fix: add actor parameter to Ash.load in LiveHelpers

Use self as actor when loading user role relationship to ensure
proper authorization and policy enforcement.
This commit is contained in:
Moritz 2026-01-08 14:09:30 +01:00
parent 3e8f29bf31
commit 715801eb9d

View file

@ -45,7 +45,10 @@ defmodule MvWeb.LiveHelpers do
end end
defp load_role_safely(user) do defp load_role_safely(user) do
case Ash.load(user, :role, domain: Mv.Accounts) do # Use self as actor for loading own role relationship
opts = [domain: Mv.Accounts, actor: user]
case Ash.load(user, :role, opts) do
{:ok, loaded_user} -> loaded_user {:ok, loaded_user} -> loaded_user
{:error, _} -> user {:error, _} -> user
end end