From e3cd4008990aa8aa53df74ea5ba1d141908c97a6 Mon Sep 17 00:00:00 2001
From: Moritz <moritz.m@local-it.org>
Date: Thu, 8 Jan 2026 14:09:30 +0100
Subject: [PATCH] fix: add actor parameter to Ash.load in LiveHelpers

Use self as actor when loading user role relationship to ensure
proper authorization and policy enforcement.
---
 lib/mv_web/live_helpers.ex | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/mv_web/live_helpers.ex b/lib/mv_web/live_helpers.ex
index 7e31e21..1835cba 100644
--- a/lib/mv_web/live_helpers.ex
+++ b/lib/mv_web/live_helpers.ex
@@ -45,7 +45,10 @@ defmodule MvWeb.LiveHelpers do
   end
 
   defp load_role_safely(user) do
-    case Ash.load(user, :role, domain: Mv.Accounts) do
+    # Use self as actor for loading own role relationship
+    opts = [domain: Mv.Accounts, actor: user]
+
+    case Ash.load(user, :role, opts) do
       {:ok, loaded_user} -> loaded_user
       {:error, _} -> user
     end