feat: prevent deletion of roles with assigned users

lib/mv_web/live/role_live/show.ex

@@ -12,6 +12,10 @@ defmodule MvWeb.RoleLive.Show do
   """
   use MvWeb, :live_view
 
+  alias Mv.Accounts
+
+  require Ash.Query
+
   @impl true
   def mount(%{"id" => id}, _session, socket) do
     # Ensure current_user has role loaded for authorization checks
@@ -32,33 +36,55 @@ defmodule MvWeb.RoleLive.Show do
       end
 
     role = Ash.get!(Mv.Authorization.Role, id, domain: Mv.Authorization)
+    user_count = load_user_count(role)
 
     {:ok,
      socket
      |> assign(:page_title, gettext("Show Role"))
-     |> assign(:role, role)}
+     |> assign(:role, role)
+     |> assign(:user_count, user_count)}
   end
 
   @impl true
   def handle_event("delete", %{"id" => id}, socket) do
     {:ok, role} = Mv.Authorization.get_role(id)
+    user_count = socket.assigns.user_count
 
-    case Mv.Authorization.destroy_role(role) do
-      :ok ->
-        {:noreply,
-         socket
-         |> put_flash(:info, gettext("Role deleted successfully."))
-         |> push_navigate(to: ~p"/admin/roles")}
+    if user_count > 0 do
+      {:noreply,
+       put_flash(
+         socket,
+         :error,
+         gettext(
+           "Cannot delete role. %{count} user(s) are still assigned to this role. Please assign them to another role first.",
+           count: user_count
+         )
+       )}
+    else
+      case Mv.Authorization.destroy_role(role) do
+        :ok ->
+          {:noreply,
+           socket
+           |> put_flash(:info, gettext("Role deleted successfully."))
+           |> push_navigate(to: ~p"/admin/roles")}
 
-      {:error, error} ->
-        error_message = format_error(error)
+        {:error, error} ->
+          error_message = format_error(error)
 
-        {:noreply,
-         put_flash(
-           socket,
-           :error,
-           gettext("Failed to delete role: %{error}", error: error_message)
-         )}
+          {:noreply,
+           put_flash(
+             socket,
+             :error,
+             gettext("Failed to delete role: %{error}", error: error_message)
+           )}
+      end
+    end
+  end
+
+  defp load_user_count(role) do
+    case Ash.count(Accounts.User |> Ash.Query.filter(role_id == ^role.id)) do
+      {:ok, count} -> count
+      _ -> 0
     end
   end