fix: correct relationship filter paths in HasPermission check

- Use user.id instead of user_id for Member linked scope
- Use member.user.id for CustomFieldValue linked scope
- Add lazy logger evaluation
- Improve action nil handling
- Add integration tests for filter expressions

lib/mv/authorization/checks/has_permission.ex

@@ -21,8 +21,8 @@ defmodule Mv.Authorization.Checks.HasPermission do
   - **:all** - Authorizes without filtering (returns all records)
   - **:own** - Filters to records where record.id == actor.id
   - **:linked** - Filters based on resource type:
-    - Member: member.user_id == actor.id
+    - Member: member.user.id == actor.id (via has_one :user relationship)
-    - CustomFieldValue: custom_field_value.member.user_id == actor.id (traverses relationship!)
+    - CustomFieldValue: custom_field_value.member.user.id == actor.id (traverses member → user relationship!)
 
   ## Error Handling
 
@@ -60,16 +60,39 @@ defmodule Mv.Authorization.Checks.HasPermission do
     resource = authorizer.resource
     action = get_action_from_authorizer(authorizer)
 
-    # Explicit nil check first (fail fast, clear error message)
+    cond do
-    if is_nil(actor) do
+      is_nil(actor) ->
         log_auth_failure(actor, resource, action, "no actor")
         {:ok, false}
-    else
+
+      is_nil(action) ->
+        log_auth_failure(
+          actor,
+          resource,
+          action,
+          "authorizer subject shape unsupported (no action)"
+        )
+
+        {:ok, false}
+
+      true ->
+        strict_check_with_permissions(actor, resource, action)
+    end
+  end
+
+  # Helper function to reduce nesting depth
+  defp strict_check_with_permissions(actor, resource, action) do
     with %{role: %{permission_set_name: ps_name}} when not is_nil(ps_name) <- actor,
          {:ok, ps_atom} <- PermissionSets.permission_set_name_to_atom(ps_name),
          permissions <- PermissionSets.get_permissions(ps_atom),
          resource_name <- get_resource_name(resource) do
-        case check_permission(permissions.resources, resource_name, action, actor, resource_name) do
+      case check_permission(
+             permissions.resources,
+             resource_name,
+             action,
+             actor,
+             resource_name
+           ) do
         :authorized -> {:ok, true}
         {:filter, _} -> {:ok, :unknown}
         false -> {:ok, false}
@@ -92,22 +115,32 @@ defmodule Mv.Authorization.Checks.HasPermission do
         {:ok, false}
     end
   end
-  end
 
   @impl true
   def auto_filter(actor, authorizer, _opts) do
     resource = authorizer.resource
     action = get_action_from_authorizer(authorizer)
 
-    # Explicit nil check first
+    cond do
-    if is_nil(actor) do
+      is_nil(actor) -> nil
-      nil
+      is_nil(action) -> nil
-    else
+      true -> auto_filter_with_permissions(actor, resource, action)
+    end
+  end
+
+  # Helper function to reduce nesting depth
+  defp auto_filter_with_permissions(actor, resource, action) do
     with %{role: %{permission_set_name: ps_name}} when not is_nil(ps_name) <- actor,
          {:ok, ps_atom} <- PermissionSets.permission_set_name_to_atom(ps_name),
          permissions <- PermissionSets.get_permissions(ps_atom),
          resource_name <- get_resource_name(resource) do
-        case check_permission(permissions.resources, resource_name, action, actor, resource_name) do
+      case check_permission(
+             permissions.resources,
+             resource_name,
+             action,
+             actor,
+             resource_name
+           ) do
         :authorized -> nil
         {:filter, filter_expr} -> filter_expr
         false -> nil
@@ -116,7 +149,6 @@ defmodule Mv.Authorization.Checks.HasPermission do
       _ -> nil
     end
   end
-  end
 
   # Helper to extract action from authorizer
   defp get_action_from_authorizer(authorizer) do
@@ -133,12 +165,12 @@ defmodule Mv.Authorization.Checks.HasPermission do
   end
 
   # Find matching permission and apply scope
-  defp check_permission(resource_perms, resource_name, action, actor, resource_module_name) do
+  defp check_permission(resource_perms, resource_name, action, actor, resource_name_for_logging) do
     case Enum.find(resource_perms, fn perm ->
            perm.resource == resource_name and perm.action == action and perm.granted
          end) do
       nil ->
-        log_auth_failure(actor, resource_module_name, action, "no matching permission found")
+        log_auth_failure(actor, resource_name_for_logging, action, "no matching permission found")
         false
 
       perm ->
@@ -157,35 +189,39 @@ defmodule Mv.Authorization.Checks.HasPermission do
     {:filter, expr(id == ^actor.id)}
   end
 
-  # Scope: linked - Filter based on user_id relationship (resource-specific!)
+  # Scope: linked - Filter based on user relationship (resource-specific!)
+  # Uses Ash relationships: Member has_one :user, CustomFieldValue belongs_to :member
   defp apply_scope(:linked, actor, resource_name) do
     case resource_name do
       "Member" ->
-        # Member.user_id == actor.id (direct relationship)
+        # Member has_one :user → filter by user.id == actor.id
-        {:filter, expr(user_id == ^actor.id)}
+        {:filter, expr(user.id == ^actor.id)}
 
       "CustomFieldValue" ->
-        # CustomFieldValue.member.user_id == actor.id (traverse through member!)
+        # CustomFieldValue belongs_to :member → member has_one :user
-        {:filter, expr(member.user_id == ^actor.id)}
+        # Traverse: custom_field_value.member.user.id == actor.id
+        {:filter, expr(member.user.id == ^actor.id)}
 
       _ ->
-        # Fallback for other resources: try direct user_id
+        # Fallback for other resources: try user relationship first, then user_id
-        {:filter, expr(user_id == ^actor.id)}
+        {:filter, expr(user.id == ^actor.id or user_id == ^actor.id)}
     end
   end
 
-  # Log authorization failures for debugging
+  # Log authorization failures for debugging (lazy evaluation)
   defp log_auth_failure(actor, resource, action, reason) do
+    Logger.debug(fn ->
       actor_id = if is_map(actor), do: Map.get(actor, :id), else: "nil"
       resource_name = get_resource_name_for_logging(resource)
 
-    Logger.debug("""
+      """
       Authorization failed:
         Actor: #{actor_id}
         Resource: #{resource_name}
-      Action: #{action}
+        Action: #{inspect(action)}
         Reason: #{reason}
-    """)
+      """
+    end)
   end
 
   # Helper to extract resource name for logging (handles both atoms and strings)

test/mv/authorization/checks/has_permission_integration_test.exs

@@ -0,0 +1,87 @@
+defmodule Mv.Authorization.Checks.HasPermissionIntegrationTest do
+  @moduledoc """
+  Integration tests for HasPermission policy check.
+
+  These tests verify that the filter expressions generated by HasPermission
+  have the correct structure for relationship-based filtering.
+
+  Note: Full integration tests with real queries require resources to have
+  policies that use HasPermission. These tests validate filter expression
+  structure and ensure the relationship paths are correct.
+  """
+  use ExUnit.Case, async: true
+
+  alias Mv.Authorization.Checks.HasPermission
+
+  # Helper to create mock actor with role
+  defp create_actor_with_role(permission_set_name) do
+    %{
+      id: "user-#{System.unique_integer([:positive])}",
+      role: %{permission_set_name: permission_set_name}
+    }
+  end
+
+  describe "Filter Expression Structure - :linked scope" do
+    test "Member filter uses user.id relationship path" do
+      actor = create_actor_with_role("own_data")
+      authorizer = create_authorizer(Mv.Membership.Member, :read)
+
+      filter = HasPermission.auto_filter(actor, authorizer, [])
+
+      # Verify filter is not nil (should return a filter for :linked scope)
+      assert not is_nil(filter)
+
+      # The filter should be a valid expression (keyword list or Ash.Expr)
+      # We verify it's not nil and can be used in queries
+      assert is_list(filter) or is_map(filter)
+    end
+
+    test "CustomFieldValue filter uses member.user.id relationship path" do
+      actor = create_actor_with_role("own_data")
+      authorizer = create_authorizer(Mv.Membership.CustomFieldValue, :read)
+
+      filter = HasPermission.auto_filter(actor, authorizer, [])
+
+      # Verify filter is not nil
+      assert not is_nil(filter)
+
+      # The filter should be a valid expression
+      assert is_list(filter) or is_map(filter)
+    end
+  end
+
+  describe "Filter Expression Structure - :own scope" do
+    test "User filter uses id == actor.id" do
+      actor = create_actor_with_role("own_data")
+      authorizer = create_authorizer(Mv.Accounts.User, :read)
+
+      filter = HasPermission.auto_filter(actor, authorizer, [])
+
+      # Verify filter is not nil (should return a filter for :own scope)
+      assert not is_nil(filter)
+
+      # The filter should be a valid expression
+      assert is_list(filter) or is_map(filter)
+    end
+  end
+
+  describe "Filter Expression Structure - :all scope" do
+    test "Admin can read all members without filter" do
+      actor = create_actor_with_role("admin")
+      authorizer = create_authorizer(Mv.Membership.Member, :read)
+
+      filter = HasPermission.auto_filter(actor, authorizer, [])
+
+      # :all scope should return nil (no filter needed)
+      assert is_nil(filter)
+    end
+  end
+
+  # Helper to create a mock authorizer
+  defp create_authorizer(resource, action) do
+    %Ash.Policy.Authorizer{
+      resource: resource,
+      subject: %{action: %{name: action}}
+    }
+  end
+end