Merge branch 'main' into feature/filter-boolean-custom-fields

lib/mv_web/live/member_live/form.ex

@@ -21,8 +21,6 @@ defmodule MvWeb.MemberLive.Form do
   """
   use MvWeb, :live_view
 
-  on_mount {MvWeb.LiveHelpers, :ensure_user_role_loaded}
-
   import MvWeb.LiveHelpers, only: [current_actor: 1, submit_form: 3]
 
   alias Mv.MembershipFees

lib/mv_web/live/member_live/index.ex

@@ -27,8 +27,6 @@ defmodule MvWeb.MemberLive.Index do
   """
   use MvWeb, :live_view
 
-  on_mount {MvWeb.LiveHelpers, :ensure_user_role_loaded}
-
   require Ash.Query
   require Logger
   import Ash.Expr

lib/mv_web/live/member_live/show.ex

@@ -22,8 +22,6 @@ defmodule MvWeb.MemberLive.Show do
   import Ash.Query
   import MvWeb.LiveHelpers, only: [current_actor: 1]
 
-  on_mount {MvWeb.LiveHelpers, :ensure_user_role_loaded}
-
   alias MvWeb.Helpers.MembershipFeeHelpers
 
   @impl true

lib/mv_web/live/member_live/show/membership_fees_component.ex

@@ -554,46 +554,55 @@ defmodule MvWeb.MemberLive.Show.MembershipFeesComponent do
   end
 
   def handle_event("regenerate_cycles", _params, socket) do
-    socket = assign(socket, :regenerating, true)
-    member = socket.assigns.member
     actor = current_actor(socket)
 
-    case CycleGenerator.generate_cycles_for_member(member.id, actor: actor) do
-      {:ok, _new_cycles, _notifications} ->
-        # Reload member with cycles
-        actor = current_actor(socket)
+    # SECURITY: Only admins can manually regenerate cycles via UI
+    # Cycle generation itself uses system actor, but UI access should be restricted
+    if actor.role && actor.role.permission_set_name == "admin" do
+      socket = assign(socket, :regenerating, true)
+      member = socket.assigns.member
 
-        updated_member =
-          member
-          |> Ash.load!(
-            [
-              :membership_fee_type,
-              membership_fee_cycles: [:membership_fee_type]
-            ],
-            actor: actor
-          )
+      case CycleGenerator.generate_cycles_for_member(member.id) do
+        {:ok, _new_cycles, _notifications} ->
+          # Reload member with cycles
+          actor = current_actor(socket)
 
-        cycles =
-          Enum.sort_by(
-            updated_member.membership_fee_cycles || [],
-            & &1.cycle_start,
-            {:desc, Date}
-          )
+          updated_member =
+            member
+            |> Ash.load!(
+              [
+                :membership_fee_type,
+                membership_fee_cycles: [:membership_fee_type]
+              ],
+              actor: actor
+            )
 
-        send(self(), {:member_updated, updated_member})
+          cycles =
+            Enum.sort_by(
+              updated_member.membership_fee_cycles || [],
+              & &1.cycle_start,
+              {:desc, Date}
+            )
 
-        {:noreply,
-         socket
-         |> assign(:member, updated_member)
-         |> assign(:cycles, cycles)
-         |> assign(:regenerating, false)
-         |> put_flash(:info, gettext("Cycles regenerated successfully"))}
+          send(self(), {:member_updated, updated_member})
 
-      {:error, error} ->
-        {:noreply,
-         socket
-         |> assign(:regenerating, false)
-         |> put_flash(:error, format_error(error))}
+          {:noreply,
+           socket
+           |> assign(:member, updated_member)
+           |> assign(:cycles, cycles)
+           |> assign(:regenerating, false)
+           |> put_flash(:info, gettext("Cycles regenerated successfully"))}
+
+        {:error, error} ->
+          {:noreply,
+           socket
+           |> assign(:regenerating, false)
+           |> put_flash(:error, format_error(error))}
+      end
+    else
+      {:noreply,
+       socket
+       |> put_flash(:error, gettext("Only administrators can regenerate cycles"))}
     end
   end