {:bcrypt_elixir, "~> 3.0", [hex: :bcrypt_elixir, repo: "hexpm", optional: false]}, {:gettext, "~> 0.26 or ~> 1.0", [hex: :gettext, repo: "hexpm", optional: true]}, {:igniter, ">= 0.5.25 and < 1.0.0-0", [hex: :igniter, repo: "hexpm", optional: true]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: false]}, {:phoenix, "~> 1.6", [hex: :phoenix, repo: "hexpm", optional: false]}, {:phoenix_html, "~> 4.0", [hex: :phoenix_html, repo: "hexpm", optional: false]}, {:phoenix_html_helpers, "~> 1.0", [hex: :phoenix_html_helpers, repo: "hexpm", optional: false]}, {:phoenix_live_view, "~> 1.1", [hex: :phoenix_live_view, repo: "hexpm", optional: false]}, {:phoenix_view, "~> 2.0", [hex: :phoenix_view, repo: "hexpm", optional: false]}, {:slugify, "~> 1.3", [hex: :slugify, repo: "hexpm", optional: false]}], "hexpm", "3cd57aee855be3ccf2960ce0b005ad209c97fbfc81faa71212bcfbd6a4a90cae"},
-  "ash_phoenix": {:hex, :ash_phoenix, "2.3.18", "fad1b8af1405758888086de568f08650c2911ee97074cfe2e325b14854bc43dd", [:mix], [{:ash, ">= 3.5.13 and < 4.0.0-0", [hex: :ash, repo: "hexpm", optional: false]}, {:igniter, "~> 0.6", [hex: :igniter, repo: "hexpm", optional: true]}, {:inertia, "~> 2.3", [hex: :inertia, repo: "hexpm", optional: true]}, {:phoenix, "~> 1.5.6 or ~> 1.6", [hex: :phoenix, repo: "hexpm", optional: false]}, {:phoenix_html, "~> 4.0", [hex: :phoenix_html, repo: "hexpm", optional: false]}, {:phoenix_live_view, "~> 0.20.3 or ~> 1.0-rc.1", [hex: :phoenix_live_view, repo: "hexpm", optional: false]}, {:spark, ">= 2.2.29 and < 3.0.0-0", [hex: :spark, repo: "hexpm", optional: false]}], "hexpm", "7ec28f9216221e83b90d9c3605e9d1cdd228984e09a1a86c9b9d393cebf25222"},
-  "ash_postgres": {:hex, :ash_postgres, "2.6.27", "7aa119cc420909573a51802f414a49a9fb21a06ee78769efd7a4db040e748f5c", [:mix], [{:ash, ">= 3.11.2 and < 4.0.0-0", [hex: :ash, repo: "hexpm", optional: false]}, {:ash_sql, ">= 0.3.16 and < 1.0.0-0", [hex: :ash_sql, repo: "hexpm", optional: false]}, {:ecto, "~> 3.13", [hex: :ecto, repo: "hexpm", optional: false]}, {:ecto_sql, "~> 3.13", [hex: :ecto_sql, repo: "hexpm", optional: false]}, {:igniter, ">= 0.6.29 and < 1.0.0-0", [hex: :igniter, repo: "hexpm", optional: true]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: false]}, {:postgrex, ">= 0.0.0", [hex: :postgrex, repo: "hexpm", optional: false]}, {:spark, ">= 2.3.4 and < 3.0.0-0", [hex: :spark, repo: "hexpm", optional: false]}], "hexpm", "f5e71dc3f77bc0c52374869df4b66493e13c0e27507c3d10ff13158ef7ea506f"},
-  "ash_sql": {:hex, :ash_sql, "0.3.16", "a4e62d2cf9b2f4a451067e5e3de28349a8d0e69cf50fc1861bad85f478ded046", [:mix], [{:ash, "~> 3.7", [hex: :ash, repo: "hexpm", optional: false]}, {:ecto, ">= 3.13.4 and < 4.0.0-0", [hex: :ecto, repo: "hexpm", optional: false]}, {:ecto_sql, "~> 3.9", [hex: :ecto_sql, repo: "hexpm", optional: false]}], "hexpm", "f3d5a810b23e12e3e102799c68b1e934fa7f909ccaa4bd530f10c7317cfcfe56"},
+  "ash_authentication": {:hex, :ash_authentication, "4.13.7", "421b5ddb516026f6794435980a632109ec116af2afa68a45e15fb48b41c92cfa", [:mix], [{:argon2_elixir, "~> 4.0", [hex: :argon2_elixir, repo: "hexpm", optional: true]}, {:ash, "~> 3.7", [hex: :ash, repo: "hexpm", optional: false]}, {:ash_postgres, ">= 2.6.8 and < 3.0.0-0", [hex: :ash_postgres, repo: "hexpm", optional: true]}, {:assent, "> 0.2.0 and < 0.3.0", [hex: :assent, repo: "hexpm", optional: false]}, {:bcrypt_elixir, "~> 3.0", [hex: :bcrypt_elixir, repo: "hexpm", optional: false]}, {:castore, "~> 1.0", [hex: :castore, repo: "hexpm", optional: false]}, {:finch, "~> 0.19", [hex: :finch, repo: "hexpm", optional: false]}, {:igniter, "~> 0.4", [hex: :igniter, repo: "hexpm", optional: true]}, {:jason, "~> 1.4", [hex: :jason, repo: "hexpm", optional: false]}, {:joken, "~> 2.5", [hex: :joken, repo: "hexpm", optional: false]}, {:plug, "~> 1.13", [hex: :plug, repo: "hexpm", optional: false]}, {:spark, "~> 2.0", [hex: :spark, repo: "hexpm", optional: false]}, {:splode, "~> 0.2", [hex: :splode, repo: "hexpm", optional: false]}], "hexpm", "0d45ac3fdcca6902dabbe161ce63e9cea8f90583863c2e14261c9309e5837121"},
+  "ash_authentication_phoenix": {:hex, :ash_authentication_phoenix, "2.15.0", "89e71e96a3d954aed7ed0c1f511d42cbfd19009b813f580b12749b01bbea5148", [:mix], [{:ash, "~> 3.0", [hex: :ash, repo: "hexpm", optional: false]}, {:ash_authentication, "~> 4.10", [hex: :ash_authentication, repo: "hexpm", optional: false]}, {:ash_phoenix, ">= 2.3.11 and < 3.0.0-0", [hex: :ash_phoenix, repo: "hexpm", optional: false]}, {:bcrypt_elixir, "~> 3.0", [hex: :bcrypt_elixir, repo: "hexpm", optional: false]}, {:gettext, "~> 0.26 or ~> 1.0", [hex: :gettext, repo: "hexpm", optional: true]}, {:igniter, ">= 0.5.25 and < 1.0.0-0", [hex: :igniter, repo: "hexpm", optional: true]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: false]}, {:phoenix, "~> 1.6", [hex: :phoenix, repo: "hexpm", optional: false]}, {:phoenix_html, "~> 4.0", [hex: :phoenix_html, repo: "hexpm", optional: false]}, {:phoenix_html_helpers, "~> 1.0", [hex: :phoenix_html_helpers, repo: "hexpm", optional: false]}, {:phoenix_live_view, "~> 1.1", [hex: :phoenix_live_view, repo: "hexpm", optional: false]}, {:phoenix_view, "~> 2.0", [hex: :phoenix_view, repo: "hexpm", optional: false]}, {:slugify, "~> 1.3", [hex: :slugify, repo: "hexpm", optional: false]}], "hexpm", "d2da66dcf62bc1054ce8f5d9c2829b1dff1dbc3f1d03f9ef0cbe89123d7df107"},
+  "ash_phoenix": {:hex, :ash_phoenix, "2.3.19", "244b24256a7d730e5223f36f371a95971542a547a12f0fb73406f67977e86c97", [:mix], [{:ash, ">= 3.5.13 and < 4.0.0-0", [hex: :ash, repo: "hexpm", optional: false]}, {:igniter, "~> 0.6", [hex: :igniter, repo: "hexpm", optional: true]}, {:inertia, "~> 2.3", [hex: :inertia, repo: "hexpm", optional: true]}, {:phoenix, "~> 1.5.6 or ~> 1.6", [hex: :phoenix, repo: "hexpm", optional: false]}, {:phoenix_html, "~> 4.0", [hex: :phoenix_html, repo: "hexpm", optional: false]}, {:phoenix_live_view, "~> 0.20.3 or ~> 1.0-rc.1", [hex: :phoenix_live_view, repo: "hexpm", optional: false]}, {:spark, ">= 2.2.29 and < 3.0.0-0", [hex: :spark, repo: "hexpm", optional: false]}], "hexpm", "754a7d869a3961a927abb7ff700af9895d2e69dd3b8f9471b0aa8e859cc4b135"},
+  "ash_postgres": {:hex, :ash_postgres, "2.6.31", "2fde375f7ff5b0a4d1ec54d64089e65c4460ff08be222119e7587b820ebd782b", [:mix], [{:ash, "~> 3.15", [hex: :ash, repo: "hexpm", optional: false]}, {:ash_sql, ">= 0.4.3 and < 1.0.0-0", [hex: :ash_sql, repo: "hexpm", optional: false]}, {:ecto, "~> 3.13", [hex: :ecto, repo: "hexpm", optional: false]}, {:ecto_sql, "~> 3.13", [hex: :ecto_sql, repo: "hexpm", optional: false]}, {:igniter, ">= 0.6.29 and < 1.0.0-0", [hex: :igniter, repo: "hexpm", optional: true]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: false]}, {:postgrex, ">= 0.0.0", [hex: :postgrex, repo: "hexpm", optional: false]}, {:spark, ">= 2.3.4 and < 3.0.0-0", [hex: :spark, repo: "hexpm", optional: false]}], "hexpm", "0f045d905fe63eb6d43313309dded5db294e437fb8e9ddcf769d4f838b9c5274"},
+  "ash_sql": {:hex, :ash_sql, "0.4.4", "7e8943b984ad416ba46d297fea6b4d2bcea25c8dfe5666e22d14c42182907798", [:mix], [{:ash, "~> 3.7", [hex: :ash, repo: "hexpm", optional: false]}, {:ecto, ">= 3.13.4 and < 4.0.0-0", [hex: :ecto, repo: "hexpm", optional: false]}, {:ecto_sql, "~> 3.9", [hex: :ecto_sql, repo: "hexpm", optional: false]}], "hexpm", "19859ba3f111f1e6e4b0b9ab2f7d849e17b6b0ea5dc54811b3e2b54a7ddff5c0"},
   "assent": {:hex, :assent, "0.2.13", "11226365d2d8661d23e9a2cf94d3255e81054ff9d88ac877f28bfdf38fa4ef31", [:mix], [{:certifi, ">= 0.0.0", [hex: :certifi, repo: "hexpm", optional: true]}, {:finch, "~> 0.15", [hex: :finch, repo: "hexpm", optional: true]}, {:jose, "~> 1.8", [hex: :jose, repo: "hexpm", optional: true]}, {:mint, "~> 1.0", [hex: :mint, repo: "hexpm", optional: true]}, {:req, "~> 0.4", [hex: :req, repo: "hexpm", optional: true]}, {:ssl_verify_fun, ">= 0.0.0", [hex: :ssl_verify_fun, repo: "hexpm", optional: true]}], "hexpm", "bf9f351b01dd6bceea1d1f157f05438f6765ce606e6eb8d29296003d29bf6eab"},
-  "bandit": {:hex, :bandit, "1.10.1", "6b1f8609d947ae2a74da5bba8aee938c94348634e54e5625eef622ca0bbbb062", [:mix], [{:hpax, "~> 1.0", [hex: :hpax, repo: "hexpm", optional: false]}, {:plug, "~> 1.18", [hex: :plug, repo: "hexpm", optional: false]}, {:telemetry, "~> 0.4 or ~> 1.0", [hex: :telemetry, repo: "hexpm", optional: false]}, {:thousand_island, "~> 1.0", [hex: :thousand_island, repo: "hexpm", optional: false]}, {:websock, "~> 0.5", [hex: :websock, repo: "hexpm", optional: false]}], "hexpm", "4b4c35f273030e44268ace53bf3d5991dfc385c77374244e2f960876547671aa"},
+  "bandit": {:hex, :bandit, "1.10.2", "d15ea32eb853b5b42b965b24221eb045462b2ba9aff9a0bda71157c06338cbff", [:mix], [{:hpax, "~> 1.0", [hex: :hpax, repo: "hexpm", optional: false]}, {:plug, "~> 1.18", [hex: :plug, repo: "hexpm", optional: false]}, {:telemetry, "~> 0.4 or ~> 1.0", [hex: :telemetry, repo: "hexpm", optional: false]}, {:thousand_island, "~> 1.0", [hex: :thousand_island, repo: "hexpm", optional: false]}, {:websock, "~> 0.5", [hex: :websock, repo: "hexpm", optional: false]}], "hexpm", "27b2a61b647914b1726c2ced3601473be5f7aa6bb468564a688646a689b3ee45"},
   "bcrypt_elixir": {:hex, :bcrypt_elixir, "3.3.2", "d50091e3c9492d73e17fc1e1619a9b09d6a5ef99160eb4d736926fd475a16ca3", [:make, :mix], [{:comeonin, "~> 5.3", [hex: :comeonin, repo: "hexpm", optional: false]}, {:elixir_make, "~> 0.6", [hex: :elixir_make, repo: "hexpm", optional: false]}], "hexpm", "471be5151874ae7931911057d1467d908955f93554f7a6cd1b7d804cac8cef53"},
   "bunt": {:hex, :bunt, "1.0.0", "081c2c665f086849e6d57900292b3a161727ab40431219529f13c4ddcf3e7a44", [:mix], [], "hexpm", "dc5f86aa08a5f6fa6b8096f0735c4e76d54ae5c9fa2c143e5a1fc7c1cd9bb6b5"},
   "castore": {:hex, :castore, "1.0.17", "4f9770d2d45fbd91dcf6bd404cf64e7e58fed04fadda0923dc32acca0badffa2", [:mix], [], "hexpm", "12d24b9d80b910dd3953e165636d68f147a31db945d2dcb9365e441f8b5351e5"},
   "cc_precompiler": {:hex, :cc_precompiler, "0.1.11", "8c844d0b9fb98a3edea067f94f616b3f6b29b959b6b3bf25fee94ffe34364768", [:mix], [{:elixir_make, "~> 0.7", [hex: :elixir_make, repo: "hexpm", optional: false]}], "hexpm", "3427232caf0835f94680e5bcf082408a70b48ad68a5f5c0b02a3bea9f3a075b9"},
   "circular_buffer": {:hex, :circular_buffer, "1.0.0", "25c004da0cba7bd8bc1bdabded4f9a902d095e20600fd15faf1f2ffbaea18a07", [:mix], [], "hexpm", "c829ec31c13c7bafd1f546677263dff5bfb006e929f25635878ac3cfba8749e5"},
   "comeonin": {:hex, :comeonin, "5.5.1", "5113e5f3800799787de08a6e0db307133850e635d34e9fab23c70b6501669510", [:mix], [], "hexpm", "65aac8f19938145377cee73973f192c5645873dcf550a8a6b18187d17c13ccdb"},
-  "credo": {:hex, :credo, "1.7.15", "283da72eeb2fd3ccf7248f4941a0527efb97afa224bcdef30b4b580bc8258e1c", [:mix], [{:bunt, "~> 0.2.1 or ~> 1.0", [hex: :bunt, repo: "hexpm", optional: false]}, {:file_system, "~> 0.2 or ~> 1.0", [hex: :file_system, repo: "hexpm", optional: false]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: false]}], "hexpm", "291e8645ea3fea7481829f1e1eb0881b8395db212821338e577a90bf225c5607"},
+  "credo": {:hex, :credo, "1.7.16", "a9f1389d13d19c631cb123c77a813dbf16449a2aebf602f590defa08953309d4", [:mix], [{:bunt, "~> 0.2.1 or ~> 1.0", [hex: :bunt, repo: "hexpm", optional: false]}, {:file_system, "~> 0.2 or ~> 1.0", [hex: :file_system, repo: "hexpm", optional: false]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: false]}], "hexpm", "d0562af33756b21f248f066a9119e3890722031b6d199f22e3cf95550e4f1579"},
   "crux": {:hex, :crux, "0.1.2", "4441c9e3a34f1e340954ce96b9ad5a2de13ceb4f97b3f910211227bb92e2ca90", [:mix], [{:picosat_elixir, "~> 0.2", [hex: :picosat_elixir, repo: "hexpm", optional: true]}, {:simple_sat, ">= 0.1.1 and < 1.0.0-0", [hex: :simple_sat, repo: "hexpm", optional: true]}, {:stream_data, "~> 1.0", [hex: :stream_data, repo: "hexpm", optional: true]}], "hexpm", "563ea3748ebfba9cc078e6d198a1d6a06015a8fae503f0b721363139f0ddb350"},
-  "db_connection": {:hex, :db_connection, "2.8.1", "9abdc1e68c34c6163f6fb96a96532272d13ad7ca45262156ae8b7ec6d9dc4bec", [:mix], [{:telemetry, "~> 0.4 or ~> 1.0", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm", "a61a3d489b239d76f326e03b98794fb8e45168396c925ef25feb405ed09da8fd"},
+  "db_connection": {:hex, :db_connection, "2.9.0", "a6a97c5c958a2d7091a58a9be40caf41ab496b0701d21e1d1abff3fa27a7f371", [:mix], [{:telemetry, "~> 0.4 or ~> 1.0", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm", "17d502eacaf61829db98facf6f20808ed33da6ccf495354a41e64fe42f9c509c"},
   "decimal": {:hex, :decimal, "2.3.0", "3ad6255aa77b4a3c4f818171b12d237500e63525c2fd056699967a3e7ea20f62", [:mix], [], "hexpm", "a4d66355cb29cb47c3cf30e71329e58361cfcb37c34235ef3bf1d7bf3773aeac"},
   "dns_cluster": {:hex, :dns_cluster, "0.2.0", "aa8eb46e3bd0326bd67b84790c561733b25c5ba2fe3c7e36f28e88f384ebcb33", [:mix], [], "hexpm", "ba6f1893411c69c01b9e8e8f772062535a4cf70f3f35bcc964a324078d8c8240"},
   "ecto": {:hex, :ecto, "3.13.5", "9d4a69700183f33bf97208294768e561f5c7f1ecf417e0fa1006e4a91713a834", [:mix], [{:decimal, "~> 2.0", [hex: :decimal, repo: "hexpm", optional: false]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: true]}, {:telemetry, "~> 0.4 or ~> 1.0", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm", "df9efebf70cf94142739ba357499661ef5dbb559ef902b68ea1f3c1fabce36de"},
@@ -28,21 +28,21 @@
   "ex_phone_number": {:hex, :ex_phone_number, "0.4.8", "c1c5e6f0673822a2a7b439b43af7d3eb1a5c19ae582b772b8b8d12625dd51ec1", [:mix], [{:sweet_xml, "~> 0.7", [hex: :sweet_xml, repo: "hexpm", optional: false]}], "hexpm", "43e2357c6b8cfe556bcd417f4ce9aaef267a786e31a2938902daaa0d36f69757"},
   "expo": {:hex, :expo, "1.1.1", "4202e1d2ca6e2b3b63e02f69cfe0a404f77702b041d02b58597c00992b601db5", [:mix], [], "hexpm", "5fb308b9cb359ae200b7e23d37c76978673aa1b06e2b3075d814ce12c5811640"},
   "file_system": {:hex, :file_system, "1.1.1", "31864f4685b0148f25bd3fbef2b1228457c0c89024ad67f7a81a3ffbc0bbad3a", [:mix], [], "hexpm", "7a15ff97dfe526aeefb090a7a9d3d03aa907e100e262a0f8f7746b78f8f87a5d"},
-  "finch": {:hex, :finch, "0.20.0", "5330aefb6b010f424dcbbc4615d914e9e3deae40095e73ab0c1bb0968933cadf", [:mix], [{:mime, "~> 1.0 or ~> 2.0", [hex: :mime, repo: "hexpm", optional: false]}, {:mint, "~> 1.6.2 or ~> 1.7", [hex: :mint, repo: "hexpm", optional: false]}, {:nimble_options, "~> 0.4 or ~> 1.0", [hex: :nimble_options, repo: "hexpm", optional: false]}, {:nimble_pool, "~> 1.1", [hex: :nimble_pool, repo: "hexpm", optional: false]}, {:telemetry, "~> 0.4 or ~> 1.0", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm", "2658131a74d051aabfcba936093c903b8e89da9a1b63e430bee62045fa9b2ee2"},
+  "finch": {:hex, :finch, "0.21.0", "b1c3b2d48af02d0c66d2a9ebfb5622be5c5ecd62937cf79a88a7f98d48a8290c", [:mix], [{:mime, "~> 1.0 or ~> 2.0", [hex: :mime, repo: "hexpm", optional: false]}, {:mint, "~> 1.6.2 or ~> 1.7", [hex: :mint, repo: "hexpm", optional: false]}, {:nimble_options, "~> 0.4 or ~> 1.0", [hex: :nimble_options, repo: "hexpm", optional: false]}, {:nimble_pool, "~> 1.1", [hex: :nimble_pool, repo: "hexpm", optional: false]}, {:telemetry, "~> 0.4 or ~> 1.0", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm", "87dc6e169794cb2570f75841a19da99cfde834249568f2a5b121b809588a4377"},
   "fine": {:hex, :fine, "0.1.4", "b19a89c1476c7c57afb5f9314aed5960b5bc95d5277de4cb5ee8e1d1616ce379", [:mix], [], "hexpm", "be3324cc454a42d80951cf6023b9954e9ff27c6daa255483b3e8d608670303f5"},
   "gettext": {:hex, :gettext, "1.0.2", "5457e1fd3f4abe47b0e13ff85086aabae760497a3497909b8473e0acee57673b", [:mix], [{:expo, "~> 0.5.1 or ~> 1.0", [hex: :expo, repo: "hexpm", optional: false]}], "hexpm", "eab805501886802071ad290714515c8c4a17196ea76e5afc9d06ca85fb1bfeb3"},
   "glob_ex": {:hex, :glob_ex, "0.1.11", "cb50d3f1ef53f6ca04d6252c7fde09fd7a1cf63387714fe96f340a1349e62c93", [:mix], [], "hexpm", "342729363056e3145e61766b416769984c329e4378f1d558b63e341020525de4"},
   "heroicons": {:git, "https://github.com/tailwindlabs/heroicons.git", "0435d4ca364a608cc75e2f8683d374e55abbae26", [tag: "v2.2.0", sparse: "optimized", depth: 1]},
   "hpax": {:hex, :hpax, "1.0.3", "ed67ef51ad4df91e75cc6a1494f851850c0bd98ebc0be6e81b026e765ee535aa", [:mix], [], "hexpm", "8eab6e1cfa8d5918c2ce4ba43588e894af35dbd8e91e6e55c817bca5847df34a"},
   "idna": {:hex, :idna, "6.1.1", "8a63070e9f7d0c62eb9d9fcb360a7de382448200fbbd1b106cc96d3d8099df8d", [:rebar3], [{:unicode_util_compat, "~> 0.7.0", [hex: :unicode_util_compat, repo: "hexpm", optional: false]}], "hexpm", "92376eb7894412ed19ac475e4a86f7b413c1b9fbb5bd16dccd57934157944cea"},
-  "igniter": {:hex, :igniter, "0.7.0", "6848714fa5afa14258c82924a57af9364745316241a409435cf39cbe11e3ae80", [:mix], [{:glob_ex, "~> 0.1.7", [hex: :glob_ex, repo: "hexpm", optional: false]}, {:jason, "~> 1.4", [hex: :jason, repo: "hexpm", optional: false]}, {:owl, "~> 0.11", [hex: :owl, repo: "hexpm", optional: false]}, {:phx_new, "~> 1.7", [hex: :phx_new, repo: "hexpm", optional: true]}, {:req, "~> 0.5", [hex: :req, repo: "hexpm", optional: false]}, {:rewrite, ">= 1.1.1 and < 2.0.0-0", [hex: :rewrite, repo: "hexpm", optional: false]}, {:sourceror, "~> 1.4", [hex: :sourceror, repo: "hexpm", optional: false]}, {:spitfire, ">= 0.1.3 and < 1.0.0-0", [hex: :spitfire, repo: "hexpm", optional: false]}], "hexpm", "1e7254780dbf4b44c9eccd6d86d47aa961efc298d7f520c24acb0258c8e90ba9"},
+  "igniter": {:hex, :igniter, "0.7.2", "81c132c0df95963c7a228f74a32d3348773743ed9651f24183bfce0fe6ff16d1", [:mix], [{:glob_ex, "~> 0.1.7", [hex: :glob_ex, repo: "hexpm", optional: false]}, {:jason, "~> 1.4", [hex: :jason, repo: "hexpm", optional: false]}, {:owl, "~> 0.11", [hex: :owl, repo: "hexpm", optional: false]}, {:phx_new, "~> 1.7", [hex: :phx_new, repo: "hexpm", optional: true]}, {:req, "~> 0.5", [hex: :req, repo: "hexpm", optional: false]}, {:rewrite, ">= 1.1.1 and < 2.0.0-0", [hex: :rewrite, repo: "hexpm", optional: false]}, {:sourceror, "~> 1.4", [hex: :sourceror, repo: "hexpm", optional: false]}, {:spitfire, ">= 0.1.3 and < 1.0.0-0", [hex: :spitfire, repo: "hexpm", optional: false]}], "hexpm", "f4cab73ec31f4fb452de1a17037f8a08826105265aa2d76486fcb848189bef9b"},
   "iterex": {:hex, :iterex, "0.1.2", "58f9b9b9a22a55cbfc7b5234a9c9c63eaac26d276b3db80936c0e1c60355a5a6", [:mix], [], "hexpm", "2e103b8bcc81757a9af121f6dc0df312c9a17220f302b1193ef720460d03029d"},
   "jason": {:hex, :jason, "1.4.4", "b9226785a9aa77b6857ca22832cffa5d5011a667207eb2a0ad56adb5db443b8a", [:mix], [{:decimal, "~> 1.0 or ~> 2.0", [hex: :decimal, repo: "hexpm", optional: true]}], "hexpm", "c5eb0cab91f094599f94d55bc63409236a8ec69a21a67814529e8d5f6cc90b3b"},
   "joken": {:hex, :joken, "2.6.2", "5daaf82259ca603af4f0b065475099ada1b2b849ff140ccd37f4b6828ca6892a", [:mix], [{:jose, "~> 1.11.10", [hex: :jose, repo: "hexpm", optional: false]}], "hexpm", "5134b5b0a6e37494e46dbf9e4dad53808e5e787904b7c73972651b51cce3d72b"},
   "jose": {:hex, :jose, "1.11.12", "06e62b467b61d3726cbc19e9b5489f7549c37993de846dfb3ee8259f9ed208b3", [:mix, :rebar3], [], "hexpm", "31e92b653e9210b696765cdd885437457de1add2a9011d92f8cf63e4641bab7b"},
-  "lazy_html": {:hex, :lazy_html, "0.1.8", "677a8642e644eef8de98f3040e2520d42d0f0f8bd6c5cd49db36504e34dffe91", [:make, :mix], [{:cc_precompiler, "~> 0.1", [hex: :cc_precompiler, repo: "hexpm", optional: false]}, {:elixir_make, "~> 0.9.0", [hex: :elixir_make, repo: "hexpm", optional: false]}, {:fine, "~> 0.1.0", [hex: :fine, repo: "hexpm", optional: false]}], "hexpm", "0d8167d930b704feb94b41414ca7f5779dff9bca7fcf619fcef18de138f08736"},
+  "lazy_html": {:hex, :lazy_html, "0.1.10", "ffe42a0b4e70859cf21a33e12a251e0c76c1dff76391609bd56702a0ef5bc429", [:make, :mix], [{:cc_precompiler, "~> 0.1", [hex: :cc_precompiler, repo: "hexpm", optional: false]}, {:elixir_make, "~> 0.9.0", [hex: :elixir_make, repo: "hexpm", optional: false]}, {:fine, "~> 0.1.0", [hex: :fine, repo: "hexpm", optional: false]}], "hexpm", "50f67e5faa09d45a99c1ddf3fac004f051997877dc8974c5797bb5ccd8e27058"},
   "libgraph": {:hex, :libgraph, "0.16.0", "3936f3eca6ef826e08880230f806bfea13193e49bf153f93edcf0239d4fd1d07", [:mix], [], "hexpm", "41ca92240e8a4138c30a7e06466acc709b0cbb795c643e9e17174a178982d6bf"},
-  "live_debugger": {:hex, :live_debugger, "0.5.0", "95e0f7727d61010f7e9053923fb2a9416904a7533c2dfb36120e7684cba4c0af", [:mix], [{:igniter, ">= 0.5.40 and < 1.0.0-0", [hex: :igniter, repo: "hexpm", optional: true]}, {:phoenix, "~> 1.7", [hex: :phoenix, repo: "hexpm", optional: false]}, {:phoenix_live_view, "~> 0.20.8 or ~> 1.0", [hex: :phoenix_live_view, repo: "hexpm", optional: false]}], "hexpm", "73ebe95118d22aa402675f677abd731cb16b136d1b6ae5f4010441fb50753b14"},
+  "live_debugger": {:hex, :live_debugger, "0.6.0", "77fcbb11b1909ff6edc29a755aa5f14cb176d188b24593526b3e482be7519990", [:mix], [{:file_system, "~> 1.0", [hex: :file_system, repo: "hexpm", optional: false]}, {:igniter, ">= 0.5.40 and < 1.0.0-0", [hex: :igniter, repo: "hexpm", optional: true]}, {:phoenix, "~> 1.7", [hex: :phoenix, repo: "hexpm", optional: false]}, {:phoenix_live_view, "~> 0.20.8 or ~> 1.0", [hex: :phoenix_live_view, repo: "hexpm", optional: false]}], "hexpm", "ad2458f4acd8b86e15b1cf7aef3304907e858f4ac35644986e5c958ea993ffb3"},
   "luhn": {:hex, :luhn, "0.3.3", "5aa0c6a32c2db4b9db9f9b883ba8301c1ae169d57199b9e6cb1ba2707bc51d96", [:mix], [], "hexpm", "3e823a913a25aab51352c727f135278d22954874d5f0835be81ed4fec3daf78d"},
   "mime": {:hex, :mime, "2.0.7", "b8d739037be7cd402aee1ba0306edfdef982687ee7e9859bee6198c1e7e2f128", [:mix], [], "hexpm", "6171188e399ee16023ffc5b76ce445eb6d9672e2e241d2df6050f3c771e80ccd"},
   "mint": {:hex, :mint, "1.7.1", "113fdb2b2f3b59e47c7955971854641c61f378549d73e829e1768de90fc1abf1", [:mix], [{:castore, "~> 0.1.0 or ~> 1.0", [hex: :castore, repo: "hexpm", optional: true]}, {:hpax, "~> 0.1.1 or ~> 0.2.0 or ~> 1.0", [hex: :hpax, repo: "hexpm", optional: false]}], "hexpm", "fceba0a4d0f24301ddee3024ae116df1c3f4bb7a563a731f45fdfeb9d39a231b"},
@@ -57,26 +57,26 @@
   "phoenix_html_helpers": {:hex, :phoenix_html_helpers, "1.0.1", "7eed85c52eff80a179391036931791ee5d2f713d76a81d0d2c6ebafe1e11e5ec", [:mix], [{:phoenix_html, "~> 4.0", [hex: :phoenix_html, repo: "hexpm", optional: false]}, {:plug, "~> 1.5", [hex: :plug, repo: "hexpm", optional: true]}], "hexpm", "cffd2385d1fa4f78b04432df69ab8da63dc5cf63e07b713a4dcf36a3740e3090"},
   "phoenix_live_dashboard": {:hex, :phoenix_live_dashboard, "0.8.7", "405880012cb4b706f26dd1c6349125bfc903fb9e44d1ea668adaf4e04d4884b7", [:mix], [{:ecto, "~> 3.6.2 or ~> 3.7", [hex: :ecto, repo: "hexpm", optional: true]}, {:ecto_mysql_extras, "~> 0.5", [hex: :ecto_mysql_extras, repo: "hexpm", optional: true]}, {:ecto_psql_extras, "~> 0.7", [hex: :ecto_psql_extras, repo: "hexpm", optional: true]}, {:ecto_sqlite3_extras, "~> 1.1.7 or ~> 1.2.0", [hex: :ecto_sqlite3_extras, repo: "hexpm", optional: true]}, {:mime, "~> 1.6 or ~> 2.0", [hex: :mime, repo: "hexpm", optional: false]}, {:phoenix_live_view, "~> 0.19 or ~> 1.0", [hex: :phoenix_live_view, repo: "hexpm", optional: false]}, {:telemetry_metrics, "~> 0.6 or ~> 1.0", [hex: :telemetry_metrics, repo: "hexpm", optional: false]}], "hexpm", "3a8625cab39ec261d48a13b7468dc619c0ede099601b084e343968309bd4d7d7"},
   "phoenix_live_reload": {:hex, :phoenix_live_reload, "1.6.2", "b18b0773a1ba77f28c52decbb0f10fd1ac4d3ae5b8632399bbf6986e3b665f62", [:mix], [{:file_system, "~> 0.2.10 or ~> 1.0", [hex: :file_system, repo: "hexpm", optional: false]}, {:phoenix, "~> 1.4", [hex: :phoenix, repo: "hexpm", optional: false]}], "hexpm", "d1f89c18114c50d394721365ffb428cce24f1c13de0467ffa773e2ff4a30d5b9"},
-  "phoenix_live_view": {:hex, :phoenix_live_view, "1.1.19", "c95e9acbc374fb796ee3e24bfecc8213123c74d9f9e45667ca40bb0a4d242953", [:mix], [{:igniter, ">= 0.6.16 and < 1.0.0-0", [hex: :igniter, repo: "hexpm", optional: true]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: true]}, {:lazy_html, "~> 0.1.0", [hex: :lazy_html, repo: "hexpm", optional: true]}, {:phoenix, "~> 1.6.15 or ~> 1.7.0 or ~> 1.8.0-rc", [hex: :phoenix, repo: "hexpm", optional: false]}, {:phoenix_html, "~> 3.3 or ~> 4.0", [hex: :phoenix_html, repo: "hexpm", optional: false]}, {:phoenix_template, "~> 1.0", [hex: :phoenix_template, repo: "hexpm", optional: false]}, {:phoenix_view, "~> 2.0", [hex: :phoenix_view, repo: "hexpm", optional: true]}, {:plug, "~> 1.15", [hex: :plug, repo: "hexpm", optional: false]}, {:telemetry, "~> 0.4.2 or ~> 1.0", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm", "d5ad357d6b21562a5b431f0ad09dfe76db9ce5648c6949f1aac334c8c4455d32"},
+  "phoenix_live_view": {:hex, :phoenix_live_view, "1.1.22", "9b3c985bfe38e82668594a8ce90008548f30b9f23b718ebaea4701710ce9006f", [:mix], [{:igniter, ">= 0.6.16 and < 1.0.0-0", [hex: :igniter, repo: "hexpm", optional: true]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: true]}, {:lazy_html, "~> 0.1.0", [hex: :lazy_html, repo: "hexpm", optional: true]}, {:phoenix, "~> 1.6.15 or ~> 1.7.0 or ~> 1.8.0-rc", [hex: :phoenix, repo: "hexpm", optional: false]}, {:phoenix_html, "~> 3.3 or ~> 4.0", [hex: :phoenix_html, repo: "hexpm", optional: false]}, {:phoenix_template, "~> 1.0", [hex: :phoenix_template, repo: "hexpm", optional: false]}, {:phoenix_view, "~> 2.0", [hex: :phoenix_view, repo: "hexpm", optional: true]}, {:plug, "~> 1.15", [hex: :plug, repo: "hexpm", optional: false]}, {:telemetry, "~> 0.4.2 or ~> 1.0", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm", "e1395d5622d8bf02113cb58183589b3da6f1751af235768816e90cc3ec5f1188"},
   "phoenix_pubsub": {:hex, :phoenix_pubsub, "2.2.0", "ff3a5616e1bed6804de7773b92cbccfc0b0f473faf1f63d7daf1206c7aeaaa6f", [:mix], [], "hexpm", "adc313a5bf7136039f63cfd9668fde73bba0765e0614cba80c06ac9460ff3e96"},
   "phoenix_template": {:hex, :phoenix_template, "1.0.4", "e2092c132f3b5e5b2d49c96695342eb36d0ed514c5b252a77048d5969330d639", [:mix], [{:phoenix_html, "~> 2.14.2 or ~> 3.0 or ~> 4.0", [hex: :phoenix_html, repo: "hexpm", optional: true]}], "hexpm", "2c0c81f0e5c6753faf5cca2f229c9709919aba34fab866d3bc05060c9c444206"},
   "phoenix_view": {:hex, :phoenix_view, "2.0.4", "b45c9d9cf15b3a1af5fb555c674b525391b6a1fe975f040fb4d913397b31abf4", [:mix], [{:phoenix_html, "~> 2.14.2 or ~> 3.0 or ~> 4.0", [hex: :phoenix_html, repo: "hexpm", optional: true]}, {:phoenix_template, "~> 1.0", [hex: :phoenix_template, repo: "hexpm", optional: false]}], "hexpm", "4e992022ce14f31fe57335db27a28154afcc94e9983266835bb3040243eb620b"},
   "picosat_elixir": {:hex, :picosat_elixir, "0.2.3", "bf326d0f179fbb3b706bb2c15fbc367dacfa2517157d090fdfc32edae004c597", [:make, :mix], [{:elixir_make, "~> 0.6", [hex: :elixir_make, repo: "hexpm", optional: false]}], "hexpm", "f76c9db2dec9d2561ffaa9be35f65403d53e984e8cd99c832383b7ab78c16c66"},
   "plug": {:hex, :plug, "1.19.1", "09bac17ae7a001a68ae393658aa23c7e38782be5c5c00c80be82901262c394c0", [:mix], [{:mime, "~> 1.0 or ~> 2.0", [hex: :mime, repo: "hexpm", optional: false]}, {:plug_crypto, "~> 1.1.1 or ~> 1.2 or ~> 2.0", [hex: :plug_crypto, repo: "hexpm", optional: false]}, {:telemetry, "~> 0.4.3 or ~> 1.0", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm", "560a0017a8f6d5d30146916862aaf9300b7280063651dd7e532b8be168511e62"},
   "plug_crypto": {:hex, :plug_crypto, "2.1.1", "19bda8184399cb24afa10be734f84a16ea0a2bc65054e23a62bb10f06bc89491", [:mix], [], "hexpm", "6470bce6ffe41c8bd497612ffde1a7e4af67f36a15eea5f921af71cf3e11247c"},
-  "postgrex": {:hex, :postgrex, "0.21.1", "2c5cc830ec11e7a0067dd4d623c049b3ef807e9507a424985b8dcf921224cd88", [:mix], [{:db_connection, "~> 2.1", [hex: :db_connection, repo: "hexpm", optional: false]}, {:decimal, "~> 1.5 or ~> 2.0", [hex: :decimal, repo: "hexpm", optional: false]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: true]}, {:table, "~> 0.1.0", [hex: :table, repo: "hexpm", optional: true]}], "hexpm", "27d8d21c103c3cc68851b533ff99eef353e6a0ff98dc444ea751de43eb48bdac"},
-  "reactor": {:hex, :reactor, "0.17.0", "eb8bdb530dbae824e2d36a8538f8ec4f3aa7c2d1b61b04959fa787c634f88b49", [:mix], [{:igniter, "~> 0.4", [hex: :igniter, repo: "hexpm", optional: true]}, {:iterex, "~> 0.1", [hex: :iterex, repo: "hexpm", optional: false]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: false]}, {:libgraph, "~> 0.16", [hex: :libgraph, repo: "hexpm", optional: false]}, {:spark, ">= 2.3.3 and < 3.0.0-0", [hex: :spark, repo: "hexpm", optional: false]}, {:splode, "~> 0.2", [hex: :splode, repo: "hexpm", optional: false]}, {:telemetry, "~> 1.2", [hex: :telemetry, repo: "hexpm", optional: false]}, {:yaml_elixir, "~> 2.11", [hex: :yaml_elixir, repo: "hexpm", optional: false]}, {:ymlr, "~> 5.0", [hex: :ymlr, repo: "hexpm", optional: false]}], "hexpm", "3c3bf71693adbad9117b11ec83cfed7d5851b916ade508ed9718de7ae165bf25"},
+  "postgrex": {:hex, :postgrex, "0.22.0", "fb027b58b6eab1f6de5396a2abcdaaeb168f9ed4eccbb594e6ac393b02078cbd", [:mix], [{:db_connection, "~> 2.9", [hex: :db_connection, repo: "hexpm", optional: false]}, {:decimal, "~> 1.5 or ~> 2.0", [hex: :decimal, repo: "hexpm", optional: false]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: true]}, {:table, "~> 0.1.0", [hex: :table, repo: "hexpm", optional: true]}], "hexpm", "a68c4261e299597909e03e6f8ff5a13876f5caadaddd0d23af0d0a61afcc5d84"},
+  "reactor": {:hex, :reactor, "1.0.0", "024bd13df910bcb8c01cebed4f10bd778269a141a1c8a234e4f67796ac4883cf", [:mix], [{:igniter, "~> 0.4", [hex: :igniter, repo: "hexpm", optional: true]}, {:iterex, "~> 0.1", [hex: :iterex, repo: "hexpm", optional: false]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: false]}, {:libgraph, "~> 0.16", [hex: :libgraph, repo: "hexpm", optional: false]}, {:spark, ">= 2.3.3 and < 3.0.0-0", [hex: :spark, repo: "hexpm", optional: false]}, {:splode, "~> 0.2", [hex: :splode, repo: "hexpm", optional: false]}, {:telemetry, "~> 1.2", [hex: :telemetry, repo: "hexpm", optional: false]}, {:yaml_elixir, "~> 2.11", [hex: :yaml_elixir, repo: "hexpm", optional: false]}, {:ymlr, "~> 5.0", [hex: :ymlr, repo: "hexpm", optional: false]}], "hexpm", "ae8eb507fffc517f5aa5947db9d2ede2db8bae63b66c94ccb5a2027d30f830a0"},
   "req": {:hex, :req, "0.5.17", "0096ddd5b0ed6f576a03dde4b158a0c727215b15d2795e59e0916c6971066ede", [:mix], [{:brotli, "~> 0.3.1", [hex: :brotli, repo: "hexpm", optional: true]}, {:ezstd, "~> 1.0", [hex: :ezstd, repo: "hexpm", optional: true]}, {:finch, "~> 0.17", [hex: :finch, repo: "hexpm", optional: false]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: false]}, {:mime, "~> 2.0.6 or ~> 2.1", [hex: :mime, repo: "hexpm", optional: false]}, {:nimble_csv, "~> 1.0", [hex: :nimble_csv, repo: "hexpm", optional: true]}, {:plug, "~> 1.0", [hex: :plug, repo: "hexpm", optional: true]}], "hexpm", "0b8bc6ffdfebbc07968e59d3ff96d52f2202d0536f10fef4dc11dc02a2a43e39"},
   "rewrite": {:hex, :rewrite, "1.2.0", "80220eb14010e175b67c939397e1a8cdaa2c32db6e2e0a9d5e23e45c0414ce21", [:mix], [{:glob_ex, "~> 0.1", [hex: :glob_ex, repo: "hexpm", optional: false]}, {:sourceror, "~> 1.0", [hex: :sourceror, repo: "hexpm", optional: false]}, {:text_diff, "~> 0.1", [hex: :text_diff, repo: "hexpm", optional: false]}], "hexpm", "a1cd702bbb9d51613ab21091f04a386d750fc6f4516b81900df082d78b2d8c50"},
   "slugify": {:hex, :slugify, "1.3.1", "0d3b8b7e5c1eeaa960e44dce94382bee34a39b3ea239293e457a9c5b47cc6fd3", [:mix], [], "hexpm", "cb090bbeb056b312da3125e681d98933a360a70d327820e4b7f91645c4d8be76"},
   "sobelow": {:hex, :sobelow, "0.14.1", "2f81e8632f15574cba2402bcddff5497b413c01e6f094bc0ab94e83c2f74db81", [:mix], [{:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: false]}], "hexpm", "8fac9a2bd90fdc4b15d6fca6e1608efb7f7c600fa75800813b794ee9364c87f2"},
-  "sourceror": {:hex, :sourceror, "1.10.0", "38397dedbbc286966ec48c7af13e228b171332be1ad731974438c77791945ce9", [:mix], [], "hexpm", "29dbdfc92e04569c9d8e6efdc422fc1d815f4bd0055dc7c51b8800fb75c4b3f1"},
-  "spark": {:hex, :spark, "2.3.14", "a08420d08e6e0e49d740aed3e160f1cb894ba8f6b3f5e6c63253e9df1995265c", [:mix], [{:igniter, ">= 0.3.64 and < 1.0.0-0", [hex: :igniter, repo: "hexpm", optional: true]}, {:jason, "~> 1.4", [hex: :jason, repo: "hexpm", optional: true]}, {:sourceror, "~> 1.2", [hex: :sourceror, repo: "hexpm", optional: true]}], "hexpm", "af50c4ea5dd67eba822247f1c98e1d4e598cb7f6c28ccf5d002f0e0718096f4f"},
-  "spitfire": {:hex, :spitfire, "0.2.1", "29e154873f05444669c7453d3d931820822cbca5170e88f0f8faa1de74a79b47", [:mix], [], "hexpm", "6eeed75054a38341b2e1814d41bb0a250564092358de2669fdb57ff88141d91b"},
-  "splode": {:hex, :splode, "0.2.10", "f755ebc8e5dc1556869c0513cf5f3450be602a41e01196249306483c4badbec0", [:mix], [], "hexpm", "906b6dc17b7ebc9b9fd9a31360bf0bd691d20e934fb28795c0ddb0c19d3198f1"},
+  "sourceror": {:hex, :sourceror, "1.10.1", "325753ed460fe9fa34ebb4deda76d57b2e1507dcd78a5eb9e1c41bfb78b7cdfe", [:mix], [], "hexpm", "288f3079d93865cd1e3e20df5b884ef2cb440e0e03e8ae393624ee8a770ba588"},
+  "spark": {:hex, :spark, "2.4.0", "f93d3ae6b5f3004e956d52f359fa40670366685447631bc7c058f4fbf250ebf3", [:mix], [{:igniter, ">= 0.3.64 and < 1.0.0-0", [hex: :igniter, repo: "hexpm", optional: true]}, {:jason, "~> 1.4", [hex: :jason, repo: "hexpm", optional: true]}, {:sourceror, "~> 1.2", [hex: :sourceror, repo: "hexpm", optional: true]}], "hexpm", "4e5185f5737cd987bb9ef377ae3462a55b8312f5007c2bc4ad6e850d14ac0111"},
+  "spitfire": {:hex, :spitfire, "0.3.3", "be195b27648f21454932bf46014455cdbce4fca55fef1f0e41d36076c47b6c4a", [], [], "hexpm", "5dc51c3b61a1d98cdcac1c130f0a374d22d51beed982df90834bdd616356e1fa"},
+  "splode": {:hex, :splode, "0.3.0", "ff8effecc509a51245df2f864ec78d849248647c37a75886033e3b1a53ca9470", [:mix], [], "hexpm", "73cfd0892d7316d6f2c93e6e8784bd6e137b2aa38443de52fd0a25171d106d81"},
   "stream_data": {:hex, :stream_data, "1.2.0", "58dd3f9e88afe27dc38bef26fce0c84a9e7a96772b2925c7b32cd2435697a52b", [:mix], [], "hexpm", "eb5c546ee3466920314643edf68943a5b14b32d1da9fe01698dc92b73f89a9ed"},
   "sweet_xml": {:hex, :sweet_xml, "0.7.5", "803a563113981aaac202a1dbd39771562d0ad31004ddbfc9b5090bdcd5605277", [:mix], [], "hexpm", "193b28a9b12891cae351d81a0cead165ffe67df1b73fe5866d10629f4faefb12"},
-  "swoosh": {:hex, :swoosh, "1.20.0", "b04134c2b302da74c3a95ca4ddde191e4854d2847d6687783fecb023a9647598", [:mix], [{:bandit, ">= 1.0.0", [hex: :bandit, repo: "hexpm", optional: true]}, {:cowboy, "~> 1.1 or ~> 2.4", [hex: :cowboy, repo: "hexpm", optional: true]}, {:ex_aws, "~> 2.1", [hex: :ex_aws, repo: "hexpm", optional: true]}, {:finch, "~> 0.6", [hex: :finch, repo: "hexpm", optional: true]}, {:gen_smtp, "~> 0.13 or ~> 1.0", [hex: :gen_smtp, repo: "hexpm", optional: true]}, {:hackney, "~> 1.9", [hex: :hackney, repo: "hexpm", optional: true]}, {:idna, "~> 6.0", [hex: :idna, repo: "hexpm", optional: false]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: false]}, {:mail, "~> 0.2", [hex: :mail, repo: "hexpm", optional: true]}, {:mime, "~> 1.1 or ~> 2.0", [hex: :mime, repo: "hexpm", optional: false]}, {:mua, "~> 0.2.3", [hex: :mua, repo: "hexpm", optional: true]}, {:multipart, "~> 0.4", [hex: :multipart, repo: "hexpm", optional: true]}, {:plug, "~> 1.9", [hex: :plug, repo: "hexpm", optional: true]}, {:plug_cowboy, ">= 1.0.0", [hex: :plug_cowboy, repo: "hexpm", optional: true]}, {:req, "~> 0.5.10 or ~> 0.6 or ~> 1.0", [hex: :req, repo: "hexpm", optional: true]}, {:telemetry, "~> 0.4.2 or ~> 1.0", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm", "13e610f709bae54851d68afb6862882aa646e5c974bf49e3bf5edd84a73cf213"},
+  "swoosh": {:hex, :swoosh, "1.21.0", "9f4fa629447774cfc9ad684d8a87a85384e8fce828b6390dd535dfbd43c9ee2a", [:mix], [{:bandit, ">= 1.0.0", [hex: :bandit, repo: "hexpm", optional: true]}, {:cowboy, "~> 1.1 or ~> 2.4", [hex: :cowboy, repo: "hexpm", optional: true]}, {:ex_aws, "~> 2.1", [hex: :ex_aws, repo: "hexpm", optional: true]}, {:finch, "~> 0.6", [hex: :finch, repo: "hexpm", optional: true]}, {:gen_smtp, "~> 0.13 or ~> 1.0", [hex: :gen_smtp, repo: "hexpm", optional: true]}, {:hackney, "~> 1.9", [hex: :hackney, repo: "hexpm", optional: true]}, {:idna, "~> 6.0", [hex: :idna, repo: "hexpm", optional: false]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: false]}, {:mail, "~> 0.2", [hex: :mail, repo: "hexpm", optional: true]}, {:mime, "~> 1.1 or ~> 2.0", [hex: :mime, repo: "hexpm", optional: false]}, {:mua, "~> 0.2.3", [hex: :mua, repo: "hexpm", optional: true]}, {:multipart, "~> 0.4", [hex: :multipart, repo: "hexpm", optional: true]}, {:plug, "~> 1.9", [hex: :plug, repo: "hexpm", optional: true]}, {:plug_cowboy, ">= 1.0.0", [hex: :plug_cowboy, repo: "hexpm", optional: true]}, {:req, "~> 0.5.10 or ~> 0.6 or ~> 1.0", [hex: :req, repo: "hexpm", optional: true]}, {:telemetry, "~> 0.4.2 or ~> 1.0", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm", "9127157bfb33b7e154d0f1ba4e888e14b08ede84e81dedcb318a2f33dbc6db51"},
   "tailwind": {:hex, :tailwind, "0.4.1", "e7bcc222fe96a1e55f948e76d13dd84a1a7653fb051d2a167135db3b4b08d3e9", [:mix], [], "hexpm", "6249d4f9819052911120dbdbe9e532e6bd64ea23476056adb7f730aa25c220d1"},
   "telemetry": {:hex, :telemetry, "1.3.0", "fedebbae410d715cf8e7062c96a1ef32ec22e764197f70cda73d82778d61e7a2", [:rebar3], [], "hexpm", "7015fc8919dbe63764f4b4b87a95b7c0996bd539e0d499be6ec9d7f3875b79e6"},
   "telemetry_metrics": {:hex, :telemetry_metrics, "1.1.0", "5bd5f3b5637e0abea0426b947e3ce5dd304f8b3bc6617039e2b5a008adc02f8f", [:mix], [{:telemetry, "~> 0.4 or ~> 1.0", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm", "e7b79e8ddfde70adb6db8a6623d1778ec66401f366e9a8f5dd0955c56bc8ce67"},

priv/gettext/de/LC_MESSAGES/auth.po

@@ -67,7 +67,7 @@ msgstr "Das Passwort wurde erfolgreich zurückgesetzt"
 #: lib/mv_web/live/auth/link_oidc_account_live.ex
 #, elixir-autogen, elixir-format
 msgid "An account with email %{email} already exists. Please enter your password to link your OIDC account."
-msgstr "Ein Konto mit der E-Mail %{email} existiert bereits. Bitte geben Sie Ihr Passwort ein, um Ihr OIDC-Konto zu verknüpfen."
+msgstr "Ein Konto mit der E-Mail %{email} existiert bereits. Bitte gib dein Passwort ein, um dein OIDC-Konto zu verknüpfen."
 
 #: lib/mv_web/live/auth/link_oidc_account_live.ex
 #, elixir-autogen, elixir-format
@@ -77,12 +77,12 @@ msgstr "Abbrechen"
 #: lib/mv_web/live/auth/link_oidc_account_live.ex
 #, elixir-autogen, elixir-format
 msgid "Incorrect password. Please try again."
-msgstr "Falsches Passwort. Bitte versuchen Sie es erneut."
+msgstr "Falsches Passwort. Bitte versuche es erneut."
 
 #: lib/mv_web/live/auth/link_oidc_account_live.ex
 #, elixir-autogen, elixir-format
 msgid "Invalid session. Please try again."
-msgstr "Ungültige Sitzung. Bitte versuchen Sie es erneut."
+msgstr "Ungültige Sitzung. Bitte versuche es erneut."
 
 #: lib/mv_web/live/auth/link_oidc_account_live.ex
 #, elixir-autogen, elixir-format
@@ -102,32 +102,32 @@ msgstr "Verknüpfen..."
 #: lib/mv_web/live/auth/link_oidc_account_live.ex
 #, elixir-autogen, elixir-format
 msgid "Session expired. Please try again."
-msgstr "Sitzung abgelaufen. Bitte versuchen Sie es erneut."
+msgstr "Sitzung abgelaufen. Bitte versuche es erneut."
 
 #: lib/mv_web/live/auth/link_oidc_account_live.ex
 #, elixir-autogen, elixir-format
 msgid "Your OIDC account has been successfully linked! Redirecting to complete sign-in..."
-msgstr "Ihr OIDC-Konto wurde erfolgreich verknüpft! Sie werden zur Anmeldung weitergeleitet..."
+msgstr "Dein OIDC-Konto wurde erfolgreich verknüpft! Du wirst zur Anmeldung weitergeleitet..."
 
 #: lib/mv_web/live/auth/link_oidc_account_live.ex
 #, elixir-autogen, elixir-format
 msgid "Account activated! Redirecting to complete sign-in..."
-msgstr "Konto aktiviert! Sie werden zur Anmeldung weitergeleitet..."
+msgstr "Konto aktiviert! Du wirst zur Anmeldung weitergeleitet..."
 
 #: lib/mv_web/live/auth/link_oidc_account_live.ex
 #, elixir-autogen, elixir-format
 msgid "Failed to link account. Please try again or contact support."
-msgstr "Verknüpfung des Kontos fehlgeschlagen. Bitte versuchen Sie es erneut oder kontaktieren Sie den Support."
+msgstr "Verknüpfung des Kontos fehlgeschlagen. Bitte versuche es erneut oder kontaktiere den Support."
 
 #: lib/mv_web/live/auth/link_oidc_account_live.ex
 #, elixir-autogen, elixir-format
 msgid "The email address from your OIDC provider is already registered to another account. Please change your email in the identity provider or contact support."
-msgstr "Die E-Mail-Adresse aus Ihrem OIDC-Provider ist bereits für ein anderes Konto registriert. Bitte ändern Sie Ihre E-Mail-Adresse im Identity-Provider oder kontaktieren Sie den Support."
+msgstr "Die E-Mail-Adresse aus deinem OIDC-Provider ist bereits für ein anderes Konto registriert. Bitte ändere deine E-Mail-Adresse im Identity-Provider oder kontaktiere den Support."
 
 #: lib/mv_web/live/auth/link_oidc_account_live.ex
 #, elixir-autogen, elixir-format
 msgid "This OIDC account is already linked to another user. Please contact support."
-msgstr "Dieses OIDC-Konto ist bereits mit einem anderen Benutzer verknüpft. Bitte kontaktieren Sie den Support."
+msgstr "Dieses OIDC-Konto ist bereits mit einem anderen Benutzer verknüpft. Bitte kontaktiere den Support."
 
 #: lib/mv_web/live/auth/link_oidc_account_live.ex
 #, elixir-autogen, elixir-format

priv/gettext/de/LC_MESSAGES/default.po

@@ -240,27 +240,27 @@ msgstr "Mitglied wurde erfolgreich %{action}"
 #: lib/mv_web/controllers/auth_controller.ex
 #, elixir-autogen, elixir-format
 msgid "You are now signed in"
-msgstr "Sie sind jetzt angemeldet"
+msgstr "Du bist jetzt angemeldet"
 
 #: lib/mv_web/controllers/auth_controller.ex
 #, elixir-autogen, elixir-format
 msgid "You are now signed out"
-msgstr "Sie sind jetzt abgemeldet"
+msgstr "Du bist jetzt abgemeldet"
 
 #: lib/mv_web/controllers/auth_controller.ex
 #, elixir-autogen, elixir-format
 msgid "You have already signed in another way, but have not confirmed your account.\nYou can confirm your account using the link we sent to you, or by resetting your password.\n"
-msgstr "Sie haben sich bereits auf andere Weise angemeldet, aber Ihr Konto noch nicht bestätigt.\nSie können Ihr Konto über den Link bestätigen, den wir Ihnen gesendet haben, oder durch Zurücksetzen Ihres Passworts.\n"
+msgstr "Du hast dich bereits auf andere Weise angemeldet, aber dein Konto noch nicht bestätigt.\nDu kannst dein Konto über den Link bestätigen, den wir dir gesendet haben, oder durch Zurücksetzen deines Passworts.\n"
 
 #: lib/mv_web/controllers/auth_controller.ex
 #, elixir-autogen, elixir-format
 msgid "Your email address has now been confirmed"
-msgstr "Ihre E-Mail-Adresse wurde bestätigt"
+msgstr "Deine E-Mail-Adresse wurde bestätigt"
 
 #: lib/mv_web/controllers/auth_controller.ex
 #, elixir-autogen, elixir-format
 msgid "Your password has successfully been reset"
-msgstr "Ihr Passwort wurde erfolgreich zurückgesetzt"
+msgstr "Dein Passwort wurde erfolgreich zurückgesetzt"
 
 #: lib/mv_web/live/custom_field_live/form_component.ex
 #: lib/mv_web/live/custom_field_live/index_component.ex
@@ -295,6 +295,7 @@ msgstr "Beschreibung"
 msgid "Edit User"
 msgstr "Benutzer*in bearbeiten"
 
+#: lib/mv_web/live/user_live/index.html.heex
 #: lib/mv_web/live/user_live/show.ex
 #, elixir-autogen, elixir-format
 msgid "Enabled"
@@ -399,7 +400,7 @@ msgstr "Dies ist ein Benutzer*innen-Datensatz aus Ihrer Datenbank."
 #: lib/mv_web/live/user_live/form.ex
 #, elixir-autogen, elixir-format
 msgid "Use this form to manage user records in your database."
-msgstr "Verwenden Sie dieses Formular, um Benutzer*innen-Datensätze zu verwalten."
+msgstr "Verwende dieses Formular, um Benutzer*innen-Datensätze zu verwalten."
 
 #: lib/mv_web/live/user_live/form.ex
 #: lib/mv_web/live/user_live/show.ex
@@ -439,7 +440,7 @@ msgstr "Administrator*innen-Hinweis"
 #: lib/mv_web/live/user_live/form.ex
 #, elixir-autogen, elixir-format, fuzzy
 msgid "As an administrator, you can directly set a new password for this user using the same secure Ash Authentication system."
-msgstr "Als Administrator*in können Sie direkt ein neues Passwort für diese*n Benutzer*in setzen."
+msgstr "Als Administrator*in kannst du direkt ein neues Passwort für diese*n Benutzer*in setzen."
 
 #: lib/mv_web/live/user_live/form.ex
 #, elixir-autogen, elixir-format
@@ -454,7 +455,7 @@ msgstr "Passwort ändern"
 #: lib/mv_web/live/user_live/form.ex
 #, elixir-autogen, elixir-format
 msgid "Check 'Change Password' above to set a new password for this user."
-msgstr "Aktivieren Sie 'Passwort ändern' oben, um ein neues Passwort für diese*n Benutzer*in zu setzen."
+msgstr "Aktiviere 'Passwort ändern' oben, um ein neues Passwort für diese*n Benutzer*in zu setzen."
 
 #: lib/mv_web/live/user_live/form.ex
 #, elixir-autogen, elixir-format
@@ -472,6 +473,7 @@ msgid "Include both letters and numbers"
 msgstr "Buchstaben und Zahlen verwenden"
 
 #: lib/mv_web/live/user_live/form.ex
+#: lib/mv_web/live/user_live/index.html.heex
 #, elixir-autogen, elixir-format
 msgid "Password"
 msgstr "Passwort"
@@ -499,7 +501,7 @@ msgstr "Passwort setzen"
 #: lib/mv_web/live/user_live/form.ex
 #, elixir-autogen, elixir-format
 msgid "User will be created without a password. Check 'Set Password' to add one."
-msgstr "Benutzer*in wird ohne Passwort erstellt. Aktivieren Sie 'Passwort setzen', um eines hinzuzufügen."
+msgstr "Benutzer*in wird ohne Passwort erstellt. Aktiviere 'Passwort setzen', um eines hinzuzufügen."
 
 #: lib/mv_web/live/user_live/form.ex
 #: lib/mv_web/live/user_live/index.html.heex
@@ -569,27 +571,27 @@ msgstr "Vorname"
 #: lib/mv_web/controllers/auth_controller.ex
 #, elixir-autogen, elixir-format
 msgid "An account with this email already exists. Please verify your password to link your OIDC account."
-msgstr "Ein Konto mit dieser E-Mail existiert bereits. Bitte verifizieren Sie Ihr Passwort, um Ihr OIDC-Konto zu verknüpfen."
+msgstr "Ein Konto mit dieser E-Mail existiert bereits. Bitte verifiziere dein Passwort, um dein OIDC-Konto zu verknüpfen."
 
 #: lib/mv_web/controllers/auth_controller.ex
 #, elixir-autogen, elixir-format
 msgid "Unable to authenticate with OIDC. Please try again."
-msgstr "OIDC-Authentifizierung fehlgeschlagen. Bitte versuchen Sie es erneut."
+msgstr "OIDC-Authentifizierung fehlgeschlagen. Bitte versuche es erneut."
 
 #: lib/mv_web/controllers/auth_controller.ex
 #, elixir-autogen, elixir-format
 msgid "Unable to sign in. Please try again."
-msgstr "Anmeldung fehlgeschlagen. Bitte versuchen Sie es erneut."
+msgstr "Anmeldung fehlgeschlagen. Bitte versuche es erneut."
 
 #: lib/mv_web/controllers/auth_controller.ex
 #, elixir-autogen, elixir-format
 msgid "Authentication failed. Please try again."
-msgstr "Authentifizierung fehlgeschlagen. Bitte versuchen Sie es erneut."
+msgstr "Authentifizierung fehlgeschlagen. Bitte versuche es erneut."
 
 #: lib/mv_web/controllers/auth_controller.ex
 #, elixir-autogen, elixir-format
 msgid "Cannot update email: This email is already registered to another account. Please change your email in the identity provider."
-msgstr "E-Mail kann nicht aktualisiert werden: Diese E-Mail-Adresse ist bereits für ein anderes Konto registriert. Bitte ändern Sie Ihre E-Mail-Adresse im Identity-Provider."
+msgstr "E-Mail kann nicht aktualisiert werden: Diese E-Mail-Adresse ist bereits für ein anderes Konto registriert. Bitte ändere deine E-Mail-Adresse im Identity-Provider."
 
 #: lib/mv_web/controllers/auth_controller.ex
 #, elixir-autogen, elixir-format
@@ -667,7 +669,7 @@ msgstr "Einstellungen erfolgreich gespeichert"
 #: lib/mv_web/live/user_live/form.ex
 #, elixir-autogen, elixir-format
 msgid "A member with this email already exists. To link with a different member, please change one of the email addresses first."
-msgstr "Ein Mitglied mit dieser E-Mail-Adresse existiert bereits. Um mit einem anderen Mitglied zu verknüpfen, ändern Sie bitte zuerst eine der E-Mail-Adressen."
+msgstr "Ein Mitglied mit dieser E-Mail-Adresse existiert bereits. Um mit einem anderen Mitglied zu verknüpfen, ändere bitte zuerst eine der E-Mail-Adressen."
 
 #: lib/mv_web/live/group_live/show.ex
 #: lib/mv_web/live/user_live/form.ex
@@ -960,7 +962,6 @@ msgid "Last name"
 msgstr "Nachname"
 
 #: lib/mv_web/components/core_components.ex
-#: lib/mv_web/live/member_live/form.ex
 #, elixir-autogen, elixir-format
 msgid "None"
 msgstr "Keine"
@@ -1073,7 +1074,7 @@ msgstr "Ein Fehler ist aufgetreten"
 #: lib/mv_web/live/member_live/show/membership_fees_component.ex
 #, elixir-autogen, elixir-format
 msgid "Are you sure you want to delete this cycle?"
-msgstr "Möchten Sie diesen Zyklus wirklich löschen?"
+msgstr "Möchtest du diesen Zyklus wirklich löschen?"
 
 #: lib/mv_web/live/membership_fee_type_live/index.ex
 #, elixir-autogen, elixir-format
@@ -1093,7 +1094,7 @@ msgstr "Die Änderung des Betrags betrifft %{count} Mitglied(er)."
 #: lib/mv_web/live/member_live/show/membership_fees_component.ex
 #, elixir-autogen, elixir-format
 msgid "Click to edit amount"
-msgstr "Klicken Sie, um den Betrag zu bearbeiten"
+msgstr "Klicke, um den Betrag zu bearbeiten"
 
 #: lib/mv_web/live/membership_fee_settings_live.ex
 #, elixir-autogen, elixir-format, fuzzy
@@ -1297,6 +1298,7 @@ msgid "Membership Fee Settings"
 msgstr "Mitgliedsbeitragseinstellungen"
 
 #: lib/mv_web/live/member_live/index.html.heex
+#: lib/mv_web/translations/member_fields.ex
 #, elixir-autogen, elixir-format, fuzzy
 msgid "Membership Fee Status"
 msgstr "Mitgliedsbeitragsstatus"
@@ -1413,7 +1415,7 @@ msgstr "Zahlungsintervall"
 #: lib/mv_web/live/membership_fee_type_live/form.ex
 #, elixir-autogen, elixir-format
 msgid "Please confirm the amount change first"
-msgstr "Bitte bestätigen Sie zuerst die Betragsänderung"
+msgstr "Bitte bestätige zuerst die Betragsänderung"
 
 #: lib/mv_web/live/membership_fee_settings_live.ex
 #, elixir-autogen, elixir-format, fuzzy
@@ -1443,7 +1445,7 @@ msgstr "Mitgliedsbeitragsart speichern"
 #: lib/mv_web/live/member_live/form.ex
 #, elixir-autogen, elixir-format
 msgid "Select a membership fee type for this member. Members can only switch between types with the same interval."
-msgstr "Wählen Sie eine Mitgliedsbeitragsart für dieses Mitglied. Mitglieder können nur zwischen Arten mit demselben Intervall wechseln."
+msgstr "Wähle eine Mitgliedsbeitragsart für dieses Mitglied. Mitglieder können nur zwischen Arten mit demselben Intervall wechseln."
 
 #: lib/mv_web/live/membership_fee_type_live/form.ex
 #, elixir-autogen, elixir-format
@@ -1484,12 +1486,12 @@ msgstr "Art"
 #: lib/mv_web/live/member_live/show/membership_fees_component.ex
 #, elixir-autogen, elixir-format
 msgid "Type '%{confirmation}' to confirm"
-msgstr "Geben Sie '%{confirmation}' ein, um zu bestätigen"
+msgstr "Gib '%{confirmation}' ein, um zu bestätigen"
 
 #: lib/mv_web/live/membership_fee_type_live/form.ex
 #, elixir-autogen, elixir-format
 msgid "Use this form to manage membership fee types in your database."
-msgstr "Verwenden Sie dieses Formular, um Mitgliedsbeitragsarten in Ihrer Datenbank zu verwalten."
+msgstr "Verwende dieses Formular, um Mitgliedsbeitragsarten in deiner Datenbank zu verwalten."
 
 #: lib/mv_web/live/member_live/show/membership_fees_component.ex
 #, elixir-autogen, elixir-format
@@ -1500,7 +1502,7 @@ msgstr "Warnung"
 #: lib/mv_web/live/member_live/show/membership_fees_component.ex
 #, elixir-autogen, elixir-format
 msgid "Warning: Changing from %{old_interval} to %{new_interval} is not allowed. Please select a membership fee type with the same interval."
-msgstr "Warnung: Wechsel von %{old_interval} zu %{new_interval} ist nicht erlaubt. Bitte wählen Sie eine Mitgliedsbeitragsart mit demselben Intervall."
+msgstr "Warnung: Wechsel von %{old_interval} zu %{new_interval} ist nicht erlaubt. Bitte wähle eine Mitgliedsbeitragsart mit demselben Intervall."
 
 #: lib/mv_web/live/membership_fee_settings_live.ex
 #, elixir-autogen, elixir-format, fuzzy
@@ -1535,7 +1537,7 @@ msgstr "Mitgliedsbeitragsart löschen"
 #: lib/mv_web/translations/member_fields.ex
 #, elixir-autogen, elixir-format, fuzzy
 msgid "Membership Fee Start Date"
-msgstr "Mitgliedsbeitragsstatus"
+msgstr "Startdatum Mitgliedsbeitrag"
 
 #: lib/mv_web/live/components/field_visibility_dropdown_component.ex
 #, elixir-autogen, elixir-format
@@ -1624,7 +1626,7 @@ msgstr "Verwalte Benutzer*innen-Rollen und ihre Berechtigungssätze."
 #: lib/mv_web/live/role_live/show.ex
 #, elixir-autogen, elixir-format
 msgid "Cannot delete role. %{count} user(s) are still assigned to this role. Please assign them to another role first."
-msgstr "Rolle kann nicht gelöscht werden. %{count} Benutzer*in(nen) sind dieser Rolle noch zugeordnet. Bitte weisen Sie sie zunächst einer anderen Rolle zu."
+msgstr "Rolle kann nicht gelöscht werden. %{count} Benutzer*in(nen) sind dieser Rolle noch zugeordnet. Bitte weise sie zunächst einer anderen Rolle zu."
 
 #: lib/mv_web/components/layouts/sidebar.ex
 #, elixir-autogen, elixir-format
@@ -1672,6 +1674,9 @@ msgstr "Profil"
 
 #: lib/mv_web/live/role_live/form.ex
 #: lib/mv_web/live/role_live/show.ex
+#: lib/mv_web/live/user_live/form.ex
+#: lib/mv_web/live/user_live/index.html.heex
+#: lib/mv_web/live/user_live/show.ex
 #, elixir-autogen, elixir-format
 msgid "Role"
 msgstr "Rolle"
@@ -1744,7 +1749,7 @@ msgstr "Sidebar umschalten"
 #: lib/mv_web/live/role_live/form.ex
 #, elixir-autogen, elixir-format
 msgid "Use this form to manage roles in your database."
-msgstr "Verwenden Sie dieses Formular, um Rollen in Ihrer Datenbank zu verwalten."
+msgstr "Verwende dieses Formular, um Rollen in deiner Datenbank zu verwalten."
 
 #: lib/mv_web/components/layouts/sidebar.ex
 #, elixir-autogen, elixir-format
@@ -1774,7 +1779,7 @@ msgstr "read_only - Lesezugriff auf alle Daten"
 #: lib/mv_web/live/member_live/form.ex
 #, elixir-autogen, elixir-format
 msgid "You do not have permission to %{action} members."
-msgstr "Sie haben keine Berechtigung, Mitglieder zu %{action}."
+msgstr "Du hast keine Berechtigung, Mitglieder zu %{action}."
 
 #: lib/mv_web/live/member_live/show/membership_fees_component.ex
 #, elixir-autogen, elixir-format
@@ -1819,22 +1824,22 @@ msgstr "Benutzer*in nicht gefunden"
 #: lib/mv_web/live/membership_fee_type_live/index.ex
 #, elixir-autogen, elixir-format
 msgid "You do not have permission to access this membership fee type"
-msgstr "Sie haben keine Berechtigung, auf diese Mitgliedsbeitragsart zuzugreifen"
+msgstr "Du hast keine Berechtigung, auf diese Mitgliedsbeitragsart zuzugreifen"
 
 #: lib/mv_web/live/user_live/index.ex
 #, elixir-autogen, elixir-format
 msgid "You do not have permission to access this user"
-msgstr "Sie haben keine Berechtigung, auf diese*n Benutzer*in zuzugreifen"
+msgstr "Du hast keine Berechtigung, auf diese*n Benutzer*in zuzugreifen"
 
 #: lib/mv_web/live/membership_fee_type_live/index.ex
 #, elixir-autogen, elixir-format
 msgid "You do not have permission to delete this membership fee type"
-msgstr "Sie haben keine Berechtigung, diese Mitgliedsbeitragsart zu löschen"
+msgstr "Du hast keine Berechtigung, diese Mitgliedsbeitragsart zu löschen"
 
 #: lib/mv_web/live/user_live/index.ex
 #, elixir-autogen, elixir-format
 msgid "You do not have permission to delete this user"
-msgstr "Sie haben keine Berechtigung, diese*n Benutzer*in zu löschen"
+msgstr "Du hast keine Berechtigung, diese*n Benutzer*in zu löschen"
 
 #: lib/mv_web/live/user_live/form.ex
 #, elixir-autogen, elixir-format, fuzzy
@@ -1846,7 +1851,7 @@ msgstr "erstellt"
 msgid "updated"
 msgstr "aktualisiert"
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #: lib/mv_web/live/user_live/form.ex
 #, elixir-autogen, elixir-format
 msgid "Unknown error"
@@ -1865,12 +1870,12 @@ msgstr "Mitglied nicht gefunden"
 #: lib/mv_web/live/member_live/index.ex
 #, elixir-autogen, elixir-format
 msgid "You do not have permission to access this member"
-msgstr "Sie haben keine Berechtigung, auf dieses Mitglied zuzugreifen"
+msgstr "Du hast keine Berechtigung, auf dieses Mitglied zuzugreifen"
 
 #: lib/mv_web/live/member_live/index.ex
 #, elixir-autogen, elixir-format
 msgid "You do not have permission to delete this member"
-msgstr "Sie haben keine Berechtigung, dieses Mitglied zu löschen"
+msgstr "Du hast keine Berechtigung, dieses Mitglied zu löschen"
 
 #: lib/mv_web/live/member_live/form.ex
 #, elixir-autogen, elixir-format
@@ -1920,17 +1925,17 @@ msgstr "Fehler beim %{action} des Mitglieds."
 #: lib/mv_web/live/member_live/form.ex
 #, elixir-autogen, elixir-format
 msgid "Failed to save member. Please try again."
-msgstr "Fehler beim Speichern des Mitglieds. Bitte versuchen Sie es erneut."
+msgstr "Fehler beim Speichern des Mitglieds. Bitte versuche es erneut."
 
 #: lib/mv_web/live/member_live/form.ex
 #, elixir-autogen, elixir-format
 msgid "Please correct the errors in the form and try again."
-msgstr "Bitte korrigieren Sie die Fehler im Formular und versuchen Sie es erneut."
+msgstr "Bitte korrigiere die Fehler im Formular und versuche es erneut."
 
 #: lib/mv_web/live/member_live/form.ex
 #, elixir-autogen, elixir-format
 msgid "Validation failed. Please check your input."
-msgstr "Validierung fehlgeschlagen. Bitte überprüfen Sie Ihre Eingabe."
+msgstr "Validierung fehlgeschlagen. Bitte überprüfe deine Eingabe."
 
 #: lib/mv_web/live/member_live/form.ex
 #, elixir-autogen, elixir-format
@@ -1967,152 +1972,137 @@ msgstr "Bezahlstatus"
 msgid "Reset"
 msgstr "Zurücksetzen"
 
-#: lib/mv_web/live/member_live/show/membership_fees_component.ex
-#, elixir-autogen, elixir-format
-msgid "Only administrators can regenerate cycles"
-msgstr "Nur Administrator*innen können Zyklen regenerieren"
-
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid " (Field: %{field})"
 msgstr " (Datenfeld: %{field})"
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "CSV File"
 msgstr "CSV Datei"
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "Download CSV templates:"
 msgstr "CSV Vorlagen herunterladen:"
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "English Template"
 msgstr "Englische Vorlage"
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "Error list truncated to %{count} entries"
 msgstr "Liste der Fehler auf %{count} Einträge reduziert"
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "Errors"
 msgstr "Fehler"
 
-#: lib/mv_web/live/global_settings_live.ex
-#, elixir-autogen, elixir-format
-msgid "Failed to prepare CSV import: %{error}"
-msgstr "Das Vorbereiten des CSV Imports ist gescheitert: %{error}"
-
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live.ex
 #, elixir-autogen, elixir-format
 msgid "Failed to prepare CSV import: %{reason}"
 msgstr "Das Vorbereiten des CSV Imports ist gescheitert: %{reason}"
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv/membership/import/import_runner.ex
 #, elixir-autogen, elixir-format
 msgid "Failed to process chunk %{idx}: %{reason}"
 msgstr "Das Importieren von %{idx} ist gescheitert: %{reason}"
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv/membership/import/import_runner.ex
 #, elixir-autogen, elixir-format, fuzzy
 msgid "Failed to read file: %{reason}"
 msgstr "Fehler beim Lesen der Datei: %{reason}"
 
-#: lib/mv_web/live/global_settings_live.ex
-#, elixir-autogen, elixir-format
-msgid "Failed to read uploaded file"
-msgstr "Fehler beim Lesen der hochgeladenen Datei"
-
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "Failed: %{count} row(s)"
 msgstr "Fehlgeschlagen: %{count} Zeile(n)"
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "German Template"
 msgstr "Deutsche Vorlage"
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live.ex
 #, elixir-autogen, elixir-format
 msgid "Import Members (CSV)"
 msgstr "Mitglieder importieren (CSV)"
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "Import Results"
 msgstr "Import-Ergebnisse"
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live.ex
 #, elixir-autogen, elixir-format
 msgid "Import is already running. Please wait for it to complete."
-msgstr "Import läuft bereits. Bitte warten Sie, bis er abgeschlossen ist."
+msgstr "Import läuft bereits. Bitte warte, bis er abgeschlossen ist."
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv/membership/import/import_runner.ex
 #, elixir-autogen, elixir-format
 msgid "Import state is missing. Cannot process chunk %{idx}."
 msgstr "Import-Status fehlt. Chunk %{idx} kann nicht verarbeitet werden."
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv/membership/import/import_runner.ex
 #, elixir-autogen, elixir-format
 msgid "Invalid chunk index: %{idx}"
 msgstr "Ungültiger Chunk-Index: %{idx}"
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "Line %{line}: %{message}"
 msgstr "Zeile %{line}: %{message}"
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv/membership/import/import_runner.ex
 #, elixir-autogen, elixir-format
 msgid "No file was uploaded"
 msgstr "Es wurde keine Datei hochgeladen"
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live.ex
 #, elixir-autogen, elixir-format
 msgid "Only administrators can import members from CSV files."
 msgstr "Nur Administrator*innen können Mitglieder aus CSV-Dateien importieren."
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live.ex
 #, elixir-autogen, elixir-format
 msgid "Please select a CSV file to import."
-msgstr "Bitte wählen Sie eine CSV-Datei zum Importieren."
+msgstr "Bitte wähle eine CSV-Datei zum Importieren."
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live.ex
 #, elixir-autogen, elixir-format
 msgid "Please wait for the file upload to complete before starting the import."
-msgstr "Bitte warten Sie, bis der Datei-Upload abgeschlossen ist, bevor Sie den Import starten."
+msgstr "Bitte warte, bis der Datei-Upload abgeschlossen ist, bevor du den Import startest."
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "Processing chunk %{current} of %{total}..."
 msgstr "Verarbeite Chunk %{current} von %{total}..."
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "Start Import"
 msgstr "Import starten"
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "Starting import..."
 msgstr "Import wird gestartet..."
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "Successfully inserted: %{count} member(s)"
 msgstr "Erfolgreich eingefügt: %{count} Mitglied(er)"
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "Summary"
 msgstr "Zusammenfassung"
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format, fuzzy
 msgid "Warnings"
 msgstr "Warnungen"
@@ -2258,7 +2248,7 @@ msgstr "Nicht berechtigt."
 #: lib/mv_web/live/global_settings_live.ex
 #, elixir-autogen, elixir-format
 msgid "Could not load data fields. Please check your permissions."
-msgstr "Datenfelder konnten nicht geladen werden. Bitte überprüfen Sie Ihre Berechtigungen."
+msgstr "Datenfelder konnten nicht geladen werden. Bitte überprüfe deine Berechtigungen."
 
 #: lib/mv_web/live/group_live/show.ex
 #, elixir-autogen, elixir-format
@@ -2325,7 +2315,7 @@ msgstr "%{name} entfernen"
 msgid "Some members could not be added: %{errors}"
 msgstr "Einige Mitglieder konnten nicht hinzugefügt werden: %{errors}"
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format, fuzzy
 msgid "CSV files only, maximum %{size} MB"
 msgstr "Nur CSV Dateien, maximal %{size} MB"
@@ -2350,20 +2340,133 @@ msgstr "Datenfeld: %{name} – erwartet %{type} %{details}, erhalten: %{value}"
 msgid "custom_field: %{name} – expected %{type}, got: %{value}"
 msgstr "Datenfeld: %{name} – erwartet %{type}, erhalten: %{value}"
 
-#: lib/mv_web/live/global_settings_live.ex
-#, elixir-autogen, elixir-format
-msgid "Manage Memberdata"
-msgstr "Mitgliederdaten verwalten"
-
-#: lib/mv_web/live/global_settings_live.ex
-#, elixir-autogen, elixir-format, fuzzy
-msgid "Use the data field name as the CSV column header in your file. Data fields must exist in Mila before importing, so they must be listed in the list of memberdate (like e-mail or first name). Unknown data field columns will be ignored with a warning."
-msgstr "Verwende die Namen der Datenfelder als Spaltennamen in der CSV Datei. Datenfelder müssen in Mila bereits angelegt sein, damit sie importiert werden können. Sie müssen in der Liste der Mitgliederdaten als Datenfeld enthalten sein (z.B. E-Mail). Spalten mit unbekannten Spaltenüberschriften werden mit einer Warnung ignoriert."
-
 #: lib/mv/membership/import/member_csv.ex
 #, elixir-autogen, elixir-format
 msgid "Unknown column '%{header}' will be ignored. If this is a custom field, create it in Mila before importing."
-msgstr "Unbekannte Spalte '%{header}' wird ignoriert. Falls dies ein Datenfeld ist, erstellen Sie es in Mila vor dem Import."
+msgstr "Unbekannte Spalte '%{header}' wird ignoriert. Falls dies ein Datenfeld ist, erstelle es in Mila vor dem Import."
+
+#: lib/mv_web/live/import_export_live.ex
+#, elixir-autogen, elixir-format, fuzzy
+msgid "Export Members (CSV)"
+msgstr "Mitglieder importieren (CSV)"
+
+#: lib/mv_web/live/import_export_live.ex
+#, elixir-autogen, elixir-format
+msgid "Export functionality will be available in a future release."
+msgstr "Export-Funktionalität ist im nächsten release verfügbar."
+
+#: lib/mv/membership/import/import_runner.ex
+#, elixir-autogen, elixir-format, fuzzy
+msgid "Failed to read uploaded file: unexpected format"
+msgstr "Fehler beim Lesen der hochgeladenen Datei"
+
+#: lib/mv_web/live/import_export_live.ex
+#, elixir-autogen, elixir-format
+msgid "Import members from CSV files or export member data."
+msgstr "Importiere Mitglieder aus CSV-Dateien oder exportiere Mitgliederdaten."
+
+#: lib/mv_web/components/layouts/sidebar.ex
+#: lib/mv_web/live/import_export_live.ex
+#, elixir-autogen, elixir-format
+msgid "Import/Export"
+msgstr "Import/Export"
+
+#: lib/mv_web/live/import_export_live.ex
+#, elixir-autogen, elixir-format, fuzzy
+msgid "You do not have permission to access this page."
+msgstr "Du hast keine Berechtigung, auf diese Seite zuzugreifen."
+
+#: lib/mv_web/live/import_export_live/components.ex
+#, elixir-autogen, elixir-format, fuzzy
+msgid "Manage Member Data"
+msgstr "Mitgliederdaten verwalten"
+
+#: lib/mv_web/live/import_export_live/components.ex
+#, elixir-autogen, elixir-format, fuzzy
+msgid "Use the data field name as the CSV column header in your file. Data fields must exist in Mila before importing, so they must be listed in the list of member data (like e-mail or first name). Unknown data field columns will be ignored with a warning."
+msgstr "Verwende die Namen der Datenfelder als Spaltennamen in der CSV Datei. Datenfelder müssen in Mila bereits angelegt sein, damit sie importiert werden können. sie müssen in der Liste der Mitgliederdaten als Datenfeld enthalten sein (z.B. E-Mail). Spalten mit unbekannten Spaltenüberschriften werden mit einer Warnung ignoriert."
+
+#: lib/mv_web/live/member_live/index.html.heex
+#, elixir-autogen, elixir-format, fuzzy
+msgid "Export members to CSV"
+msgstr "Mitglieder importieren (CSV)"
+
+#: lib/mv_web/live/member_live/index.html.heex
+#, elixir-autogen, elixir-format
+msgid "Export to CSV"
+msgstr "Nach CSV exportieren"
+
+#: lib/mv_web/live/member_live/index.html.heex
+#, elixir-autogen, elixir-format
+msgid "all"
+msgstr "alle"
+
+#: lib/mv/membership/member/validations/email_change_permission.ex
+#, elixir-autogen, elixir-format
+msgid "Only administrators or the linked user can change the email for members linked to users"
+msgstr "Nur Administrator*innen oder die verknüpften Nutzer*innen können die Email Adresse für Mitglieder verknüpfter Nutzer*innen ändern."
+
+#: lib/mv_web/live/user_live/form.ex
+#, elixir-autogen, elixir-format, fuzzy
+msgid "Select role..."
+msgstr "Rolle auswählen..."
+
+#: lib/mv_web/live/member_live/show/membership_fees_component.ex
+#, elixir-autogen, elixir-format
+msgid "You are not allowed to perform this action."
+msgstr "Du hast keine Berechtigungen diese Aktion auszuführen."
+
+#: lib/mv_web/live/member_live/form.ex
+#, elixir-autogen, elixir-format, fuzzy
+msgid "Select a membership fee type"
+msgstr "Beitragsart auswählen"
+
+#: lib/mv_web/live/user_live/index.html.heex
+#: lib/mv_web/live/user_live/show.ex
+#, elixir-autogen, elixir-format, fuzzy
+msgid "Linked"
+msgstr "Verknüpft"
+
+#: lib/mv_web/live/user_live/index.html.heex
+#: lib/mv_web/live/user_live/show.ex
+#, elixir-autogen, elixir-format
+msgid "OIDC"
+msgstr "OIDC"
+
+#: lib/mv_web/live/user_live/show.ex
+#, elixir-autogen, elixir-format, fuzzy
+msgid "Not linked"
+msgstr "Nichtverknüpft"
+
+#: lib/mv_web/live/user_live/form.ex
+#, elixir-autogen, elixir-format
+msgid "SSO / OIDC user"
+msgstr "SSO / OIDC Nutzer*in"
+
+#: lib/mv_web/live/user_live/form.ex
+#, elixir-autogen, elixir-format
+msgid "This user is linked via SSO (Single Sign-On). A password set or changed here only affects login with email and password in this application. It does not change the password in your identity provider (e.g. Authentik). To change the SSO password, use the identity provider or your organization's IT."
+msgstr "Diese*r Nutzer*in ist über SSO (Single Sign-On) verbunden. Ein hier festgelegtes oder geändertes Passwort wirkt sich nur auf die Anmeldung mit E-Mail-Adresse und Passwort in dieser Anwendung aus. Es ändert nicht das Passwort in Eurem Identitätsanbieter (z. B. Authentik). Um das SSO-Passwort zu ändern, wende dich an den Identitätsanbieter oder die IT-Abteilung Ihrer Organisation."
+
+#: lib/mv_web/live/import_export_live/components.ex
+#, elixir-autogen, elixir-format
+msgid "Import aborted"
+msgstr "Import abgebrochen"
+
+#: lib/mv_web/controllers/member_export_controller.ex
+#, elixir-autogen, elixir-format, fuzzy
+msgid "paid"
+msgstr "Bezahlt"
+
+#: lib/mv_web/controllers/member_export_controller.ex
+#, elixir-autogen, elixir-format, fuzzy
+msgid "suspended"
+msgstr "Pausiert"
+
+#: lib/mv_web/controllers/member_export_controller.ex
+#, elixir-autogen, elixir-format, fuzzy
+msgid "unpaid"
+msgstr "Unbezahlt"
 
 #~ #: lib/mv_web/live/global_settings_live.ex
 #~ #, elixir-autogen, elixir-format, fuzzy
@@ -2371,11 +2474,16 @@ msgstr "Unbekannte Spalte '%{header}' wird ignoriert. Falls dies ein Datenfeld i
 #~ msgstr "Benutzerdefinierte Felder"
 
 #~ #: lib/mv_web/live/global_settings_live.ex
-#~ #, elixir-autogen, elixir-format, fuzzy
-#~ msgid "Individual data fields must be created in Mila before importing. Use the field name as the CSV column header. Unknown custom field columns will be ignored with a warning."
-#~ msgstr "Individuelle Datenfelder müssen in Mila erstellt werden, bevor sie importiert werden können. Verwenden Sie den Namen des Datenfeldes als CSV-Spaltenüberschrift. Unbekannte Spaltenüberschriften werden mit einer Warnung ignoriert."
+#~ #, elixir-autogen, elixir-format
+#~ msgid "Failed to prepare CSV import: %{error}"
+#~ msgstr "Das Vorbereiten des CSV Imports ist gescheitert: %{error}"
 
 #~ #: lib/mv_web/live/global_settings_live.ex
+#~ #, elixir-autogen, elixir-format, fuzzy
+#~ msgid "Individual data fields must be created in Mila before importing. Use the field name as the CSV column header. Unknown custom field columns will be ignored with a warning."
+#~ msgstr "Individuelle Datenfelder müssen in Mila erstellt werden, bevor sie importiert werden können. Verwende den Namen des Datenfeldes als CSV-Spaltenüberschrift. Unbekannte Spaltenüberschriften werden mit einer Warnung ignoriert."
+
+#~ #: lib/mv_web/live/member_live/show/membership_fees_component.ex
 #~ #, elixir-autogen, elixir-format
-#~ msgid "Manage Custom Fields"
-#~ msgstr "Benutzerdefinierte Felder verwalten"
+#~ msgid "Only administrators can regenerate cycles"
+#~ msgstr "Nur Administrator*innen können Zyklen regenerieren"

priv/gettext/de/LC_MESSAGES/errors.po

@@ -123,7 +123,7 @@ msgstr "muss vorhanden sein"
 
 ## Custom validation messages from Mv.Accounts.User
 msgid "User already has a member. Remove existing member first."
-msgstr "Benutzer*in hat bereits ein Mitglied. Entfernen Sie zuerst das vorhandene Mitglied."
+msgstr "Benutzer*in hat bereits ein Mitglied. Entferne zuerst das vorhandene Mitglied."
 
 msgid "OIDC user_info must contain a non-empty 'sub' or 'id' field"
 msgstr "OIDC user_info darf kein leeres 'sub' oder 'id' Feld enthalten"

priv/gettext/default.pot

@@ -296,6 +296,7 @@ msgstr ""
 msgid "Edit User"
 msgstr ""
 
+#: lib/mv_web/live/user_live/index.html.heex
 #: lib/mv_web/live/user_live/show.ex
 #, elixir-autogen, elixir-format
 msgid "Enabled"
@@ -473,6 +474,7 @@ msgid "Include both letters and numbers"
 msgstr ""
 
 #: lib/mv_web/live/user_live/form.ex
+#: lib/mv_web/live/user_live/index.html.heex
 #, elixir-autogen, elixir-format
 msgid "Password"
 msgstr ""
@@ -961,7 +963,6 @@ msgid "Last name"
 msgstr ""
 
 #: lib/mv_web/components/core_components.ex
-#: lib/mv_web/live/member_live/form.ex
 #, elixir-autogen, elixir-format
 msgid "None"
 msgstr ""
@@ -1298,6 +1299,7 @@ msgid "Membership Fee Settings"
 msgstr ""
 
 #: lib/mv_web/live/member_live/index.html.heex
+#: lib/mv_web/translations/member_fields.ex
 #, elixir-autogen, elixir-format
 msgid "Membership Fee Status"
 msgstr ""
@@ -1673,6 +1675,9 @@ msgstr ""
 
 #: lib/mv_web/live/role_live/form.ex
 #: lib/mv_web/live/role_live/show.ex
+#: lib/mv_web/live/user_live/form.ex
+#: lib/mv_web/live/user_live/index.html.heex
+#: lib/mv_web/live/user_live/show.ex
 #, elixir-autogen, elixir-format
 msgid "Role"
 msgstr ""
@@ -1847,7 +1852,7 @@ msgstr ""
 msgid "updated"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #: lib/mv_web/live/user_live/form.ex
 #, elixir-autogen, elixir-format
 msgid "Unknown error"
@@ -1968,152 +1973,137 @@ msgstr ""
 msgid "Reset"
 msgstr ""
 
-#: lib/mv_web/live/member_live/show/membership_fees_component.ex
-#, elixir-autogen, elixir-format
-msgid "Only administrators can regenerate cycles"
-msgstr ""
-
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid " (Field: %{field})"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "CSV File"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "Download CSV templates:"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "English Template"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "Error list truncated to %{count} entries"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "Errors"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
-#, elixir-autogen, elixir-format
-msgid "Failed to prepare CSV import: %{error}"
-msgstr ""
-
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live.ex
 #, elixir-autogen, elixir-format
 msgid "Failed to prepare CSV import: %{reason}"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv/membership/import/import_runner.ex
 #, elixir-autogen, elixir-format
 msgid "Failed to process chunk %{idx}: %{reason}"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv/membership/import/import_runner.ex
 #, elixir-autogen, elixir-format
 msgid "Failed to read file: %{reason}"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
-#, elixir-autogen, elixir-format
-msgid "Failed to read uploaded file"
-msgstr ""
-
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "Failed: %{count} row(s)"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "German Template"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live.ex
 #, elixir-autogen, elixir-format
 msgid "Import Members (CSV)"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "Import Results"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live.ex
 #, elixir-autogen, elixir-format
 msgid "Import is already running. Please wait for it to complete."
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv/membership/import/import_runner.ex
 #, elixir-autogen, elixir-format
 msgid "Import state is missing. Cannot process chunk %{idx}."
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv/membership/import/import_runner.ex
 #, elixir-autogen, elixir-format
 msgid "Invalid chunk index: %{idx}"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "Line %{line}: %{message}"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv/membership/import/import_runner.ex
 #, elixir-autogen, elixir-format
 msgid "No file was uploaded"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live.ex
 #, elixir-autogen, elixir-format
 msgid "Only administrators can import members from CSV files."
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live.ex
 #, elixir-autogen, elixir-format
 msgid "Please select a CSV file to import."
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live.ex
 #, elixir-autogen, elixir-format
 msgid "Please wait for the file upload to complete before starting the import."
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "Processing chunk %{current} of %{total}..."
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "Start Import"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "Starting import..."
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "Successfully inserted: %{count} member(s)"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "Summary"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "Warnings"
 msgstr ""
@@ -2326,8 +2316,8 @@ msgstr ""
 msgid "Some members could not be added: %{errors}"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
-#, elixir-autogen, elixir-format
+#: lib/mv_web/live/import_export_live/components.ex
+#, elixir-autogen, elixir-format, fuzzy
 msgid "CSV files only, maximum %{size} MB"
 msgstr ""
 
@@ -2351,17 +2341,130 @@ msgstr ""
 msgid "custom_field: %{name} – expected %{type}, got: %{value}"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
-#, elixir-autogen, elixir-format
-msgid "Manage Memberdata"
-msgstr ""
-
-#: lib/mv_web/live/global_settings_live.ex
-#, elixir-autogen, elixir-format
-msgid "Use the data field name as the CSV column header in your file. Data fields must exist in Mila before importing, so they must be listed in the list of memberdate (like e-mail or first name). Unknown data field columns will be ignored with a warning."
-msgstr ""
-
 #: lib/mv/membership/import/member_csv.ex
 #, elixir-autogen, elixir-format
 msgid "Unknown column '%{header}' will be ignored. If this is a custom field, create it in Mila before importing."
 msgstr ""
+
+#: lib/mv_web/live/import_export_live.ex
+#, elixir-autogen, elixir-format
+msgid "Export Members (CSV)"
+msgstr ""
+
+#: lib/mv_web/live/import_export_live.ex
+#, elixir-autogen, elixir-format
+msgid "Export functionality will be available in a future release."
+msgstr ""
+
+#: lib/mv/membership/import/import_runner.ex
+#, elixir-autogen, elixir-format
+msgid "Failed to read uploaded file: unexpected format"
+msgstr ""
+
+#: lib/mv_web/live/import_export_live.ex
+#, elixir-autogen, elixir-format
+msgid "Import members from CSV files or export member data."
+msgstr ""
+
+#: lib/mv_web/components/layouts/sidebar.ex
+#: lib/mv_web/live/import_export_live.ex
+#, elixir-autogen, elixir-format
+msgid "Import/Export"
+msgstr ""
+
+#: lib/mv_web/live/import_export_live.ex
+#, elixir-autogen, elixir-format
+msgid "You do not have permission to access this page."
+msgstr ""
+
+#: lib/mv_web/live/import_export_live/components.ex
+#, elixir-autogen, elixir-format
+msgid "Manage Member Data"
+msgstr ""
+
+#: lib/mv_web/live/import_export_live/components.ex
+#, elixir-autogen, elixir-format
+msgid "Use the data field name as the CSV column header in your file. Data fields must exist in Mila before importing, so they must be listed in the list of member data (like e-mail or first name). Unknown data field columns will be ignored with a warning."
+msgstr ""
+
+#: lib/mv_web/live/member_live/index.html.heex
+#, elixir-autogen, elixir-format
+msgid "Export members to CSV"
+msgstr ""
+
+#: lib/mv_web/live/member_live/index.html.heex
+#, elixir-autogen, elixir-format
+msgid "Export to CSV"
+msgstr ""
+
+#: lib/mv_web/live/member_live/index.html.heex
+#, elixir-autogen, elixir-format
+msgid "all"
+msgstr ""
+
+#: lib/mv/membership/member/validations/email_change_permission.ex
+#, elixir-autogen, elixir-format
+msgid "Only administrators or the linked user can change the email for members linked to users"
+msgstr ""
+
+#: lib/mv_web/live/user_live/form.ex
+#, elixir-autogen, elixir-format
+msgid "Select role..."
+msgstr ""
+
+#: lib/mv_web/live/member_live/show/membership_fees_component.ex
+#, elixir-autogen, elixir-format
+msgid "You are not allowed to perform this action."
+msgstr ""
+
+#: lib/mv_web/live/member_live/form.ex
+#, elixir-autogen, elixir-format
+msgid "Select a membership fee type"
+msgstr ""
+
+#: lib/mv_web/live/user_live/index.html.heex
+#: lib/mv_web/live/user_live/show.ex
+#, elixir-autogen, elixir-format
+msgid "Linked"
+msgstr ""
+
+#: lib/mv_web/live/user_live/index.html.heex
+#: lib/mv_web/live/user_live/show.ex
+#, elixir-autogen, elixir-format
+msgid "OIDC"
+msgstr ""
+
+#: lib/mv_web/live/user_live/show.ex
+#, elixir-autogen, elixir-format
+msgid "Not linked"
+msgstr ""
+
+#: lib/mv_web/live/user_live/form.ex
+#, elixir-autogen, elixir-format
+msgid "SSO / OIDC user"
+msgstr ""
+
+#: lib/mv_web/live/user_live/form.ex
+#, elixir-autogen, elixir-format
+msgid "This user is linked via SSO (Single Sign-On). A password set or changed here only affects login with email and password in this application. It does not change the password in your identity provider (e.g. Authentik). To change the SSO password, use the identity provider or your organization's IT."
+msgstr ""
+
+#: lib/mv_web/live/import_export_live/components.ex
+#, elixir-autogen, elixir-format
+msgid "Import aborted"
+msgstr ""
+
+#: lib/mv_web/controllers/member_export_controller.ex
+#, elixir-autogen, elixir-format
+msgid "paid"
+msgstr ""
+
+#: lib/mv_web/controllers/member_export_controller.ex
+#, elixir-autogen, elixir-format
+msgid "suspended"
+msgstr ""
+
+#: lib/mv_web/controllers/member_export_controller.ex
+#, elixir-autogen, elixir-format
+msgid "unpaid"
+msgstr ""

priv/gettext/en/LC_MESSAGES/default.po

@@ -295,6 +295,7 @@ msgstr ""
 msgid "Edit User"
 msgstr ""
 
+#: lib/mv_web/live/user_live/index.html.heex
 #: lib/mv_web/live/user_live/show.ex
 #, elixir-autogen, elixir-format
 msgid "Enabled"
@@ -472,6 +473,7 @@ msgid "Include both letters and numbers"
 msgstr ""
 
 #: lib/mv_web/live/user_live/form.ex
+#: lib/mv_web/live/user_live/index.html.heex
 #, elixir-autogen, elixir-format
 msgid "Password"
 msgstr ""
@@ -959,7 +961,6 @@ msgid "Last name"
 msgstr ""
 
 #: lib/mv_web/components/core_components.ex
-#: lib/mv_web/live/member_live/form.ex
 #, elixir-autogen, elixir-format, fuzzy
 msgid "None"
 msgstr ""
@@ -1296,6 +1297,7 @@ msgid "Membership Fee Settings"
 msgstr ""
 
 #: lib/mv_web/live/member_live/index.html.heex
+#: lib/mv_web/translations/member_fields.ex
 #, elixir-autogen, elixir-format, fuzzy
 msgid "Membership Fee Status"
 msgstr ""
@@ -1671,6 +1673,9 @@ msgstr ""
 
 #: lib/mv_web/live/role_live/form.ex
 #: lib/mv_web/live/role_live/show.ex
+#: lib/mv_web/live/user_live/form.ex
+#: lib/mv_web/live/user_live/index.html.heex
+#: lib/mv_web/live/user_live/show.ex
 #, elixir-autogen, elixir-format
 msgid "Role"
 msgstr ""
@@ -1845,7 +1850,7 @@ msgstr ""
 msgid "updated"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #: lib/mv_web/live/user_live/form.ex
 #, elixir-autogen, elixir-format
 msgid "Unknown error"
@@ -1966,152 +1971,137 @@ msgstr ""
 msgid "Reset"
 msgstr ""
 
-#: lib/mv_web/live/member_live/show/membership_fees_component.ex
-#, elixir-autogen, elixir-format
-msgid "Only administrators can regenerate cycles"
-msgstr ""
-
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid " (Field: %{field})"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "CSV File"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "Download CSV templates:"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "English Template"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "Error list truncated to %{count} entries"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "Errors"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
-#, elixir-autogen, elixir-format
-msgid "Failed to prepare CSV import: %{error}"
-msgstr ""
-
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live.ex
 #, elixir-autogen, elixir-format
 msgid "Failed to prepare CSV import: %{reason}"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv/membership/import/import_runner.ex
 #, elixir-autogen, elixir-format
 msgid "Failed to process chunk %{idx}: %{reason}"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv/membership/import/import_runner.ex
 #, elixir-autogen, elixir-format, fuzzy
 msgid "Failed to read file: %{reason}"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
-#, elixir-autogen, elixir-format
-msgid "Failed to read uploaded file"
-msgstr ""
-
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "Failed: %{count} row(s)"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "German Template"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live.ex
 #, elixir-autogen, elixir-format
 msgid "Import Members (CSV)"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "Import Results"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live.ex
 #, elixir-autogen, elixir-format
 msgid "Import is already running. Please wait for it to complete."
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv/membership/import/import_runner.ex
 #, elixir-autogen, elixir-format
 msgid "Import state is missing. Cannot process chunk %{idx}."
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv/membership/import/import_runner.ex
 #, elixir-autogen, elixir-format
 msgid "Invalid chunk index: %{idx}"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "Line %{line}: %{message}"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv/membership/import/import_runner.ex
 #, elixir-autogen, elixir-format
 msgid "No file was uploaded"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live.ex
 #, elixir-autogen, elixir-format
 msgid "Only administrators can import members from CSV files."
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live.ex
 #, elixir-autogen, elixir-format, fuzzy
 msgid "Please select a CSV file to import."
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live.ex
 #, elixir-autogen, elixir-format
 msgid "Please wait for the file upload to complete before starting the import."
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "Processing chunk %{current} of %{total}..."
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "Start Import"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "Starting import..."
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "Successfully inserted: %{count} member(s)"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format
 msgid "Summary"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format, fuzzy
 msgid "Warnings"
 msgstr ""
@@ -2264,7 +2254,7 @@ msgstr ""
 msgid "Could not load member search. Please try again."
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
+#: lib/mv_web/live/import_export_live/components.ex
 #, elixir-autogen, elixir-format, fuzzy
 msgid "CSV files only, maximum %{size} MB"
 msgstr ""
@@ -2289,32 +2279,150 @@ msgstr ""
 msgid "custom_field: %{name} – expected %{type}, got: %{value}"
 msgstr ""
 
-#: lib/mv_web/live/global_settings_live.ex
-#, elixir-autogen, elixir-format
-msgid "Manage Memberdata"
-msgstr ""
-
-#: lib/mv_web/live/global_settings_live.ex
-#, elixir-autogen, elixir-format, fuzzy
-msgid "Use the data field name as the CSV column header in your file. Data fields must exist in Mila before importing, so they must be listed in the list of memberdate (like e-mail or first name). Unknown data field columns will be ignored with a warning."
-msgstr ""
-
 #: lib/mv/membership/import/member_csv.ex
 #, elixir-autogen, elixir-format
 msgid "Unknown column '%{header}' will be ignored. If this is a custom field, create it in Mila before importing."
 msgstr "Unknown column '%{header}' will be ignored. If this is a custom field, create it in Mila before importing."
 
+#: lib/mv_web/live/import_export_live.ex
+#, elixir-autogen, elixir-format, fuzzy
+msgid "Export Members (CSV)"
+msgstr ""
+
+#: lib/mv_web/live/import_export_live.ex
+#, elixir-autogen, elixir-format
+msgid "Export functionality will be available in a future release."
+msgstr ""
+
+#: lib/mv/membership/import/import_runner.ex
+#, elixir-autogen, elixir-format, fuzzy
+msgid "Failed to read uploaded file: unexpected format"
+msgstr ""
+
+#: lib/mv_web/live/import_export_live.ex
+#, elixir-autogen, elixir-format
+msgid "Import members from CSV files or export member data."
+msgstr ""
+
+#: lib/mv_web/components/layouts/sidebar.ex
+#: lib/mv_web/live/import_export_live.ex
+#, elixir-autogen, elixir-format
+msgid "Import/Export"
+msgstr ""
+
+#: lib/mv_web/live/import_export_live.ex
+#, elixir-autogen, elixir-format, fuzzy
+msgid "You do not have permission to access this page."
+msgstr ""
+
+#: lib/mv_web/live/import_export_live/components.ex
+#, elixir-autogen, elixir-format, fuzzy
+msgid "Manage Member Data"
+msgstr ""
+
+#: lib/mv_web/live/import_export_live/components.ex
+#, elixir-autogen, elixir-format, fuzzy
+msgid "Use the data field name as the CSV column header in your file. Data fields must exist in Mila before importing, so they must be listed in the list of member data (like e-mail or first name). Unknown data field columns will be ignored with a warning."
+msgstr ""
+
+#: lib/mv_web/live/member_live/index.html.heex
+#, elixir-autogen, elixir-format, fuzzy
+msgid "Export members to CSV"
+msgstr ""
+
+#: lib/mv_web/live/member_live/index.html.heex
+#, elixir-autogen, elixir-format
+msgid "Export to CSV"
+msgstr ""
+
+#: lib/mv_web/live/member_live/index.html.heex
+#, elixir-autogen, elixir-format
+msgid "all"
+msgstr ""
+
+#: lib/mv/membership/member/validations/email_change_permission.ex
+#, elixir-autogen, elixir-format
+msgid "Only administrators or the linked user can change the email for members linked to users"
+msgstr ""
+
+#: lib/mv_web/live/user_live/form.ex
+#, elixir-autogen, elixir-format, fuzzy
+msgid "Select role..."
+msgstr ""
+
+#: lib/mv_web/live/member_live/show/membership_fees_component.ex
+#, elixir-autogen, elixir-format
+msgid "You are not allowed to perform this action."
+msgstr ""
+
+#: lib/mv_web/live/member_live/form.ex
+#, elixir-autogen, elixir-format, fuzzy
+msgid "Select a membership fee type"
+msgstr ""
+
+#: lib/mv_web/live/user_live/index.html.heex
+#: lib/mv_web/live/user_live/show.ex
+#, elixir-autogen, elixir-format, fuzzy
+msgid "Linked"
+msgstr ""
+
+#: lib/mv_web/live/user_live/index.html.heex
+#: lib/mv_web/live/user_live/show.ex
+#, elixir-autogen, elixir-format
+msgid "OIDC"
+msgstr ""
+
+#: lib/mv_web/live/user_live/show.ex
+#, elixir-autogen, elixir-format, fuzzy
+msgid "Not linked"
+msgstr ""
+
+#: lib/mv_web/live/user_live/form.ex
+#, elixir-autogen, elixir-format
+msgid "SSO / OIDC user"
+msgstr ""
+
+#: lib/mv_web/live/user_live/form.ex
+#, elixir-autogen, elixir-format
+msgid "This user is linked via SSO (Single Sign-On). A password set or changed here only affects login with email and password in this application. It does not change the password in your identity provider (e.g. Authentik). To change the SSO password, use the identity provider or your organization's IT."
+msgstr ""
+
+#: lib/mv_web/live/import_export_live/components.ex
+#, elixir-autogen, elixir-format
+msgid "Import aborted"
+msgstr ""
+
+#: lib/mv_web/controllers/member_export_controller.ex
+#, elixir-autogen, elixir-format, fuzzy
+msgid "paid"
+msgstr ""
+
+#: lib/mv_web/controllers/member_export_controller.ex
+#, elixir-autogen, elixir-format, fuzzy
+msgid "suspended"
+msgstr ""
+
+#: lib/mv_web/controllers/member_export_controller.ex
+#, elixir-autogen, elixir-format, fuzzy
+msgid "unpaid"
+msgstr ""
+
 #~ #: lib/mv_web/live/global_settings_live.ex
 #~ #, elixir-autogen, elixir-format, fuzzy
 #~ msgid "Custom Fields in CSV Import"
 #~ msgstr ""
 
+#~ #: lib/mv_web/live/global_settings_live.ex
+#~ #, elixir-autogen, elixir-format
+#~ msgid "Failed to prepare CSV import: %{error}"
+#~ msgstr ""
+
 #~ #: lib/mv_web/live/global_settings_live.ex
 #~ #, elixir-autogen, elixir-format, fuzzy
 #~ msgid "Individual data fields must be created in Mila before importing. Use the field name as the CSV column header. Unknown custom field columns will be ignored with a warning."
 #~ msgstr ""
 
-#~ #: lib/mv_web/live/global_settings_live.ex
+#~ #: lib/mv_web/live/member_live/show/membership_fees_component.ex
 #~ #, elixir-autogen, elixir-format
-#~ msgid "Manage Custom Fields"
+#~ msgid "Only administrators can regenerate cycles"
 #~ msgstr ""

priv/repo/seeds.exs

@@ -10,7 +10,7 @@ alias Mv.MembershipFees.CycleGenerator
 
 require Ash.Query
 
-# Create example membership fee types
+# Create example membership fee types (no admin user yet; skip authorization for bootstrap)
 for fee_type_attrs <- [
       %{
         name: "Standard (Jährlich)",
@@ -39,7 +39,12 @@ for fee_type_attrs <- [
     ] do
   MembershipFeeType
   |> Ash.Changeset.for_create(:create, fee_type_attrs)
-  |> Ash.create!(upsert?: true, upsert_identity: :unique_name)
+  |> Ash.create!(
+    upsert?: true,
+    upsert_identity: :unique_name,
+    authorize?: false,
+    domain: Mv.MembershipFees
+  )
 end
 
 for attrs <- [
@@ -127,8 +132,15 @@ for attrs <- [
   )
 end
 
-# Get admin email from environment variable or use default
+# Admin email: default for dev/test so seed_admin has a target
 admin_email = System.get_env("ADMIN_EMAIL") || "admin@localhost"
+System.put_env("ADMIN_EMAIL", admin_email)
+
+# In dev/test, set fallback password so seed_admin creates the admin user when none is set
+if Mix.env() in [:dev, :test] and is_nil(System.get_env("ADMIN_PASSWORD")) and
+     is_nil(System.get_env("ADMIN_PASSWORD_FILE")) do
+  System.put_env("ADMIN_PASSWORD", "testpassword")
+end
 
 # Create all authorization roles (idempotent - creates only if they don't exist)
 # Roles are created using create_role_with_system_flag to allow setting is_system_role
@@ -209,39 +221,9 @@ if is_nil(admin_role) do
   raise "Failed to create or find admin role. Cannot proceed with member seeding."
 end
 
-# Assign admin role to user with ADMIN_EMAIL (if user exists)
-# This handles both existing users (e.g., from OIDC) and newly created users
-case Accounts.User
-     |> Ash.Query.filter(email == ^admin_email)
-     |> Ash.read_one(domain: Mv.Accounts, authorize?: false) do
-  {:ok, existing_admin_user} when not is_nil(existing_admin_user) ->
-    # User already exists (e.g., via OIDC) - assign admin role
-    # Use authorize?: false for bootstrap - this is initial setup
-    existing_admin_user
-    |> Ash.Changeset.for_update(:update, %{})
-    |> Ash.Changeset.manage_relationship(:role, admin_role, type: :append_and_remove)
-    |> Ash.update!(authorize?: false)
-
-  {:ok, nil} ->
-    # User doesn't exist - create admin user with password
-    # Use authorize?: false for bootstrap - no admin user exists yet to use as actor
-    Accounts.create_user!(%{email: admin_email},
-      upsert?: true,
-      upsert_identity: :unique_email,
-      authorize?: false
-    )
-    |> Ash.Changeset.for_update(:admin_set_password, %{password: "testpassword"})
-    |> Ash.update!(authorize?: false)
-    |> then(fn user ->
-      user
-      |> Ash.Changeset.for_update(:update, %{})
-      |> Ash.Changeset.manage_relationship(:role, admin_role, type: :append_and_remove)
-      |> Ash.update!(authorize?: false)
-    end)
-
-  {:error, error} ->
-    raise "Failed to check for existing admin user: #{inspect(error)}"
-end
+# Create/update admin user via Release.seed_admin (uses ADMIN_EMAIL, ADMIN_PASSWORD / ADMIN_PASSWORD_FILE).
+# Reduces duplication and exercises the same path as production entrypoint.
+Mv.Release.seed_admin()
 
 # Load admin user with role for use as actor in member operations
 # This ensures all member operations have proper authorization
@@ -299,12 +281,12 @@ case Accounts.User
     IO.puts("SystemActor will fall back to admin user (#{admin_email})")
 end
 
-# Load all membership fee types for assignment
+# Load all membership fee types for assignment (admin actor for authorization)
 # Sort by name to ensure deterministic order
 all_fee_types =
   MembershipFeeType
   |> Ash.Query.sort(name: :asc)
-  |> Ash.read!()
+  |> Ash.read!(actor: admin_user_with_role, domain: Mv.MembershipFees)
   |> Enum.to_list()
 
 # Create sample members for testing - use upsert to prevent duplicates
@@ -452,7 +434,8 @@ Enum.each(member_attrs_list, fn member_attrs ->
   end
 end)
 
-# Create additional users for user-member linking examples
+# Create additional users for user-member linking examples (no password by default)
+# Only admin gets a password (admin_set_password when created); all other users have no password.
 additional_users = [
   %{email: "hans.mueller@example.de"},
   %{email: "greta.schmidt@example.de"},
@@ -462,15 +445,12 @@ additional_users = [
 
 created_users =
   Enum.map(additional_users, fn user_attrs ->
-    # Use admin user as actor for additional user creation (not bootstrap)
     user =
       Accounts.create_user!(user_attrs,
         upsert?: true,
         upsert_identity: :unique_email,
         actor: admin_user_with_role
       )
-      |> Ash.Changeset.for_update(:admin_set_password, %{password: "testpassword"})
-      |> Ash.update!(actor: admin_user_with_role)
 
     # Reload user to ensure all fields (including member_id) are loaded
     Accounts.User
@@ -744,7 +724,14 @@ IO.puts("📝 Created sample data:")
 IO.puts("   - Global settings: club_name = #{default_club_name}")
 IO.puts("   - Membership fee types: 4 types (Yearly, Half-yearly, Quarterly, Monthly)")
 IO.puts("   - Custom fields: 12 fields (String, Date, Boolean, Email, + 8 realistic fields)")
-IO.puts("   - Admin user: #{admin_email} (password: testpassword)")
+
+password_configured =
+  System.get_env("ADMIN_PASSWORD") != nil or System.get_env("ADMIN_PASSWORD_FILE") != nil
+
+IO.puts(
+  "   - Admin user: #{admin_email} (password: #{if password_configured, do: "set", else: "not set"})"
+)
+
 IO.puts("   - Sample members: Hans, Greta, Friedrich")
 
 IO.puts(

rel/overlays/bin/docker-entrypoint.sh

@@ -4,6 +4,9 @@ set -e
 echo "==> Running database migrations..."
 /app/bin/migrate
 
+echo "==> Seeding admin user from ENV (ADMIN_EMAIL, ADMIN_PASSWORD)..."
+/app/bin/mv eval "Mv.Release.seed_admin()"
+
 echo "==> Starting application..."
 exec /app/bin/server
 

test/accounts/user_authentication_test.exs

@@ -41,18 +41,6 @@ defmodule Mv.Accounts.UserAuthenticationTest do
       assert is_nil(found_user.oidc_id)
     end
 
-    @tag :test_proposal
-    test "password authentication uses email as identity_field" do
-      # Verify the configuration: password strategy should use email as identity_field
-      # This test checks the AshAuthentication configuration
-
-      strategies = AshAuthentication.Info.authentication_strategies(Mv.Accounts.User)
-      password_strategy = Enum.find(strategies, fn s -> s.name == :password end)
-
-      assert password_strategy != nil
-      assert password_strategy.identity_field == :email
-    end
-
     @tag :test_proposal
     test "multiple users can exist with different emails" do
       user1 =
@@ -130,6 +118,10 @@ defmodule Mv.Accounts.UserAuthenticationTest do
         )
 
       case result do
+        {:ok, found_user} when is_struct(found_user) ->
+          assert found_user.id == user.id
+          assert found_user.oidc_id == "oidc_identifier_12345"
+
         {:ok, [found_user]} ->
           assert found_user.id == user.id
           assert found_user.oidc_id == "oidc_identifier_12345"
@@ -137,6 +129,9 @@ defmodule Mv.Accounts.UserAuthenticationTest do
         {:ok, []} ->
           flunk("User should be found by oidc_id")
 
+        {:ok, nil} ->
+          flunk("User should be found by oidc_id")
+
         {:error, error} ->
           flunk("Unexpected error: #{inspect(error)}")
       end
@@ -231,11 +226,14 @@ defmodule Mv.Accounts.UserAuthenticationTest do
           actor: system_actor
         )
 
-      # Either returns empty list OR authentication error - both mean "user not found"
+      # Either returns empty/nil OR authentication error - both mean "user not found"
       case result do
         {:ok, []} ->
           :ok
 
+        {:ok, nil} ->
+          :ok
+
         {:error, %Ash.Error.Forbidden{errors: [%AshAuthentication.Errors.AuthenticationFailed{}]}} ->
           :ok
 
@@ -272,11 +270,14 @@ defmodule Mv.Accounts.UserAuthenticationTest do
           actor: system_actor
         )
 
-      # Either returns empty list OR authentication error - both mean "user not found"
+      # Either returns empty/nil OR authentication error - both mean "user not found"
       case result do
         {:ok, []} ->
           :ok
 
+        {:ok, nil} ->
+          :ok
+
         {:error, %Ash.Error.Forbidden{errors: [%AshAuthentication.Errors.AuthenticationFailed{}]}} ->
           :ok
 

test/membership/custom_field_slug_test.exs

@@ -1,13 +1,14 @@
 defmodule Mv.Membership.CustomFieldSlugTest do
   @moduledoc """
-  Tests for automatic slug generation on CustomField resource.
+  Tests for CustomField slug business rules only.
 
-  This test suite verifies:
-  1. Slugs are automatically generated from the name attribute
-  2. Slugs are unique (cannot have duplicates)
-  3. Slugs are immutable (don't change when name changes)
-  4. Slugs handle various edge cases (unicode, special chars, etc.)
-  5. Slugs can be used for lookups
+  We test our business logic, not Ash/slugify implementation details:
+  - Slug is generated from name on create (one smoke test)
+  - Slug is unique (business rule)
+  - Slug is immutable (does not change when name is updated; cannot be set manually)
+  - Slug cannot be empty (rejects name with only special characters)
+
+  We do not test: slugify edge cases (umlauts, truncation, etc.) or Ash/Ecto struct/load behavior.
   """
   use Mv.DataCase, async: true
 
@@ -18,8 +19,8 @@ defmodule Mv.Membership.CustomFieldSlugTest do
     %{actor: system_actor}
   end
 
-  describe "automatic slug generation on create" do
-    test "generates slug from name with simple ASCII text", %{actor: actor} do
+  describe "slug generation (business rule)" do
+    test "slug is generated from name on create", %{actor: actor} do
       {:ok, custom_field} =
         CustomField
         |> Ash.Changeset.for_create(:create, %{
@@ -30,78 +31,6 @@ defmodule Mv.Membership.CustomFieldSlugTest do
 
       assert custom_field.slug == "mobile-phone"
     end
-
-    test "generates slug from name with German umlauts", %{actor: actor} do
-      {:ok, custom_field} =
-        CustomField
-        |> Ash.Changeset.for_create(:create, %{
-          name: "Café Müller",
-          value_type: :string
-        })
-        |> Ash.create(actor: actor)
-
-      assert custom_field.slug == "cafe-muller"
-    end
-
-    test "generates slug with lowercase conversion", %{actor: actor} do
-      {:ok, custom_field} =
-        CustomField
-        |> Ash.Changeset.for_create(:create, %{
-          name: "TEST NAME",
-          value_type: :string
-        })
-        |> Ash.create(actor: actor)
-
-      assert custom_field.slug == "test-name"
-    end
-
-    test "generates slug by removing special characters", %{actor: actor} do
-      {:ok, custom_field} =
-        CustomField
-        |> Ash.Changeset.for_create(:create, %{
-          name: "E-Mail & Address!",
-          value_type: :string
-        })
-        |> Ash.create(actor: actor)
-
-      assert custom_field.slug == "e-mail-address"
-    end
-
-    test "generates slug by replacing multiple spaces with single hyphen", %{actor: actor} do
-      {:ok, custom_field} =
-        CustomField
-        |> Ash.Changeset.for_create(:create, %{
-          name: "Multiple   Spaces",
-          value_type: :string
-        })
-        |> Ash.create(actor: actor)
-
-      assert custom_field.slug == "multiple-spaces"
-    end
-
-    test "trims leading and trailing hyphens", %{actor: actor} do
-      {:ok, custom_field} =
-        CustomField
-        |> Ash.Changeset.for_create(:create, %{
-          name: "-Test-",
-          value_type: :string
-        })
-        |> Ash.create(actor: actor)
-
-      assert custom_field.slug == "test"
-    end
-
-    test "handles unicode characters properly (ß becomes ss)", %{actor: actor} do
-      {:ok, custom_field} =
-        CustomField
-        |> Ash.Changeset.for_create(:create, %{
-          name: "Straße",
-          value_type: :string
-        })
-        |> Ash.create(actor: actor)
-
-      assert custom_field.slug == "strasse"
-    end
   end
 
   describe "slug uniqueness" do
@@ -248,29 +177,8 @@ defmodule Mv.Membership.CustomFieldSlugTest do
     end
   end
 
-  describe "slug edge cases" do
-    test "handles very long names by truncating slug", %{actor: actor} do
-      # Create a name at the maximum length (100 chars)
-      long_name = String.duplicate("abcdefghij", 10)
-      # 100 characters exactly
-
-      {:ok, custom_field} =
-        CustomField
-        |> Ash.Changeset.for_create(:create, %{
-          name: long_name,
-          value_type: :string
-        })
-        |> Ash.create(actor: actor)
-
-      # Slug should be truncated to maximum 100 characters
-      assert String.length(custom_field.slug) <= 100
-      # Should be the full slugified version since name is exactly 100 chars
-      assert custom_field.slug == long_name
-    end
-
+  describe "slug cannot be empty (business rule)" do
     test "rejects name with only special characters", %{actor: actor} do
-      # When name contains only special characters, slug would be empty
-      # This should fail validation
       assert {:error, %Ash.Error.Invalid{} = error} =
                CustomField
                |> Ash.Changeset.for_create(:create, %{
@@ -279,107 +187,9 @@ defmodule Mv.Membership.CustomFieldSlugTest do
                })
                |> Ash.create(actor: actor)
 
-      # Should fail because slug would be empty
       error_message = Exception.message(error)
       assert error_message =~ "Slug cannot be empty" or error_message =~ "is required"
     end
-
-    test "handles mixed special characters and text", %{actor: actor} do
-      {:ok, custom_field} =
-        CustomField
-        |> Ash.Changeset.for_create(:create, %{
-          name: "Test@#$%Name",
-          value_type: :string
-        })
-        |> Ash.create(actor: actor)
-
-      # slugify keeps the hyphen between words
-      assert custom_field.slug == "test-name"
-    end
-
-    test "handles numbers in name", %{actor: actor} do
-      {:ok, custom_field} =
-        CustomField
-        |> Ash.Changeset.for_create(:create, %{
-          name: "Field 123 Test",
-          value_type: :string
-        })
-        |> Ash.create(actor: actor)
-
-      assert custom_field.slug == "field-123-test"
-    end
-
-    test "handles consecutive hyphens in name", %{actor: actor} do
-      {:ok, custom_field} =
-        CustomField
-        |> Ash.Changeset.for_create(:create, %{
-          name: "Test---Name",
-          value_type: :string
-        })
-        |> Ash.create(actor: actor)
-
-      # Should reduce multiple hyphens to single hyphen
-      assert custom_field.slug == "test-name"
-    end
-
-    test "handles name with dots and underscores", %{actor: actor} do
-      {:ok, custom_field} =
-        CustomField
-        |> Ash.Changeset.for_create(:create, %{
-          name: "test.field_name",
-          value_type: :string
-        })
-        |> Ash.create(actor: actor)
-
-      # Dots and underscores should be handled (either kept or converted)
-      assert custom_field.slug =~ ~r/^[a-z0-9-]+$/
-    end
-  end
-
-  describe "slug in queries and responses" do
-    test "slug is included in struct after create", %{actor: actor} do
-      {:ok, custom_field} =
-        CustomField
-        |> Ash.Changeset.for_create(:create, %{
-          name: "Test",
-          value_type: :string
-        })
-        |> Ash.create(actor: actor)
-
-      # Slug should be present in the struct
-      assert Map.has_key?(custom_field, :slug)
-      assert custom_field.slug != nil
-    end
-
-    test "can load custom field and slug is present", %{actor: actor} do
-      {:ok, custom_field} =
-        CustomField
-        |> Ash.Changeset.for_create(:create, %{
-          name: "Test",
-          value_type: :string
-        })
-        |> Ash.create(actor: actor)
-
-      # Load it back
-      loaded_custom_field = Ash.get!(CustomField, custom_field.id, actor: actor)
-
-      assert loaded_custom_field.slug == "test"
-    end
-
-    test "slug is returned in list queries", %{actor: actor} do
-      {:ok, custom_field} =
-        CustomField
-        |> Ash.Changeset.for_create(:create, %{
-          name: "Test",
-          value_type: :string
-        })
-        |> Ash.create(actor: actor)
-
-      custom_fields = Ash.read!(CustomField, actor: actor)
-
-      found = Enum.find(custom_fields, &(&1.id == custom_field.id))
-      assert found.slug == "test"
-    end
   end
 
   describe "slug-based lookup (future feature)" do

test/membership/group_test.exs

@@ -1,6 +1,7 @@
 defmodule Mv.Membership.GroupTest do
   @moduledoc """
   Tests for Group resource validations, CRUD operations, and relationships.
+  Uses async: true; no shared DB state or sandbox constraints.
   """
   use Mv.DataCase, async: true
 
@@ -232,23 +233,7 @@ defmodule Mv.Membership.GroupTest do
   end
 
   describe "Relationships & Deletion" do
-    test "group has many_to_many members relationship (load with preloading)", %{actor: actor} do
-      {:ok, group} = Membership.create_group(%{name: "Test Group"}, actor: actor)
-      {:ok, member} = Membership.create_member(%{email: "test@test.com"}, actor: actor)
-
-      {:ok, _mg} =
-        Membership.create_member_group(%{member_id: member.id, group_id: group.id},
-          actor: actor
-        )
-
-      # Load group with members
-      {:ok, group_with_members} =
-        Ash.load(group, :members, actor: actor, domain: Mv.Membership)
-
-      assert length(group_with_members.members) == 1
-      assert hd(group_with_members.members).id == member.id
-    end
-
+    # We test business/data rules (CASCADE), not Ash relationship loading (framework).
     test "delete group cascades to member_groups (members remain intact)", %{actor: actor} do
       {:ok, group} = Membership.create_group(%{name: "Test Group"}, actor: actor)
       {:ok, member} = Membership.create_member(%{email: "test@test.com"}, actor: actor)

test/membership/member_group_test.exs

@@ -1,6 +1,7 @@
 defmodule Mv.Membership.MemberGroupTest do
   @moduledoc """
   Tests for MemberGroup join table resource - validations and cascade delete behavior.
+  Uses async: true; no shared DB state or sandbox constraints.
   """
   use Mv.DataCase, async: true
 

test/membership/membership_fee_settings_test.exs

@@ -54,18 +54,26 @@ defmodule Mv.Membership.MembershipFeeSettingsTest do
 
       # Create a valid fee type
       {:ok, fee_type} =
-        Ash.create(MembershipFeeType, %{
+        Ash.create(
+          MembershipFeeType,
+          %{
             name: "Test Fee Type #{System.unique_integer([:positive])}",
             amount: Decimal.new("100.00"),
             interval: :yearly
-        })
+          },
+          actor: actor
+        )
 
       # Setting a valid fee type should work
       {:ok, updated} =
         settings
-        |> Ash.Changeset.for_update(:update_membership_fee_settings, %{
+        |> Ash.Changeset.for_update(
+          :update_membership_fee_settings,
+          %{
             default_membership_fee_type_id: fee_type.id
-        })
+          },
+          actor: actor
+        )
         |> Ash.update(actor: actor)
 
       assert updated.default_membership_fee_type_id == fee_type.id

test/membership_fees/changes/validate_same_interval_test.exs

@@ -52,7 +52,7 @@ defmodule Mv.MembershipFees.Changes.ValidateSameIntervalTest do
         |> Ash.Changeset.for_update(:update_member, %{membership_fee_type_id: yearly_type2.id},
           actor: actor
         )
-        |> ValidateSameInterval.change(%{}, %{})
+        |> ValidateSameInterval.change(%{}, %{actor: actor})
 
       assert changeset.valid?
     end
@@ -68,7 +68,7 @@ defmodule Mv.MembershipFees.Changes.ValidateSameIntervalTest do
         |> Ash.Changeset.for_update(:update_member, %{membership_fee_type_id: monthly_type.id},
           actor: actor
         )
-        |> ValidateSameInterval.change(%{}, %{})
+        |> ValidateSameInterval.change(%{}, %{actor: actor})
 
       refute changeset.valid?
       assert %{errors: errors} = changeset
@@ -90,7 +90,7 @@ defmodule Mv.MembershipFees.Changes.ValidateSameIntervalTest do
         |> Ash.Changeset.for_update(:update_member, %{membership_fee_type_id: yearly_type.id},
           actor: actor
         )
-        |> ValidateSameInterval.change(%{}, %{})
+        |> ValidateSameInterval.change(%{}, %{actor: actor})
 
       assert changeset.valid?
     end
@@ -102,7 +102,7 @@ defmodule Mv.MembershipFees.Changes.ValidateSameIntervalTest do
       changeset =
         member
         |> Ash.Changeset.for_update(:update_member, %{membership_fee_type_id: nil}, actor: actor)
-        |> ValidateSameInterval.change(%{}, %{})
+        |> ValidateSameInterval.change(%{}, %{actor: actor})
 
       refute changeset.valid?
       assert %{errors: errors} = changeset
@@ -120,7 +120,7 @@ defmodule Mv.MembershipFees.Changes.ValidateSameIntervalTest do
       changeset =
         member
         |> Ash.Changeset.for_update(:update_member, %{first_name: "New Name"}, actor: actor)
-        |> ValidateSameInterval.change(%{}, %{})
+        |> ValidateSameInterval.change(%{}, %{actor: actor})
 
       assert changeset.valid?
     end
@@ -136,7 +136,7 @@ defmodule Mv.MembershipFees.Changes.ValidateSameIntervalTest do
         |> Ash.Changeset.for_update(:update_member, %{membership_fee_type_id: quarterly_type.id},
           actor: actor
         )
-        |> ValidateSameInterval.change(%{}, %{})
+        |> ValidateSameInterval.change(%{}, %{actor: actor})
 
       error = Enum.find(changeset.errors, &(&1.field == :membership_fee_type_id))
       assert error.message =~ "yearly"
@@ -175,7 +175,7 @@ defmodule Mv.MembershipFees.Changes.ValidateSameIntervalTest do
           |> Ash.Changeset.for_update(:update_member, %{membership_fee_type_id: type2.id},
             actor: actor
           )
-          |> ValidateSameInterval.change(%{}, %{})
+          |> ValidateSameInterval.change(%{}, %{actor: actor})
 
         refute changeset.valid?,
                "Should prevent change from #{interval1} to #{interval2}"

test/membership_fees/membership_fee_cycle_test.exs

@@ -151,7 +151,7 @@ defmodule Mv.MembershipFees.MembershipFeeCycleTest do
       member = create_member(%{membership_fee_type_id: fee_type.id}, actor)
       cycle = create_cycle(member, fee_type, %{status: :paid}, actor)
 
-      assert {:ok, updated} = Ash.update(cycle, %{}, action: :mark_as_unpaid)
+      assert {:ok, updated} = Ash.update(cycle, %{}, actor: actor, action: :mark_as_unpaid)
       assert updated.status == :unpaid
     end
 
@@ -175,7 +175,7 @@ defmodule Mv.MembershipFees.MembershipFeeCycleTest do
       member = create_member(%{membership_fee_type_id: fee_type.id}, actor)
       cycle = create_cycle(member, fee_type, %{status: :suspended}, actor)
 
-      assert {:ok, updated} = Ash.update(cycle, %{}, action: :mark_as_unpaid)
+      assert {:ok, updated} = Ash.update(cycle, %{}, actor: actor, action: :mark_as_unpaid)
       assert updated.status == :unpaid
     end
   end

test/membership_fees/membership_fee_type_integration_test.exs

@@ -155,9 +155,13 @@ defmodule Mv.MembershipFees.MembershipFeeTypeIntegrationTest do
       {:ok, settings} = Mv.Membership.get_settings()
 
       settings
-      |> Ash.Changeset.for_update(:update_membership_fee_settings, %{
+      |> Ash.Changeset.for_update(
+        :update_membership_fee_settings,
+        %{
           default_membership_fee_type_id: fee_type.id
-      })
+        },
+        actor: actor
+      )
       |> Ash.update!(actor: actor)
 
       # Try to delete
@@ -176,9 +180,13 @@ defmodule Mv.MembershipFees.MembershipFeeTypeIntegrationTest do
       {:ok, settings} = Mv.Membership.get_settings()
 
       settings
-      |> Ash.Changeset.for_update(:update_membership_fee_settings, %{
+      |> Ash.Changeset.for_update(
+        :update_membership_fee_settings,
+        %{
           default_membership_fee_type_id: fee_type.id
-      })
+        },
+        actor: actor
+      )
       |> Ash.update!(actor: actor)
 
       # Create a member without explicitly setting membership_fee_type_id

test/membership_fees/membership_fee_type_test.exs

@@ -1,6 +1,10 @@
 defmodule Mv.MembershipFees.MembershipFeeTypeTest do
   @moduledoc """
-  Tests for MembershipFeeType resource.
+  Tests for MembershipFeeType business rules only.
+
+  We test: required fields, allowed interval values, uniqueness, amount constraints,
+  interval immutability, and referential integrity (cannot delete when in use).
+  We do not test: standard CRUD (create/update/delete when no constraints apply).
   """
   use Mv.DataCase, async: true
 
@@ -11,34 +15,7 @@ defmodule Mv.MembershipFees.MembershipFeeTypeTest do
     %{actor: system_actor}
   end
 
-  describe "create MembershipFeeType" do
-    test "can create membership fee type with valid attributes", %{actor: actor} do
-      attrs = %{
-        name: "Standard Membership",
-        amount: Decimal.new("120.00"),
-        interval: :yearly,
-        description: "Standard yearly membership fee"
-      }
-
-      assert {:ok, %MembershipFeeType{} = fee_type} =
-               Ash.create(MembershipFeeType, attrs, actor: actor)
-
-      assert fee_type.name == "Standard Membership"
-      assert Decimal.equal?(fee_type.amount, Decimal.new("120.00"))
-      assert fee_type.interval == :yearly
-      assert fee_type.description == "Standard yearly membership fee"
-    end
-
-    test "can create membership fee type without description", %{actor: actor} do
-      attrs = %{
-        name: "Basic",
-        amount: Decimal.new("60.00"),
-        interval: :monthly
-      }
-
-      assert {:ok, %MembershipFeeType{}} = Ash.create(MembershipFeeType, attrs, actor: actor)
-    end
-
+  describe "create MembershipFeeType - business rules" do
     test "requires name", %{actor: actor} do
       attrs = %{
         amount: Decimal.new("100.00"),
@@ -69,28 +46,24 @@ defmodule Mv.MembershipFees.MembershipFeeTypeTest do
       assert error_on_field?(error, :interval)
     end
 
-    test "validates interval enum values - monthly", %{actor: actor} do
-      attrs = %{name: "Monthly", amount: Decimal.new("10.00"), interval: :monthly}
-      assert {:ok, fee_type} = Ash.create(MembershipFeeType, attrs, actor: actor)
-      assert fee_type.interval == :monthly
-    end
+    test "accepts valid interval values (monthly, quarterly, half_yearly, yearly)", %{
+      actor: actor
+    } do
+      for {interval, name} <- [
+            monthly: "Monthly",
+            quarterly: "Quarterly",
+            half_yearly: "Half Yearly",
+            yearly: "Yearly"
+          ] do
+        attrs = %{
+          name: "#{name} #{System.unique_integer([:positive])}",
+          amount: Decimal.new("10.00"),
+          interval: interval
+        }
 
-    test "validates interval enum values - quarterly", %{actor: actor} do
-      attrs = %{name: "Quarterly", amount: Decimal.new("30.00"), interval: :quarterly}
         assert {:ok, fee_type} = Ash.create(MembershipFeeType, attrs, actor: actor)
-      assert fee_type.interval == :quarterly
+        assert fee_type.interval == interval
       end
-
-    test "validates interval enum values - half_yearly", %{actor: actor} do
-      attrs = %{name: "Half Yearly", amount: Decimal.new("60.00"), interval: :half_yearly}
-      assert {:ok, fee_type} = Ash.create(MembershipFeeType, attrs, actor: actor)
-      assert fee_type.interval == :half_yearly
-    end
-
-    test "validates interval enum values - yearly", %{actor: actor} do
-      attrs = %{name: "Yearly", amount: Decimal.new("120.00"), interval: :yearly}
-      assert {:ok, fee_type} = Ash.create(MembershipFeeType, attrs, actor: actor)
-      assert fee_type.interval == :yearly
     end
 
     test "rejects invalid interval values", %{actor: actor} do
@@ -128,13 +101,13 @@ defmodule Mv.MembershipFees.MembershipFeeTypeTest do
     end
   end
 
-  describe "update MembershipFeeType" do
+  describe "update MembershipFeeType - business rules" do
     setup %{actor: actor} do
       {:ok, fee_type} =
         Ash.create(
           MembershipFeeType,
           %{
-            name: "Original Name",
+            name: "Original Name #{System.unique_integer([:positive])}",
             amount: Decimal.new("100.00"),
             interval: :yearly,
             description: "Original description"
@@ -145,28 +118,6 @@ defmodule Mv.MembershipFees.MembershipFeeTypeTest do
       %{fee_type: fee_type}
     end
 
-    test "can update name", %{actor: actor, fee_type: fee_type} do
-      assert {:ok, updated} = Ash.update(fee_type, %{name: "Updated Name"}, actor: actor)
-      assert updated.name == "Updated Name"
-    end
-
-    test "can update amount", %{actor: actor, fee_type: fee_type} do
-      assert {:ok, updated} = Ash.update(fee_type, %{amount: Decimal.new("150.00")}, actor: actor)
-      assert Decimal.equal?(updated.amount, Decimal.new("150.00"))
-    end
-
-    test "can update description", %{actor: actor, fee_type: fee_type} do
-      assert {:ok, updated} =
-               Ash.update(fee_type, %{description: "Updated description"}, actor: actor)
-
-      assert updated.description == "Updated description"
-    end
-
-    test "can clear description", %{actor: actor, fee_type: fee_type} do
-      assert {:ok, updated} = Ash.update(fee_type, %{description: nil}, actor: actor)
-      assert updated.description == nil
-    end
-
     test "interval immutability: update fails when interval is changed", %{
       actor: actor,
       fee_type: fee_type
@@ -179,7 +130,7 @@ defmodule Mv.MembershipFees.MembershipFeeTypeTest do
     end
   end
 
-  describe "delete MembershipFeeType" do
+  describe "delete MembershipFeeType - business rules (referential integrity)" do
     setup %{actor: actor} do
       {:ok, fee_type} =
         Ash.create(
@@ -195,12 +146,6 @@ defmodule Mv.MembershipFees.MembershipFeeTypeTest do
       %{fee_type: fee_type}
     end
 
-    test "can delete when not in use", %{actor: actor, fee_type: fee_type} do
-      result = Ash.destroy(fee_type, actor: actor)
-      # Ash.destroy returns :ok or {:ok, _} depending on version
-      assert result == :ok or match?({:ok, _}, result)
-    end
-
     test "cannot delete when members are assigned", %{actor: actor, fee_type: fee_type} do
       alias Mv.Membership.Member
 
@@ -264,9 +209,13 @@ defmodule Mv.MembershipFees.MembershipFeeTypeTest do
       {:ok, settings} = Mv.Membership.get_settings()
 
       settings
-      |> Ash.Changeset.for_update(:update_membership_fee_settings, %{
+      |> Ash.Changeset.for_update(
+        :update_membership_fee_settings,
+        %{
           default_membership_fee_type_id: fee_type.id
-      })
+        },
+        actor: actor
+      )
       |> Ash.update!(actor: actor)
 
       # Try to delete

test/mv/accounts/user_policies_test.exs

@@ -10,7 +10,6 @@ defmodule Mv.Accounts.UserPoliciesTest do
   use Mv.DataCase, async: false
 
   alias Mv.Accounts
-  alias Mv.Authorization
 
   require Ash.Query
 
@@ -19,59 +18,10 @@ defmodule Mv.Accounts.UserPoliciesTest do
     %{actor: system_actor}
   end
 
-  # Helper to create a role with a specific permission set
-  defp create_role_with_permission_set(permission_set_name, actor) do
-    role_name = "Test Role #{permission_set_name} #{System.unique_integer([:positive])}"
-
-    case Authorization.create_role(
-           %{
-             name: role_name,
-             description: "Test role for #{permission_set_name}",
-             permission_set_name: permission_set_name
-           },
-           actor: actor
-         ) do
-      {:ok, role} -> role
-      {:error, error} -> raise "Failed to create role: #{inspect(error)}"
-    end
-  end
-
-  # Helper to create a user with a specific permission set
-  # Returns user with role preloaded (required for authorization)
-  defp create_user_with_permission_set(permission_set_name, actor) do
-    # Create role with permission set
-    role = create_role_with_permission_set(permission_set_name, actor)
-
-    # Create user
-    {:ok, user} =
-      Accounts.User
-      |> Ash.Changeset.for_create(:register_with_password, %{
-        email: "user#{System.unique_integer([:positive])}@example.com",
-        password: "testpassword123"
-      })
-      |> Ash.create(actor: actor)
-
-    # Assign role to user
-    {:ok, user} =
-      user
-      |> Ash.Changeset.for_update(:update, %{})
-      |> Ash.Changeset.manage_relationship(:role, role, type: :append_and_remove)
-      |> Ash.update(actor: actor)
-
-    # Reload user with role preloaded (critical for authorization!)
-    {:ok, user_with_role} = Ash.load(user, :role, domain: Mv.Accounts, actor: actor)
-    user_with_role
-  end
-
-  # Helper to create another user (for testing access to other users)
-  defp create_other_user(actor) do
-    create_user_with_permission_set("own_data", actor)
-  end
-
   # Shared test setup for permission sets with scope :own access
   defp setup_user_with_own_access(permission_set, actor) do
-    user = create_user_with_permission_set(permission_set, actor)
-    other_user = create_other_user(actor)
+    user = Mv.Fixtures.user_with_role_fixture(permission_set)
+    other_user = Mv.Fixtures.user_with_role_fixture("own_data")
 
     # Reload user to ensure role is preloaded
     {:ok, user} =
@@ -80,22 +30,26 @@ defmodule Mv.Accounts.UserPoliciesTest do
     %{user: user, other_user: other_user}
   end
 
-  describe "own_data permission set (Mitglied)" do
-    setup %{actor: actor} do
-      setup_user_with_own_access("own_data", actor)
+  # Data-driven: same behaviour for own_data, read_only, normal_user (scope :own for User)
+  describe "non-admin permission sets (own_data, read_only, normal_user)" do
+    setup %{actor: actor} = context do
+      permission_set = context[:permission_set] || "own_data"
+      setup_user_with_own_access(permission_set, actor)
     end
 
-    test "can read own user record", %{user: user} do
+    for permission_set <- ["own_data", "read_only", "normal_user"] do
+      @tag permission_set: permission_set
+      test "can read own user record (#{permission_set})", %{user: user} do
         {:ok, fetched_user} =
           Ash.get(Accounts.User, user.id, actor: user, domain: Mv.Accounts)
 
         assert fetched_user.id == user.id
       end
 
-    test "can update own email", %{user: user} do
+      @tag permission_set: permission_set
+      test "can update own email (#{permission_set})", %{user: user} do
         new_email = "updated#{System.unique_integer([:positive])}@example.com"
 
-      # Non-admins use :update (email only); :update_user is admin-only (member link/unlink).
         {:ok, updated_user} =
           user
           |> Ash.Changeset.for_update(:update, %{email: new_email})
@@ -104,19 +58,21 @@ defmodule Mv.Accounts.UserPoliciesTest do
         assert updated_user.email == Ash.CiString.new(new_email)
       end
 
-    test "cannot read other users (returns not found due to auto_filter)", %{
+      @tag permission_set: permission_set
+      test "cannot read other users - not found due to auto_filter (#{permission_set})", %{
         user: user,
         other_user: other_user
       } do
-      # Note: With auto_filter policies, when a user tries to read a user that doesn't
-      # match the filter (id == actor.id), Ash returns NotFound, not Forbidden.
-      # This is the expected behavior - the filter makes the record "invisible" to the user.
         assert_raise Ash.Error.Invalid, fn ->
           Ash.get!(Accounts.User, other_user.id, actor: user, domain: Mv.Accounts)
         end
       end
 
-    test "cannot update other users (returns forbidden)", %{user: user, other_user: other_user} do
+      @tag permission_set: permission_set
+      test "cannot update other users - forbidden (#{permission_set})", %{
+        user: user,
+        other_user: other_user
+      } do
         assert_raise Ash.Error.Forbidden, fn ->
           other_user
           |> Ash.Changeset.for_update(:update, %{email: "hacked@example.com"})
@@ -124,15 +80,16 @@ defmodule Mv.Accounts.UserPoliciesTest do
         end
       end
 
-    test "list users returns only own user", %{user: user} do
+      @tag permission_set: permission_set
+      test "list users returns only own user (#{permission_set})", %{user: user} do
         {:ok, users} = Ash.read(Accounts.User, actor: user, domain: Mv.Accounts)
 
-      # Should only return the own user (scope :own filters)
         assert length(users) == 1
         assert hd(users).id == user.id
       end
 
-    test "cannot create user (returns forbidden)", %{user: user} do
+      @tag permission_set: permission_set
+      test "cannot create user - forbidden (#{permission_set})", %{user: user} do
         assert_raise Ash.Error.Forbidden, fn ->
           Accounts.User
           |> Ash.Changeset.for_create(:create_user, %{
@@ -142,155 +99,32 @@ defmodule Mv.Accounts.UserPoliciesTest do
         end
       end
 
-    test "cannot destroy user (returns forbidden)", %{user: user} do
+      @tag permission_set: permission_set
+      test "cannot destroy user - forbidden (#{permission_set})", %{user: user} do
         assert_raise Ash.Error.Forbidden, fn ->
           Ash.destroy!(user, actor: user)
         end
       end
-  end
 
-  describe "read_only permission set (Vorstand/Buchhaltung)" do
-    setup %{actor: actor} do
-      setup_user_with_own_access("read_only", actor)
-    end
-
-    test "can read own user record", %{user: user} do
-      {:ok, fetched_user} =
-        Ash.get(Accounts.User, user.id, actor: user, domain: Mv.Accounts)
-
-      assert fetched_user.id == user.id
-    end
-
-    test "can update own email", %{user: user} do
-      new_email = "updated#{System.unique_integer([:positive])}@example.com"
-
-      # Non-admins use :update (email only); :update_user is admin-only (member link/unlink).
-      {:ok, updated_user} =
-        user
-        |> Ash.Changeset.for_update(:update, %{email: new_email})
-        |> Ash.update(actor: user)
-
-      assert updated_user.email == Ash.CiString.new(new_email)
-    end
-
-    test "cannot read other users (returns not found due to auto_filter)", %{
+      @tag permission_set: permission_set
+      test "cannot change role via update_user - forbidden (#{permission_set})", %{
         user: user,
         other_user: other_user
       } do
-      # Note: With auto_filter policies, when a user tries to read a user that doesn't
-      # match the filter (id == actor.id), Ash returns NotFound, not Forbidden.
-      # This is the expected behavior - the filter makes the record "invisible" to the user.
-      assert_raise Ash.Error.Invalid, fn ->
-        Ash.get!(Accounts.User, other_user.id, actor: user, domain: Mv.Accounts)
-      end
-    end
+        other_role = Mv.Fixtures.role_fixture("read_only")
 
-    test "cannot update other users (returns forbidden)", %{user: user, other_user: other_user} do
-      assert_raise Ash.Error.Forbidden, fn ->
+        assert {:error, %Ash.Error.Forbidden{}} =
                  other_user
-        |> Ash.Changeset.for_update(:update, %{email: "hacked@example.com"})
-        |> Ash.update!(actor: user)
-      end
-    end
-
-    test "list users returns only own user", %{user: user} do
-      {:ok, users} = Ash.read(Accounts.User, actor: user, domain: Mv.Accounts)
-
-      # Should only return the own user (scope :own filters)
-      assert length(users) == 1
-      assert hd(users).id == user.id
-    end
-
-    test "cannot create user (returns forbidden)", %{user: user} do
-      assert_raise Ash.Error.Forbidden, fn ->
-        Accounts.User
-        |> Ash.Changeset.for_create(:create_user, %{
-          email: "new#{System.unique_integer([:positive])}@example.com"
-        })
-        |> Ash.create!(actor: user)
-      end
-    end
-
-    test "cannot destroy user (returns forbidden)", %{user: user} do
-      assert_raise Ash.Error.Forbidden, fn ->
-        Ash.destroy!(user, actor: user)
-      end
-    end
-  end
-
-  describe "normal_user permission set (Kassenwart)" do
-    setup %{actor: actor} do
-      setup_user_with_own_access("normal_user", actor)
-    end
-
-    test "can read own user record", %{user: user} do
-      {:ok, fetched_user} =
-        Ash.get(Accounts.User, user.id, actor: user, domain: Mv.Accounts)
-
-      assert fetched_user.id == user.id
-    end
-
-    test "can update own email", %{user: user} do
-      new_email = "updated#{System.unique_integer([:positive])}@example.com"
-
-      # Non-admins use :update (email only); :update_user is admin-only (member link/unlink).
-      {:ok, updated_user} =
-        user
-        |> Ash.Changeset.for_update(:update, %{email: new_email})
-        |> Ash.update(actor: user)
-
-      assert updated_user.email == Ash.CiString.new(new_email)
-    end
-
-    test "cannot read other users (returns not found due to auto_filter)", %{
-      user: user,
-      other_user: other_user
-    } do
-      # Note: With auto_filter policies, when a user tries to read a user that doesn't
-      # match the filter (id == actor.id), Ash returns NotFound, not Forbidden.
-      # This is the expected behavior - the filter makes the record "invisible" to the user.
-      assert_raise Ash.Error.Invalid, fn ->
-        Ash.get!(Accounts.User, other_user.id, actor: user, domain: Mv.Accounts)
-      end
-    end
-
-    test "cannot update other users (returns forbidden)", %{user: user, other_user: other_user} do
-      assert_raise Ash.Error.Forbidden, fn ->
-        other_user
-        |> Ash.Changeset.for_update(:update, %{email: "hacked@example.com"})
-        |> Ash.update!(actor: user)
-      end
-    end
-
-    test "list users returns only own user", %{user: user} do
-      {:ok, users} = Ash.read(Accounts.User, actor: user, domain: Mv.Accounts)
-
-      # Should only return the own user (scope :own filters)
-      assert length(users) == 1
-      assert hd(users).id == user.id
-    end
-
-    test "cannot create user (returns forbidden)", %{user: user} do
-      assert_raise Ash.Error.Forbidden, fn ->
-        Accounts.User
-        |> Ash.Changeset.for_create(:create_user, %{
-          email: "new#{System.unique_integer([:positive])}@example.com"
-        })
-        |> Ash.create!(actor: user)
-      end
-    end
-
-    test "cannot destroy user (returns forbidden)", %{user: user} do
-      assert_raise Ash.Error.Forbidden, fn ->
-        Ash.destroy!(user, actor: user)
+                 |> Ash.Changeset.for_update(:update_user, %{role_id: other_role.id})
+                 |> Ash.update(actor: user, domain: Mv.Accounts)
       end
     end
   end
 
   describe "admin permission set" do
     setup %{actor: actor} do
-      user = create_user_with_permission_set("admin", actor)
-      other_user = create_other_user(actor)
+      user = Mv.Fixtures.user_with_role_fixture("admin")
+      other_user = Mv.Fixtures.user_with_role_fixture("own_data")
 
       # Reload user to ensure role is preloaded
       {:ok, user} =
@@ -343,6 +177,88 @@ defmodule Mv.Accounts.UserPoliciesTest do
       # Verify user is deleted
       assert {:error, _} = Ash.get(Accounts.User, other_user.id, domain: Mv.Accounts)
     end
+
+    test "admin can assign role to another user via update_user", %{
+      other_user: other_user
+    } do
+      admin = Mv.Fixtures.user_with_role_fixture("admin")
+      normal_user_role = Mv.Fixtures.role_fixture("normal_user")
+
+      {:ok, updated} =
+        other_user
+        |> Ash.Changeset.for_update(:update_user, %{role_id: normal_user_role.id})
+        |> Ash.update(actor: admin)
+
+      assert updated.role_id == normal_user_role.id
+    end
+  end
+
+  describe "admin role assignment and last-admin validation" do
+    test "two admins: one can change own role to normal_user (other remains admin)", %{
+      actor: _actor
+    } do
+      _admin_role = Mv.Fixtures.role_fixture("admin")
+      normal_user_role = Mv.Fixtures.role_fixture("normal_user")
+
+      admin_a = Mv.Fixtures.user_with_role_fixture("admin")
+      _admin_b = Mv.Fixtures.user_with_role_fixture("admin")
+
+      {:ok, updated} =
+        admin_a
+        |> Ash.Changeset.for_update(:update_user, %{role_id: normal_user_role.id})
+        |> Ash.update(actor: admin_a)
+
+      assert updated.role_id == normal_user_role.id
+    end
+
+    test "single admin: changing own role to normal_user returns validation error", %{
+      actor: _actor
+    } do
+      normal_user_role = Mv.Fixtures.role_fixture("normal_user")
+      single_admin = Mv.Fixtures.user_with_role_fixture("admin")
+
+      assert {:error, %Ash.Error.Invalid{errors: errors}} =
+               single_admin
+               |> Ash.Changeset.for_update(:update_user, %{role_id: normal_user_role.id})
+               |> Ash.update(actor: single_admin)
+
+      error_messages =
+        Enum.flat_map(errors, fn
+          %Ash.Error.Changes.InvalidAttribute{message: msg} when is_binary(msg) -> [msg]
+          %{message: msg} when is_binary(msg) -> [msg]
+          _ -> []
+        end)
+
+      assert Enum.any?(error_messages, fn msg ->
+               msg =~ "least one user must keep the Admin role" or msg =~ "Admin role"
+             end),
+             "Expected last-admin validation message, got: #{inspect(error_messages)}"
+    end
+
+    test "admin can switch to another admin role (two roles with permission_set_name admin)", %{
+      actor: _actor
+    } do
+      # Two distinct roles both with permission_set_name "admin" (e.g. "Admin" and "Superadmin")
+      admin_role_a = Mv.Fixtures.role_fixture("admin")
+      admin_role_b = Mv.Fixtures.role_fixture("admin")
+
+      admin_user = Mv.Fixtures.user_with_role_fixture("admin")
+      # Ensure user has role_a so we can switch to role_b
+      {:ok, admin_user} =
+        admin_user
+        |> Ash.Changeset.for_update(:update_user, %{role_id: admin_role_a.id})
+        |> Ash.update(actor: admin_user)
+
+      assert admin_user.role_id == admin_role_a.id
+
+      # Switching to another admin role must be allowed (no last-admin error)
+      {:ok, updated} =
+        admin_user
+        |> Ash.Changeset.for_update(:update_user, %{role_id: admin_role_b.id})
+        |> Ash.update(actor: admin_user)
+
+      assert updated.role_id == admin_role_b.id
+    end
   end
 
   describe "AshAuthentication bypass" do

test/mv/authorization/permission_sets_test.exs

@@ -496,6 +496,281 @@ defmodule Mv.Authorization.PermissionSetsTest do
 
       assert "*" in permissions.pages
     end
+
+    test "admin pages include explicit /settings and /membership_fee_settings" do
+      permissions = PermissionSets.get_permissions(:admin)
+
+      assert "/settings" in permissions.pages
+      assert "/membership_fee_settings" in permissions.pages
+    end
+  end
+
+  describe "get_permissions/1 - MemberGroup resource" do
+    test "own_data has MemberGroup read with scope :linked only" do
+      permissions = PermissionSets.get_permissions(:own_data)
+
+      mg_read =
+        Enum.find(permissions.resources, fn p ->
+          p.resource == "MemberGroup" && p.action == :read
+        end)
+
+      mg_create =
+        Enum.find(permissions.resources, fn p ->
+          p.resource == "MemberGroup" && p.action == :create
+        end)
+
+      assert mg_read != nil
+      assert mg_read.scope == :linked
+      assert mg_read.granted == true
+      assert mg_create == nil || mg_create.granted == false
+    end
+
+    test "read_only has MemberGroup read with scope :all, no create/destroy" do
+      permissions = PermissionSets.get_permissions(:read_only)
+
+      mg_read =
+        Enum.find(permissions.resources, fn p ->
+          p.resource == "MemberGroup" && p.action == :read
+        end)
+
+      mg_create =
+        Enum.find(permissions.resources, fn p ->
+          p.resource == "MemberGroup" && p.action == :create
+        end)
+
+      mg_destroy =
+        Enum.find(permissions.resources, fn p ->
+          p.resource == "MemberGroup" && p.action == :destroy
+        end)
+
+      assert mg_read != nil
+      assert mg_read.scope == :all
+      assert mg_read.granted == true
+      assert mg_create == nil || mg_create.granted == false
+      assert mg_destroy == nil || mg_destroy.granted == false
+    end
+
+    test "normal_user has MemberGroup read/create/destroy with scope :all" do
+      permissions = PermissionSets.get_permissions(:normal_user)
+
+      mg_read =
+        Enum.find(permissions.resources, fn p ->
+          p.resource == "MemberGroup" && p.action == :read
+        end)
+
+      mg_create =
+        Enum.find(permissions.resources, fn p ->
+          p.resource == "MemberGroup" && p.action == :create
+        end)
+
+      mg_destroy =
+        Enum.find(permissions.resources, fn p ->
+          p.resource == "MemberGroup" && p.action == :destroy
+        end)
+
+      assert mg_read != nil
+      assert mg_read.scope == :all
+      assert mg_read.granted == true
+      assert mg_create != nil
+      assert mg_create.scope == :all
+      assert mg_create.granted == true
+      assert mg_destroy != nil
+      assert mg_destroy.scope == :all
+      assert mg_destroy.granted == true
+    end
+
+    test "admin has MemberGroup read/create/destroy with scope :all" do
+      permissions = PermissionSets.get_permissions(:admin)
+
+      mg_read =
+        Enum.find(permissions.resources, fn p ->
+          p.resource == "MemberGroup" && p.action == :read
+        end)
+
+      mg_create =
+        Enum.find(permissions.resources, fn p ->
+          p.resource == "MemberGroup" && p.action == :create
+        end)
+
+      mg_destroy =
+        Enum.find(permissions.resources, fn p ->
+          p.resource == "MemberGroup" && p.action == :destroy
+        end)
+
+      assert mg_read != nil
+      assert mg_read.scope == :all
+      assert mg_read.granted == true
+      assert mg_create != nil
+      assert mg_create.granted == true
+      assert mg_destroy != nil
+      assert mg_destroy.granted == true
+    end
+  end
+
+  describe "get_permissions/1 - MembershipFeeType resource" do
+    test "all permission sets have MembershipFeeType read with scope :all" do
+      for set <- PermissionSets.all_permission_sets() do
+        permissions = PermissionSets.get_permissions(set)
+
+        mft_read =
+          Enum.find(permissions.resources, fn p ->
+            p.resource == "MembershipFeeType" && p.action == :read
+          end)
+
+        assert mft_read != nil, "Permission set #{set} should have MembershipFeeType read"
+        assert mft_read.scope == :all
+        assert mft_read.granted == true
+      end
+    end
+
+    test "only admin has MembershipFeeType create/update/destroy" do
+      for set <- [:own_data, :read_only, :normal_user] do
+        permissions = PermissionSets.get_permissions(set)
+
+        mft_create =
+          Enum.find(permissions.resources, fn p ->
+            p.resource == "MembershipFeeType" && p.action == :create
+          end)
+
+        mft_update =
+          Enum.find(permissions.resources, fn p ->
+            p.resource == "MembershipFeeType" && p.action == :update
+          end)
+
+        mft_destroy =
+          Enum.find(permissions.resources, fn p ->
+            p.resource == "MembershipFeeType" && p.action == :destroy
+          end)
+
+        assert mft_create == nil || mft_create.granted == false,
+               "Permission set #{set} should not allow MembershipFeeType create"
+
+        assert mft_update == nil || mft_update.granted == false,
+               "Permission set #{set} should not allow MembershipFeeType update"
+
+        assert mft_destroy == nil || mft_destroy.granted == false,
+               "Permission set #{set} should not allow MembershipFeeType destroy"
+      end
+
+      admin_permissions = PermissionSets.get_permissions(:admin)
+
+      mft_create =
+        Enum.find(admin_permissions.resources, fn p ->
+          p.resource == "MembershipFeeType" && p.action == :create
+        end)
+
+      mft_update =
+        Enum.find(admin_permissions.resources, fn p ->
+          p.resource == "MembershipFeeType" && p.action == :update
+        end)
+
+      mft_destroy =
+        Enum.find(admin_permissions.resources, fn p ->
+          p.resource == "MembershipFeeType" && p.action == :destroy
+        end)
+
+      assert mft_create != nil
+      assert mft_create.scope == :all
+      assert mft_create.granted == true
+      assert mft_update != nil
+      assert mft_update.granted == true
+      assert mft_destroy != nil
+      assert mft_destroy.granted == true
+    end
+  end
+
+  describe "get_permissions/1 - MembershipFeeCycle resource" do
+    test "all permission sets have MembershipFeeCycle read; own_data uses :linked, others :all" do
+      for set <- PermissionSets.all_permission_sets() do
+        permissions = PermissionSets.get_permissions(set)
+
+        mfc_read =
+          Enum.find(permissions.resources, fn p ->
+            p.resource == "MembershipFeeCycle" && p.action == :read
+          end)
+
+        assert mfc_read != nil, "Permission set #{set} should have MembershipFeeCycle read"
+        assert mfc_read.granted == true
+
+        expected_scope = if set == :own_data, do: :linked, else: :all
+
+        assert mfc_read.scope == expected_scope,
+               "Permission set #{set} should have MembershipFeeCycle read scope #{expected_scope}, got #{mfc_read.scope}"
+      end
+    end
+
+    test "read_only has MembershipFeeCycle read only, no update" do
+      permissions = PermissionSets.get_permissions(:read_only)
+
+      mfc_update =
+        Enum.find(permissions.resources, fn p ->
+          p.resource == "MembershipFeeCycle" && p.action == :update
+        end)
+
+      assert mfc_update == nil || mfc_update.granted == false
+    end
+
+    test "normal_user has MembershipFeeCycle read/create/update/destroy with scope :all" do
+      permissions = PermissionSets.get_permissions(:normal_user)
+
+      mfc_read =
+        Enum.find(permissions.resources, fn p ->
+          p.resource == "MembershipFeeCycle" && p.action == :read
+        end)
+
+      mfc_create =
+        Enum.find(permissions.resources, fn p ->
+          p.resource == "MembershipFeeCycle" && p.action == :create
+        end)
+
+      mfc_update =
+        Enum.find(permissions.resources, fn p ->
+          p.resource == "MembershipFeeCycle" && p.action == :update
+        end)
+
+      mfc_destroy =
+        Enum.find(permissions.resources, fn p ->
+          p.resource == "MembershipFeeCycle" && p.action == :destroy
+        end)
+
+      assert mfc_read != nil && mfc_read.granted == true
+      assert mfc_create != nil && mfc_create.scope == :all && mfc_create.granted == true
+      assert mfc_update != nil && mfc_update.granted == true
+      assert mfc_destroy != nil && mfc_destroy.scope == :all && mfc_destroy.granted == true
+    end
+
+    test "admin has MembershipFeeCycle read/create/update/destroy with scope :all" do
+      permissions = PermissionSets.get_permissions(:admin)
+
+      mfc_read =
+        Enum.find(permissions.resources, fn p ->
+          p.resource == "MembershipFeeCycle" && p.action == :read
+        end)
+
+      mfc_create =
+        Enum.find(permissions.resources, fn p ->
+          p.resource == "MembershipFeeCycle" && p.action == :create
+        end)
+
+      mfc_update =
+        Enum.find(permissions.resources, fn p ->
+          p.resource == "MembershipFeeCycle" && p.action == :update
+        end)
+
+      mfc_destroy =
+        Enum.find(permissions.resources, fn p ->
+          p.resource == "MembershipFeeCycle" && p.action == :destroy
+        end)
+
+      assert mfc_read != nil
+      assert mfc_read.granted == true
+      assert mfc_create != nil
+      assert mfc_create.granted == true
+      assert mfc_update != nil
+      assert mfc_update.granted == true
+      assert mfc_destroy != nil
+      assert mfc_destroy.granted == true
+    end
   end
 
   describe "valid_permission_set?/1" do

test/mv/authorization/role_policies_test.exs

@@ -0,0 +1,226 @@
+defmodule Mv.Authorization.RolePoliciesTest do
+  @moduledoc """
+  Tests for Role resource authorization policies.
+
+  Rule: All permission sets (own_data, read_only, normal_user, admin) can **read** roles.
+  Only **admin** can create, update, or destroy roles.
+  """
+  use Mv.DataCase, async: false
+
+  alias Mv.Authorization
+  alias Mv.Authorization.Role
+
+  describe "read access - all permission sets can read roles" do
+    setup do
+      # Create a role to read (via system_actor; once policies exist, system_actor is admin)
+      role = Mv.Fixtures.role_fixture("read_only")
+      %{role: role}
+    end
+
+    @tag :permission_set_own_data
+    test "own_data can list roles", %{role: _role} do
+      user = Mv.Fixtures.user_with_role_fixture("own_data")
+      user = Mv.Authorization.Actor.ensure_loaded(user)
+
+      {:ok, roles} = Authorization.list_roles(actor: user)
+
+      assert is_list(roles)
+      assert roles != []
+    end
+
+    @tag :permission_set_own_data
+    test "own_data can get role by id", %{role: role} do
+      user = Mv.Fixtures.user_with_role_fixture("own_data")
+      user = Mv.Authorization.Actor.ensure_loaded(user)
+
+      {:ok, loaded} = Ash.get(Role, role.id, actor: user, domain: Mv.Authorization)
+
+      assert loaded.id == role.id
+    end
+
+    @tag :permission_set_read_only
+    test "read_only can list roles", %{role: _role} do
+      user = Mv.Fixtures.user_with_role_fixture("read_only")
+      user = Mv.Authorization.Actor.ensure_loaded(user)
+
+      {:ok, roles} = Authorization.list_roles(actor: user)
+
+      assert is_list(roles)
+      assert roles != []
+    end
+
+    @tag :permission_set_read_only
+    test "read_only can get role by id", %{role: role} do
+      user = Mv.Fixtures.user_with_role_fixture("read_only")
+      user = Mv.Authorization.Actor.ensure_loaded(user)
+
+      {:ok, loaded} = Ash.get(Role, role.id, actor: user, domain: Mv.Authorization)
+
+      assert loaded.id == role.id
+    end
+
+    @tag :permission_set_normal_user
+    test "normal_user can list roles", %{role: _role} do
+      user = Mv.Fixtures.user_with_role_fixture("normal_user")
+      user = Mv.Authorization.Actor.ensure_loaded(user)
+
+      {:ok, roles} = Authorization.list_roles(actor: user)
+
+      assert is_list(roles)
+      assert roles != []
+    end
+
+    @tag :permission_set_normal_user
+    test "normal_user can get role by id", %{role: role} do
+      user = Mv.Fixtures.user_with_role_fixture("normal_user")
+      user = Mv.Authorization.Actor.ensure_loaded(user)
+
+      {:ok, loaded} = Ash.get(Role, role.id, actor: user, domain: Mv.Authorization)
+
+      assert loaded.id == role.id
+    end
+
+    @tag :permission_set_admin
+    test "admin can list roles", %{role: _role} do
+      admin = Mv.Fixtures.user_with_role_fixture("admin")
+      admin = Mv.Authorization.Actor.ensure_loaded(admin)
+
+      {:ok, roles} = Authorization.list_roles(actor: admin)
+
+      assert is_list(roles)
+      assert roles != []
+    end
+
+    @tag :permission_set_admin
+    test "admin can get role by id", %{role: role} do
+      admin = Mv.Fixtures.user_with_role_fixture("admin")
+      admin = Mv.Authorization.Actor.ensure_loaded(admin)
+
+      {:ok, loaded} = Ash.get(Role, role.id, actor: admin, domain: Mv.Authorization)
+
+      assert loaded.id == role.id
+    end
+  end
+
+  describe "create/update/destroy - only admin allowed" do
+    setup do
+      # Non-system role for destroy test (role_fixture creates non-system roles)
+      role = Mv.Fixtures.role_fixture("normal_user")
+      %{role: role}
+    end
+
+    test "admin can create_role", %{role: _role} do
+      admin = Mv.Fixtures.user_with_role_fixture("admin")
+      admin = Mv.Authorization.Actor.ensure_loaded(admin)
+
+      attrs = %{
+        name: "New Role #{System.unique_integer([:positive])}",
+        description: "Test",
+        permission_set_name: "read_only"
+      }
+
+      assert {:ok, _created} = Authorization.create_role(attrs, actor: admin)
+    end
+
+    test "admin can update_role", %{role: role} do
+      admin = Mv.Fixtures.user_with_role_fixture("admin")
+      admin = Mv.Authorization.Actor.ensure_loaded(admin)
+
+      assert {:ok, updated} =
+               Authorization.update_role(role, %{description: "Updated by admin"}, actor: admin)
+
+      assert updated.description == "Updated by admin"
+    end
+
+    test "admin can destroy non-system role", %{role: role} do
+      admin = Mv.Fixtures.user_with_role_fixture("admin")
+      admin = Mv.Authorization.Actor.ensure_loaded(admin)
+
+      assert :ok = Authorization.destroy_role(role, actor: admin)
+    end
+
+    test "own_data cannot create_role (forbidden)", %{role: _role} do
+      user = Mv.Fixtures.user_with_role_fixture("own_data")
+      user = Mv.Authorization.Actor.ensure_loaded(user)
+
+      attrs = %{
+        name: "New Role #{System.unique_integer([:positive])}",
+        description: "Test",
+        permission_set_name: "read_only"
+      }
+
+      assert {:error, %Ash.Error.Forbidden{}} = Authorization.create_role(attrs, actor: user)
+    end
+
+    test "own_data cannot update_role (forbidden)", %{role: role} do
+      user = Mv.Fixtures.user_with_role_fixture("own_data")
+      user = Mv.Authorization.Actor.ensure_loaded(user)
+
+      assert {:error, %Ash.Error.Forbidden{}} =
+               Authorization.update_role(role, %{description: "Updated"}, actor: user)
+    end
+
+    test "own_data cannot destroy_role (forbidden)", %{role: role} do
+      user = Mv.Fixtures.user_with_role_fixture("own_data")
+      user = Mv.Authorization.Actor.ensure_loaded(user)
+
+      assert {:error, %Ash.Error.Forbidden{}} = Authorization.destroy_role(role, actor: user)
+    end
+
+    test "read_only cannot create_role (forbidden)", %{role: _role} do
+      user = Mv.Fixtures.user_with_role_fixture("read_only")
+      user = Mv.Authorization.Actor.ensure_loaded(user)
+
+      attrs = %{
+        name: "New Role #{System.unique_integer([:positive])}",
+        description: "Test",
+        permission_set_name: "read_only"
+      }
+
+      assert {:error, %Ash.Error.Forbidden{}} = Authorization.create_role(attrs, actor: user)
+    end
+
+    test "read_only cannot update_role (forbidden)", %{role: role} do
+      user = Mv.Fixtures.user_with_role_fixture("read_only")
+      user = Mv.Authorization.Actor.ensure_loaded(user)
+
+      assert {:error, %Ash.Error.Forbidden{}} =
+               Authorization.update_role(role, %{description: "Updated"}, actor: user)
+    end
+
+    test "read_only cannot destroy_role (forbidden)", %{role: role} do
+      user = Mv.Fixtures.user_with_role_fixture("read_only")
+      user = Mv.Authorization.Actor.ensure_loaded(user)
+
+      assert {:error, %Ash.Error.Forbidden{}} = Authorization.destroy_role(role, actor: user)
+    end
+
+    test "normal_user cannot create_role (forbidden)", %{role: _role} do
+      user = Mv.Fixtures.user_with_role_fixture("normal_user")
+      user = Mv.Authorization.Actor.ensure_loaded(user)
+
+      attrs = %{
+        name: "New Role #{System.unique_integer([:positive])}",
+        description: "Test",
+        permission_set_name: "normal_user"
+      }
+
+      assert {:error, %Ash.Error.Forbidden{}} = Authorization.create_role(attrs, actor: user)
+    end
+
+    test "normal_user cannot update_role (forbidden)", %{role: role} do
+      user = Mv.Fixtures.user_with_role_fixture("normal_user")
+      user = Mv.Authorization.Actor.ensure_loaded(user)
+
+      assert {:error, %Ash.Error.Forbidden{}} =
+               Authorization.update_role(role, %{description: "Updated"}, actor: user)
+    end
+
+    test "normal_user cannot destroy_role (forbidden)", %{role: role} do
+      user = Mv.Fixtures.user_with_role_fixture("normal_user")
+      user = Mv.Authorization.Actor.ensure_loaded(user)
+
+      assert {:error, %Ash.Error.Forbidden{}} = Authorization.destroy_role(role, actor: user)
+    end
+  end
+end

test/mv/authorization/role_test.exs

@@ -12,27 +12,29 @@ defmodule Mv.Authorization.RoleTest do
   end
 
   describe "permission_set_name validation" do
-    test "accepts valid permission set names" do
+    test "accepts valid permission set names", %{actor: actor} do
       attrs = %{
         name: "Test Role",
         permission_set_name: "own_data"
       }
 
-      assert {:ok, role} = Authorization.create_role(attrs)
+      assert {:ok, role} = Authorization.create_role(attrs, actor: actor)
       assert role.permission_set_name == "own_data"
     end
 
-    test "rejects invalid permission set names" do
+    test "rejects invalid permission set names", %{actor: actor} do
       attrs = %{
         name: "Test Role",
         permission_set_name: "invalid_set"
       }
 
-      assert {:error, %Ash.Error.Invalid{errors: errors}} = Authorization.create_role(attrs)
+      assert {:error, %Ash.Error.Invalid{errors: errors}} =
+               Authorization.create_role(attrs, actor: actor)
+
       assert error_message(errors, :permission_set_name) =~ "must be one of"
     end
 
-    test "accepts all four valid permission sets" do
+    test "accepts all four valid permission sets", %{actor: actor} do
       valid_sets = ["own_data", "read_only", "normal_user", "admin"]
 
       for permission_set <- valid_sets do
@@ -41,7 +43,7 @@ defmodule Mv.Authorization.RoleTest do
           permission_set_name: permission_set
         }
 
-        assert {:ok, _role} = Authorization.create_role(attrs)
+        assert {:ok, _role} = Authorization.create_role(attrs, actor: actor)
       end
     end
   end
@@ -60,34 +62,36 @@ defmodule Mv.Authorization.RoleTest do
       {:ok, system_role} = Ash.create(changeset, actor: actor)
 
       assert {:error, %Ash.Error.Invalid{errors: errors}} =
-               Authorization.destroy_role(system_role)
+               Authorization.destroy_role(system_role, actor: actor)
 
       message = error_message(errors, :is_system_role)
       assert message =~ "Cannot delete system role"
     end
 
-    test "allows deletion of non-system roles" do
+    test "allows deletion of non-system roles", %{actor: actor} do
       # is_system_role defaults to false, so regular create works
       {:ok, regular_role} =
-        Authorization.create_role(%{
-          name: "Regular Role",
-          permission_set_name: "read_only"
-        })
+        Authorization.create_role(
+          %{name: "Regular Role", permission_set_name: "read_only"},
+          actor: actor
+        )
 
-      assert :ok = Authorization.destroy_role(regular_role)
+      assert :ok = Authorization.destroy_role(regular_role, actor: actor)
     end
   end
 
   describe "name uniqueness" do
-    test "enforces unique role names" do
+    test "enforces unique role names", %{actor: actor} do
       attrs = %{
         name: "Unique Role",
         permission_set_name: "own_data"
       }
 
-      assert {:ok, _} = Authorization.create_role(attrs)
+      assert {:ok, _} = Authorization.create_role(attrs, actor: actor)
+
+      assert {:error, %Ash.Error.Invalid{errors: errors}} =
+               Authorization.create_role(attrs, actor: actor)
 
-      assert {:error, %Ash.Error.Invalid{errors: errors}} = Authorization.create_role(attrs)
       assert error_message(errors, :name) =~ "has already been taken"
     end
   end

test/mv/helpers/system_actor_test.exs

@@ -18,18 +18,21 @@ defmodule Mv.Helpers.SystemActorTest do
     Ecto.Adapters.SQL.query!(Mv.Repo, "DELETE FROM users WHERE id = $1", [id])
   end
 
-  # Helper function to ensure admin role exists
+  # Helper function to ensure admin role exists (bootstrap: no actor yet, use authorize?: false)
   defp ensure_admin_role do
-    case Authorization.list_roles() do
+    case Authorization.list_roles(authorize?: false) do
       {:ok, roles} ->
         case Enum.find(roles, &(&1.permission_set_name == "admin")) do
           nil ->
             {:ok, role} =
-              Authorization.create_role(%{
+              Authorization.create_role(
+                %{
                   name: "Admin",
                   description: "Administrator with full access",
                   permission_set_name: "admin"
-              })
+                },
+                authorize?: false
+              )
 
             role
 
@@ -39,11 +42,14 @@ defmodule Mv.Helpers.SystemActorTest do
 
       _ ->
         {:ok, role} =
-          Authorization.create_role(%{
+          Authorization.create_role(
+            %{
               name: "Admin",
               description: "Administrator with full access",
               permission_set_name: "admin"
-          })
+            },
+            authorize?: false
+          )
 
         role
     end
@@ -364,12 +370,17 @@ defmodule Mv.Helpers.SystemActorTest do
 
     test "raises error if system user has wrong role", %{system_user: system_user} do
       # Create a non-admin role (using read_only as it's a valid permission set)
+      system_actor = SystemActor.get_system_actor()
+
       {:ok, read_only_role} =
-        Authorization.create_role(%{
+        Authorization.create_role(
+          %{
             name: "Read Only Role",
             description: "Read-only access",
             permission_set_name: "read_only"
-        })
+          },
+          actor: system_actor
+        )
 
       system_actor = SystemActor.get_system_actor()
 

test/mv/membership/custom_field_policies_test.exs

@@ -8,67 +8,30 @@ defmodule Mv.Membership.CustomFieldPoliciesTest do
   use Mv.DataCase, async: false
 
   alias Mv.Membership.CustomField
-  alias Mv.Accounts
-  alias Mv.Authorization
 
   setup do
     system_actor = Mv.Helpers.SystemActor.get_system_actor()
     %{actor: system_actor}
   end
 
-  defp create_role_with_permission_set(permission_set_name, actor) do
-    role_name = "Test Role #{permission_set_name} #{System.unique_integer([:positive])}"
+  defp create_custom_field do
+    admin = Mv.Fixtures.user_with_role_fixture("admin")
 
-    case Authorization.create_role(
-           %{
-             name: role_name,
-             description: "Test role for #{permission_set_name}",
-             permission_set_name: permission_set_name
-           },
-           actor: actor
-         ) do
-      {:ok, role} -> role
-      {:error, error} -> raise "Failed to create role: #{inspect(error)}"
-    end
-  end
-
-  defp create_user_with_permission_set(permission_set_name, actor) do
-    role = create_role_with_permission_set(permission_set_name, actor)
-
-    {:ok, user} =
-      Accounts.User
-      |> Ash.Changeset.for_create(:register_with_password, %{
-        email: "user#{System.unique_integer([:positive])}@example.com",
-        password: "testpassword123"
-      })
-      |> Ash.create(actor: actor)
-
-    {:ok, user} =
-      user
-      |> Ash.Changeset.for_update(:update, %{})
-      |> Ash.Changeset.manage_relationship(:role, role, type: :append_and_remove)
-      |> Ash.update(actor: actor)
-
-    {:ok, user_with_role} = Ash.load(user, :role, domain: Mv.Accounts, actor: actor)
-    user_with_role
-  end
-
-  defp create_custom_field(actor) do
     {:ok, field} =
       CustomField
       |> Ash.Changeset.for_create(:create, %{
         name: "test_field_#{System.unique_integer([:positive])}",
         value_type: :string
       })
-      |> Ash.create(actor: actor, domain: Mv.Membership)
+      |> Ash.create(actor: admin, domain: Mv.Membership)
 
     field
   end
 
   describe "read access (all roles)" do
-    test "user with own_data can read all custom fields", %{actor: actor} do
-      custom_field = create_custom_field(actor)
-      user = create_user_with_permission_set("own_data", actor)
+    test "user with own_data can read all custom fields", %{actor: _actor} do
+      custom_field = create_custom_field()
+      user = Mv.Fixtures.user_with_role_fixture("own_data")
 
       {:ok, fields} = Ash.read(CustomField, actor: user, domain: Mv.Membership)
       ids = Enum.map(fields, & &1.id)
@@ -78,9 +41,9 @@ defmodule Mv.Membership.CustomFieldPoliciesTest do
       assert fetched.id == custom_field.id
     end
 
-    test "user with read_only can read all custom fields", %{actor: actor} do
-      custom_field = create_custom_field(actor)
-      user = create_user_with_permission_set("read_only", actor)
+    test "user with read_only can read all custom fields", %{actor: _actor} do
+      custom_field = create_custom_field()
+      user = Mv.Fixtures.user_with_role_fixture("read_only")
 
       {:ok, fields} = Ash.read(CustomField, actor: user, domain: Mv.Membership)
       ids = Enum.map(fields, & &1.id)
@@ -90,9 +53,9 @@ defmodule Mv.Membership.CustomFieldPoliciesTest do
       assert fetched.id == custom_field.id
     end
 
-    test "user with normal_user can read all custom fields", %{actor: actor} do
-      custom_field = create_custom_field(actor)
-      user = create_user_with_permission_set("normal_user", actor)
+    test "user with normal_user can read all custom fields", %{actor: _actor} do
+      custom_field = create_custom_field()
+      user = Mv.Fixtures.user_with_role_fixture("normal_user")
 
       {:ok, fields} = Ash.read(CustomField, actor: user, domain: Mv.Membership)
       ids = Enum.map(fields, & &1.id)
@@ -102,9 +65,9 @@ defmodule Mv.Membership.CustomFieldPoliciesTest do
       assert fetched.id == custom_field.id
     end
 
-    test "user with admin can read all custom fields", %{actor: actor} do
-      custom_field = create_custom_field(actor)
-      user = create_user_with_permission_set("admin", actor)
+    test "user with admin can read all custom fields", %{actor: _actor} do
+      custom_field = create_custom_field()
+      user = Mv.Fixtures.user_with_role_fixture("admin")
 
       {:ok, fields} = Ash.read(CustomField, actor: user, domain: Mv.Membership)
       ids = Enum.map(fields, & &1.id)
@@ -116,9 +79,9 @@ defmodule Mv.Membership.CustomFieldPoliciesTest do
   end
 
   describe "write access - non-admin cannot create/update/destroy" do
-    setup %{actor: actor} do
-      user = create_user_with_permission_set("normal_user", actor)
-      custom_field = create_custom_field(actor)
+    setup %{actor: _actor} do
+      user = Mv.Fixtures.user_with_role_fixture("normal_user")
+      custom_field = create_custom_field()
       %{user: user, custom_field: custom_field}
     end
 
@@ -152,9 +115,9 @@ defmodule Mv.Membership.CustomFieldPoliciesTest do
   end
 
   describe "write access - admin can create/update/destroy" do
-    setup %{actor: actor} do
-      user = create_user_with_permission_set("admin", actor)
-      custom_field = create_custom_field(actor)
+    setup %{actor: _actor} do
+      user = Mv.Fixtures.user_with_role_fixture("admin")
+      custom_field = create_custom_field()
       %{user: user, custom_field: custom_field}
     end
 

test/mv/membership/custom_field_value_policies_test.exs

@@ -11,7 +11,6 @@ defmodule Mv.Membership.CustomFieldValuePoliciesTest do
 
   alias Mv.Membership.{CustomField, CustomFieldValue}
   alias Mv.Accounts
-  alias Mv.Authorization
 
   require Ash.Query
 
@@ -20,47 +19,9 @@ defmodule Mv.Membership.CustomFieldValuePoliciesTest do
     %{actor: system_actor}
   end
 
-  # Helper to create a role with a specific permission set
-  defp create_role_with_permission_set(permission_set_name, actor) do
-    role_name = "Test Role #{permission_set_name} #{System.unique_integer([:positive])}"
+  defp create_linked_member_for_user(user, _actor) do
+    admin = Mv.Fixtures.user_with_role_fixture("admin")
 
-    case Authorization.create_role(
-           %{
-             name: role_name,
-             description: "Test role for #{permission_set_name}",
-             permission_set_name: permission_set_name
-           },
-           actor: actor
-         ) do
-      {:ok, role} -> role
-      {:error, error} -> raise "Failed to create role: #{inspect(error)}"
-    end
-  end
-
-  # Helper to create a user with a specific permission set
-  # Returns user with role preloaded (required for authorization)
-  defp create_user_with_permission_set(permission_set_name, actor) do
-    role = create_role_with_permission_set(permission_set_name, actor)
-
-    {:ok, user} =
-      Accounts.User
-      |> Ash.Changeset.for_create(:register_with_password, %{
-        email: "user#{System.unique_integer([:positive])}@example.com",
-        password: "testpassword123"
-      })
-      |> Ash.create(actor: actor)
-
-    {:ok, user} =
-      user
-      |> Ash.Changeset.for_update(:update, %{})
-      |> Ash.Changeset.manage_relationship(:role, role, type: :append_and_remove)
-      |> Ash.update(actor: actor)
-
-    {:ok, user_with_role} = Ash.load(user, :role, domain: Mv.Accounts, actor: actor)
-    user_with_role
-  end
-
-  defp create_linked_member_for_user(user, actor) do
     {:ok, member} =
       Mv.Membership.create_member(
         %{
@@ -68,18 +29,20 @@ defmodule Mv.Membership.CustomFieldValuePoliciesTest do
           last_name: "Member",
           email: "linked#{System.unique_integer([:positive])}@example.com"
         },
-        actor: actor
+        actor: admin
       )
 
     user
     |> Ash.Changeset.for_update(:update, %{})
     |> Ash.Changeset.force_change_attribute(:member_id, member.id)
-    |> Ash.update(actor: actor, domain: Mv.Accounts, return_notifications?: false)
+    |> Ash.update(actor: admin, domain: Mv.Accounts, return_notifications?: false)
 
     member
   end
 
-  defp create_unlinked_member(actor) do
+  defp create_unlinked_member(_actor) do
+    admin = Mv.Fixtures.user_with_role_fixture("admin")
+
     {:ok, member} =
       Mv.Membership.create_member(
         %{
@@ -87,25 +50,29 @@ defmodule Mv.Membership.CustomFieldValuePoliciesTest do
           last_name: "Member",
           email: "unlinked#{System.unique_integer([:positive])}@example.com"
         },
-        actor: actor
+        actor: admin
       )
 
     member
   end
 
-  defp create_custom_field(actor) do
+  defp create_custom_field do
+    admin = Mv.Fixtures.user_with_role_fixture("admin")
+
     {:ok, field} =
       CustomField
       |> Ash.Changeset.for_create(:create, %{
         name: "test_field_#{System.unique_integer([:positive])}",
         value_type: :string
       })
-      |> Ash.create(actor: actor)
+      |> Ash.create(actor: admin, domain: Mv.Membership)
 
     field
   end
 
-  defp create_custom_field_value(member_id, custom_field_id, value, actor) do
+  defp create_custom_field_value(member_id, custom_field_id, value) do
+    admin = Mv.Fixtures.user_with_role_fixture("admin")
+
     {:ok, cfv} =
       CustomFieldValue
       |> Ash.Changeset.for_create(:create, %{
@@ -113,22 +80,22 @@ defmodule Mv.Membership.CustomFieldValuePoliciesTest do
         custom_field_id: custom_field_id,
         value: %{"_union_type" => "string", "_union_value" => value}
       })
-      |> Ash.create(actor: actor, domain: Mv.Membership)
+      |> Ash.create(actor: admin, domain: Mv.Membership)
 
     cfv
   end
 
   describe "own_data permission set (Mitglied)" do
     setup %{actor: actor} do
-      user = create_user_with_permission_set("own_data", actor)
+      user = Mv.Fixtures.user_with_role_fixture("own_data")
       linked_member = create_linked_member_for_user(user, actor)
       unlinked_member = create_unlinked_member(actor)
-      custom_field = create_custom_field(actor)
+      custom_field = create_custom_field()
 
-      cfv_linked = create_custom_field_value(linked_member.id, custom_field.id, "linked", actor)
+      cfv_linked = create_custom_field_value(linked_member.id, custom_field.id, "linked")
 
       cfv_unlinked =
-        create_custom_field_value(unlinked_member.id, custom_field.id, "unlinked", actor)
+        create_custom_field_value(unlinked_member.id, custom_field.id, "unlinked")
 
       {:ok, user} =
         Ash.get(Accounts.User, user.id, domain: Mv.Accounts, load: [:role], actor: actor)
@@ -177,10 +144,10 @@ defmodule Mv.Membership.CustomFieldValuePoliciesTest do
     test "can create custom field value for linked member", %{
       user: user,
       linked_member: linked_member,
-      actor: actor
+      actor: _actor
     } do
       # Create a second custom field via admin (own_data cannot create CustomField)
-      custom_field2 = create_custom_field(actor)
+      custom_field2 = create_custom_field()
 
       {:ok, cfv} =
         CustomFieldValue
@@ -257,15 +224,15 @@ defmodule Mv.Membership.CustomFieldValuePoliciesTest do
 
   describe "read_only permission set (Vorstand/Buchhaltung)" do
     setup %{actor: actor} do
-      user = create_user_with_permission_set("read_only", actor)
+      user = Mv.Fixtures.user_with_role_fixture("read_only")
       linked_member = create_linked_member_for_user(user, actor)
       unlinked_member = create_unlinked_member(actor)
-      custom_field = create_custom_field(actor)
+      custom_field = create_custom_field()
 
-      cfv_linked = create_custom_field_value(linked_member.id, custom_field.id, "linked", actor)
+      cfv_linked = create_custom_field_value(linked_member.id, custom_field.id, "linked")
 
       cfv_unlinked =
-        create_custom_field_value(unlinked_member.id, custom_field.id, "unlinked", actor)
+        create_custom_field_value(unlinked_member.id, custom_field.id, "unlinked")
 
       {:ok, user} =
         Ash.get(Accounts.User, user.id, domain: Mv.Accounts, load: [:role], actor: actor)
@@ -340,15 +307,15 @@ defmodule Mv.Membership.CustomFieldValuePoliciesTest do
 
   describe "normal_user permission set (Kassenwart)" do
     setup %{actor: actor} do
-      user = create_user_with_permission_set("normal_user", actor)
+      user = Mv.Fixtures.user_with_role_fixture("normal_user")
       linked_member = create_linked_member_for_user(user, actor)
       unlinked_member = create_unlinked_member(actor)
-      custom_field = create_custom_field(actor)
+      custom_field = create_custom_field()
 
-      cfv_linked = create_custom_field_value(linked_member.id, custom_field.id, "linked", actor)
+      cfv_linked = create_custom_field_value(linked_member.id, custom_field.id, "linked")
 
       cfv_unlinked =
-        create_custom_field_value(unlinked_member.id, custom_field.id, "unlinked", actor)
+        create_custom_field_value(unlinked_member.id, custom_field.id, "unlinked")
 
       {:ok, user} =
         Ash.get(Accounts.User, user.id, domain: Mv.Accounts, load: [:role], actor: actor)
@@ -379,10 +346,10 @@ defmodule Mv.Membership.CustomFieldValuePoliciesTest do
     test "can create custom field value", %{
       user: user,
       unlinked_member: unlinked_member,
-      actor: actor
+      actor: _actor
     } do
       # normal_user cannot create CustomField; use actor (admin) to create it
-      custom_field = create_custom_field(actor)
+      custom_field = create_custom_field()
 
       {:ok, cfv} =
         CustomFieldValue
@@ -421,15 +388,15 @@ defmodule Mv.Membership.CustomFieldValuePoliciesTest do
 
   describe "admin permission set" do
     setup %{actor: actor} do
-      user = create_user_with_permission_set("admin", actor)
+      user = Mv.Fixtures.user_with_role_fixture("admin")
       linked_member = create_linked_member_for_user(user, actor)
       unlinked_member = create_unlinked_member(actor)
-      custom_field = create_custom_field(actor)
+      custom_field = create_custom_field()
 
-      cfv_linked = create_custom_field_value(linked_member.id, custom_field.id, "linked", actor)
+      cfv_linked = create_custom_field_value(linked_member.id, custom_field.id, "linked")
 
       cfv_unlinked =
-        create_custom_field_value(unlinked_member.id, custom_field.id, "unlinked", actor)
+        create_custom_field_value(unlinked_member.id, custom_field.id, "unlinked")
 
       {:ok, user} =
         Ash.get(Accounts.User, user.id, domain: Mv.Accounts, load: [:role], actor: actor)
@@ -457,7 +424,7 @@ defmodule Mv.Membership.CustomFieldValuePoliciesTest do
     end
 
     test "can create custom field value", %{user: user, unlinked_member: unlinked_member} do
-      custom_field = create_custom_field(user)
+      custom_field = create_custom_field()
 
       {:ok, cfv} =
         CustomFieldValue