From ad0a3cd4581c3684e352b96534e828904710131d Mon Sep 17 00:00:00 2001
From: Moritz <moritz.m@local-it.org>
Date: Thu, 8 Jan 2026 15:54:46 +0100
Subject: [PATCH] fix: add ensure_user_role_loaded to router live_session
 globally

---
 lib/mv_web/live_helpers.ex | 10 ++++++++--
 lib/mv_web/router.ex       |  5 ++++-
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/lib/mv_web/live_helpers.ex b/lib/mv_web/live_helpers.ex
index 1835cba..f217ee2 100644
--- a/lib/mv_web/live_helpers.ex
+++ b/lib/mv_web/live_helpers.ex
@@ -49,8 +49,14 @@ defmodule MvWeb.LiveHelpers do
     opts = [domain: Mv.Accounts, actor: user]
 
     case Ash.load(user, :role, opts) do
-      {:ok, loaded_user} -> loaded_user
-      {:error, _} -> user
+      {:ok, loaded_user} ->
+        loaded_user
+
+      {:error, error} ->
+        # Log warning if role loading fails - this can cause authorization issues
+        require Logger
+        Logger.warning("Failed to load role for user #{user.id}: #{inspect(error)}")
+        user
     end
   end
 end
diff --git a/lib/mv_web/router.ex b/lib/mv_web/router.ex
index e73c926..682b672 100644
--- a/lib/mv_web/router.ex
+++ b/lib/mv_web/router.ex
@@ -46,7 +46,10 @@ defmodule MvWeb.Router do
     AshAuthentication-specific: We define that all routes can only be accessed when the user is signed in.
     """
     ash_authentication_live_session :authentication_required,
-      on_mount: {MvWeb.LiveUserAuth, :live_user_required} do
+      on_mount: [
+        {MvWeb.LiveUserAuth, :live_user_required},
+        {MvWeb.LiveHelpers, :ensure_user_role_loaded}
+      ] do
       live "/", MemberLive.Index, :index
 
       live "/members", MemberLive.Index, :index