refactor: adress review

lib/membership/setting.ex

@@ -56,6 +56,9 @@ defmodule Mv.Membership.Setting do
       # Update membership fee settings
       {:ok, updated} = Mv.Membership.update_settings(settings, %{include_joining_cycle: false})
   """
+  # primary_read_warning?: false — We use a custom read prepare that selects only public
+  # attributes and explicitly excludes smtp_password. Ash warns when the primary read does
+  # not load all attributes; we intentionally omit the password for security.
   use Ash.Resource,
     domain: Mv.Membership,
     data_layer: AshPostgres.DataLayer,
@@ -65,6 +68,8 @@ defmodule Mv.Membership.Setting do
   @uuid_pattern ~r/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
   @valid_join_form_member_fields Mv.Constants.member_fields() |> Enum.map(&Atom.to_string/1)
 
+  alias Ash.Resource.Info, as: ResourceInfo
+
   postgres do
     table "settings"
     repo Mv.Repo
@@ -74,48 +79,25 @@ defmodule Mv.Membership.Setting do
     description "Global application settings (singleton resource)"
   end
 
-  # All public attributes except smtp_password, used to exclude it from default reads.
-  # This list is used in the read prepare to prevent the sensitive password from being
-  # returned in standard reads (it can still be read via explicit select in Config).
-  @public_attributes [
-    :id,
-    :club_name,
-    :member_field_visibility,
-    :member_field_required,
-    :include_joining_cycle,
-    :default_membership_fee_type_id,
-    :vereinfacht_api_url,
-    :vereinfacht_api_key,
-    :vereinfacht_club_id,
-    :vereinfacht_app_url,
-    :oidc_client_id,
-    :oidc_base_url,
-    :oidc_redirect_uri,
-    :oidc_client_secret,
-    :oidc_admin_group_name,
-    :oidc_groups_claim,
-    :oidc_only,
-    :smtp_host,
-    :smtp_port,
-    :smtp_username,
-    :smtp_ssl,
-    :smtp_from_name,
-    :smtp_from_email,
-    :join_form_enabled,
-    :join_form_field_ids,
-    :join_form_field_required,
-    :inserted_at,
-    :updated_at
-  ]
+  # Attributes excluded from the default read (sensitive data). Same pattern as smtp_password:
+  # read only via explicit select when needed; never loaded into default get_settings().
+  @excluded_from_read [:smtp_password, :oidc_client_secret]
 
   actions do
     read :read do
       primary? true
 
-      # smtp_password is excluded from the default select to prevent it from being returned
-      # in plaintext via standard reads. Config reads it via an explicit select internally.
+      # Exclude sensitive attributes (e.g. smtp_password) from default reads. Config reads
+      # them via explicit select when needed. Uses all attribute names minus excluded so
+      # the list stays correct when new attributes are added to the resource.
       prepare fn query, _context ->
-        Ash.Query.select(query, @public_attributes)
+        select_attrs =
+          __MODULE__
+          |> ResourceInfo.attribute_names()
+          |> MapSet.to_list()
+          |> Kernel.--(@excluded_from_read)
+
+        Ash.Query.select(query, select_attrs)
       end
     end