Add resource policies for Group, MemberGroup, MembershipFeeType, MembershipFeeCycle

- Group/MemberGroup/MembershipFeeType/MembershipFeeCycle: HasPermission policy
- normal_user: Group and MembershipFeeCycle create/update/destroy; pages /groups/new, /groups/:slug/edit
- Add policy tests for all four resources

lib/membership/group.ex

@@ -36,7 +36,8 @@ defmodule Mv.Membership.Group do
   """
   use Ash.Resource,
     domain: Mv.Membership,
-    data_layer: AshPostgres.DataLayer
+    data_layer: AshPostgres.DataLayer,
+    authorizers: [Ash.Policy.Authorizer]
 
   require Ash.Query
   alias Mv.Helpers
@@ -63,6 +64,13 @@ defmodule Mv.Membership.Group do
     end
   end
 
+  policies do
+    policy action_type([:read, :create, :update, :destroy]) do
+      description "Check permissions from role (all can read; normal_user and admin can create/update/destroy)"
+      authorize_if Mv.Authorization.Checks.HasPermission
+    end
+  end
+
   validations do
     validate present(:name)
 
@@ -136,7 +144,7 @@ defmodule Mv.Membership.Group do
     query =
       Mv.Membership.Group
       |> Ash.Query.filter(fragment("LOWER(?) = LOWER(?)", name, ^name))
-      |> maybe_exclude_id(exclude_id)
+      |> Helpers.query_exclude_id(exclude_id)
 
     opts = Helpers.ash_actor_opts(actor)
 
@@ -155,7 +163,4 @@ defmodule Mv.Membership.Group do
         :ok
     end
   end
-
-  defp maybe_exclude_id(query, nil), do: query
-  defp maybe_exclude_id(query, id), do: Ash.Query.filter(query, id != ^id)
 end