fix: add actor parameter to Ash.load in LiveHelpers
Use self as actor when loading user role relationship to ensure proper authorization and policy enforcement.
This commit is contained in:
parent
3e8f29bf31
commit
715801eb9d
1 changed files with 4 additions and 1 deletions
|
|
@ -45,7 +45,10 @@ defmodule MvWeb.LiveHelpers do
|
||||||
end
|
end
|
||||||
|
|
||||||
defp load_role_safely(user) do
|
defp load_role_safely(user) do
|
||||||
case Ash.load(user, :role, domain: Mv.Accounts) do
|
# Use self as actor for loading own role relationship
|
||||||
|
opts = [domain: Mv.Accounts, actor: user]
|
||||||
|
|
||||||
|
case Ash.load(user, :role, opts) do
|
||||||
{:ok, loaded_user} -> loaded_user
|
{:ok, loaded_user} -> loaded_user
|
||||||
{:error, _} -> user
|
{:error, _} -> user
|
||||||
end
|
end
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue