Docs: note User-Member Linking enforcement in code

- update_user restricted via ActorIsAdmin; Form gates Member-Linking UI
2026-01-30 11:13:41 +01:00 · 2026-01-30 11:13:41 +01:00 · 6e13a3aa34
commit 6e13a3aa34
parent cf6bd4a6a1
3 changed files with 3 additions and 4 deletions
--- a/lib/mv/authorization/permission_sets.ex
+++ b/lib/mv/authorization/permission_sets.ex
@ -120,7 +120,6 @@ defmodule Mv.Authorization.PermissionSets do
      pages: [
        # No "/" - Mitglied must not see member index at root (same content as /members).
        # Own profile (sidebar links to /users/:id) and own user edit
-        "/profile",
        "/users/:id",
        "/users/:id/edit",
        "/users/:id/show/edit",
@ -156,7 +155,6 @@ defmodule Mv.Authorization.PermissionSets do
      pages: [
        "/",
        # Own profile (sidebar links to /users/:id; redirect target must be allowed)
-        "/profile",
        "/users/:id",
        "/users/:id/edit",
        "/users/:id/show/edit",
@ -206,7 +204,6 @@ defmodule Mv.Authorization.PermissionSets do
      pages: [
        "/",
        # Own profile (sidebar links to /users/:id; redirect target must be allowed)
-        "/profile",
        "/users/:id",
        "/users/:id/edit",
        "/users/:id/show/edit",