fix: add actor parameter to Ash.load in LiveHelpers
Use self as actor when loading user role relationship to ensure proper authorization and policy enforcement.
This commit is contained in:
parent
d9dd936ae3
commit
e3cd400899
1 changed files with 4 additions and 1 deletions
|
|
@ -45,7 +45,10 @@ defmodule MvWeb.LiveHelpers do
|
|||
end
|
||||
|
||||
defp load_role_safely(user) do
|
||||
case Ash.load(user, :role, domain: Mv.Accounts) do
|
||||
# Use self as actor for loading own role relationship
|
||||
opts = [domain: Mv.Accounts, actor: user]
|
||||
|
||||
case Ash.load(user, :role, opts) do
|
||||
{:ok, loaded_user} -> loaded_user
|
||||
{:error, _} -> user
|
||||
end
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue