refactor: remove AssignDefaultRole change module
The attribute-level default solution makes this change module obsolete. All role assignment is now handled via the role_id attribute's default function, which is more robust and works for all creation paths.
This commit is contained in:
parent
a9b1d794d2
commit
e7bf777be2
GPG key ID:
1020A035E5DD0824
2 changed files with 0 additions and 272 deletions
|
|
@ -1,103 +0,0 @@
|
||||||
defmodule Mv.Accounts.User.Changes.AssignDefaultRole do
|
|
||||||
@moduledoc """
|
|
||||||
Assigns the default "Mitglied" role to new users if no role is explicitly provided.
|
|
||||||
|
|
||||||
This change runs during user creation actions (`:create_user`, `:register_with_password`,
|
|
||||||
`:register_with_rauthy`) and ensures that all users have a role assigned.
|
|
||||||
|
|
||||||
## Behavior
|
|
||||||
|
|
||||||
- Skips assignment if `role_id` is already set in the changeset, data, or arguments
|
|
||||||
- Loads the "Mitglied" role without authorization (safe for system operations)
|
|
||||||
- Returns unchanged changeset if "Mitglied" role doesn't exist (test environments)
|
|
||||||
- Adds error to changeset on unexpected failures
|
|
||||||
|
|
||||||
## Important Notes
|
|
||||||
|
|
||||||
- Works with upserts: When combined with `upsert_fields`, only new users get the role
|
|
||||||
- Uses `authorize?: false` to avoid circular dependencies during user creation
|
|
||||||
- The "Mitglied" role must exist (created by seeds or migration)
|
|
||||||
|
|
||||||
## Examples
|
|
||||||
|
|
||||||
# Automatically assigns "Mitglied" role during user creation:
|
|
||||||
{:ok, user} =
|
|
||||||
User
|
|
||||||
|> Ash.Changeset.for_create(:create_user, %{email: "new@example.com"})
|
|
||||||
|> Ash.create()
|
|
||||||
|
|
||||||
# User now has "Mitglied" role assigned
|
|
||||||
{:ok, user_with_role} = Ash.load(user, :role)
|
|
||||||
assert user_with_role.role.name == "Mitglied"
|
|
||||||
|
|
||||||
# Skips assignment if role is already set:
|
|
||||||
{:ok, user} =
|
|
||||||
User
|
|
||||||
|> Ash.Changeset.for_create(:create_user, %{email: "admin@example.com", role_id: admin_role.id})
|
|
||||||
|> Ash.create()
|
|
||||||
|
|
||||||
# User has the explicitly set role, not "Mitglied"
|
|
||||||
{:ok, user_with_role} = Ash.load(user, :role)
|
|
||||||
assert user_with_role.role.name == "Admin"
|
|
||||||
"""
|
|
||||||
use Ash.Resource.Change
|
|
||||||
|
|
||||||
@impl true
|
|
||||||
@spec change(Ash.Changeset.t(), keyword(), map()) :: Ash.Changeset.t()
|
|
||||||
def change(changeset, _opts, _context) do
|
|
||||||
# Check role_id in changeset attributes (for new assignments)
|
|
||||||
role_id_in_changeset = Ash.Changeset.get_attribute(changeset, :role_id)
|
|
||||||
|
|
||||||
# Check role_id in existing data (for upserts)
|
|
||||||
role_id_in_data = Map.get(changeset.data, :role_id)
|
|
||||||
|
|
||||||
# Check if role is being set via argument
|
|
||||||
role_arg = Ash.Changeset.get_argument(changeset, :role)
|
|
||||||
|
|
||||||
# Check if role relationship is already being managed
|
|
||||||
# Relationships are stored as a list of tuples: [{record_or_changes, opts}]
|
|
||||||
role_relationship = Map.get(changeset.relationships || %{}, :role)
|
|
||||||
|
|
||||||
# Skip if role is already set anywhere (changeset, data, argument, or relationship)
|
|
||||||
has_role =
|
|
||||||
not is_nil(role_id_in_changeset) or
|
|
||||||
not is_nil(role_id_in_data) or
|
|
||||||
not is_nil(role_arg) or
|
|
||||||
(not is_nil(role_relationship) and role_relationship != [])
|
|
||||||
|
|
||||||
if has_role do
|
|
||||||
changeset
|
|
||||||
else
|
|
||||||
assign_default_role(changeset)
|
|
||||||
end
|
|
||||||
end
|
|
||||||
|
|
||||||
@spec assign_default_role(Ash.Changeset.t()) :: Ash.Changeset.t()
|
|
||||||
defp assign_default_role(changeset) do
|
|
||||||
# Load the "Mitglied" role without authorization
|
|
||||||
# This is safe because:
|
|
||||||
# 1. We're only reading a public system role (no sensitive data)
|
|
||||||
# 2. This runs during user creation (bootstrap phase)
|
|
||||||
# 3. Using SystemActor here would create circular dependency (SystemActor needs a user)
|
|
||||||
case Mv.Authorization.Role.get_mitglied_role() do
|
|
||||||
{:ok, %Mv.Authorization.Role{} = mitglied_role} ->
|
|
||||||
# Assign the role using manage_relationship
|
|
||||||
# Note: :append_and_remove is the correct type for Ash 2.0+ (replaces :replace)
|
|
||||||
Ash.Changeset.manage_relationship(changeset, :role, mitglied_role,
|
|
||||||
type: :append_and_remove
|
|
||||||
)
|
|
||||||
|
|
||||||
{:ok, nil} ->
|
|
||||||
# Role doesn't exist - skip assignment (common in test environments)
|
|
||||||
# In production, the migration will have created the role
|
|
||||||
changeset
|
|
||||||
|
|
||||||
{:error, error} ->
|
|
||||||
# Unexpected error during role lookup
|
|
||||||
Ash.Changeset.add_error(changeset,
|
|
||||||
field: :role_id,
|
|
||||||
message: "Failed to load default role: #{inspect(error)}"
|
|
||||||
)
|
|
||||||
end
|
|
||||||
end
|
|
||||||
end
|
|
||||||
|
|
@ -1,169 +0,0 @@
|
||||||
defmodule Mv.Accounts.User.Changes.AssignDefaultRoleTest do
|
|
||||||
@moduledoc """
|
|
||||||
Tests for AssignDefaultRole change module.
|
|
||||||
|
|
||||||
Tests cover:
|
|
||||||
- Automatic role assignment when no role is set
|
|
||||||
- Skipping assignment when role is already set (changeset, data, or argument)
|
|
||||||
- Handling missing "Mitglied" role gracefully
|
|
||||||
- Error handling for unexpected failures
|
|
||||||
"""
|
|
||||||
use Mv.DataCase, async: true
|
|
||||||
|
|
||||||
alias Mv.Accounts.User
|
|
||||||
alias Mv.Authorization.Role
|
|
||||||
|
|
||||||
setup do
|
|
||||||
# Ensure "Mitglied" role exists
|
|
||||||
Mv.DataCase.ensure_default_role()
|
|
||||||
|
|
||||||
# Get "Mitglied" role for assertions
|
|
||||||
{:ok, mitglied_role} = Role.get_mitglied_role()
|
|
||||||
|
|
||||||
%{mitglied_role: mitglied_role}
|
|
||||||
end
|
|
||||||
|
|
||||||
describe "change/3" do
|
|
||||||
test "assigns Mitglied role when no role is set", %{mitglied_role: mitglied_role} do
|
|
||||||
email = "test#{System.unique_integer([:positive])}@example.com"
|
|
||||||
|
|
||||||
# Create user - AssignDefaultRole change runs automatically via :create_user action
|
|
||||||
{:ok, user} =
|
|
||||||
User
|
|
||||||
|> Ash.Changeset.for_create(:create_user, %{email: email})
|
|
||||||
|> Ash.create(authorize?: false, domain: Mv.Accounts)
|
|
||||||
|
|
||||||
# Load user with role
|
|
||||||
{:ok, user_with_role} = Ash.load(user, :role, domain: Mv.Accounts, authorize?: false)
|
|
||||||
|
|
||||||
# Verify role was assigned
|
|
||||||
assert user_with_role.role != nil
|
|
||||||
assert user_with_role.role.id == mitglied_role.id
|
|
||||||
assert user_with_role.role.name == "Mitglied"
|
|
||||||
end
|
|
||||||
|
|
||||||
test "skips assignment when role relationship is already set in changeset", %{
|
|
||||||
mitglied_role: _mitglied_role
|
|
||||||
} do
|
|
||||||
# Create a different role
|
|
||||||
other_role =
|
|
||||||
Role
|
|
||||||
|> Ash.Changeset.for_create(:create_role, %{
|
|
||||||
name: "Test Role #{System.unique_integer([:positive])}",
|
|
||||||
description: "Test role",
|
|
||||||
permission_set_name: "own_data"
|
|
||||||
})
|
|
||||||
|> Ash.create!(authorize?: false, domain: Mv.Authorization)
|
|
||||||
|
|
||||||
# Test that AssignDefaultRole skips when role relationship is already set
|
|
||||||
# Create a changeset with role relationship already set BEFORE the change runs
|
|
||||||
changeset =
|
|
||||||
User
|
|
||||||
|> Ash.Changeset.for_create(:create_user, %{
|
|
||||||
email: "test#{System.unique_integer([:positive])}@example.com"
|
|
||||||
})
|
|
||||||
|> Ash.Changeset.manage_relationship(:role, other_role, type: :append_and_remove)
|
|
||||||
|
|
||||||
# Manually call the change to test it
|
|
||||||
result_changeset = Mv.Accounts.User.Changes.AssignDefaultRole.change(changeset, [], %{})
|
|
||||||
|
|
||||||
# The change should detect that role relationship is already set and skip assignment
|
|
||||||
# Verify by creating the user and checking the role
|
|
||||||
{:ok, user} = Ash.create(result_changeset, authorize?: false, domain: Mv.Accounts)
|
|
||||||
|
|
||||||
# Load user with role
|
|
||||||
{:ok, user_with_role} = Ash.load(user, :role, domain: Mv.Accounts, authorize?: false)
|
|
||||||
|
|
||||||
# Verify the explicitly set role was used, not "Mitglied"
|
|
||||||
assert user_with_role.role != nil
|
|
||||||
assert user_with_role.role.id == other_role.id
|
|
||||||
assert user_with_role.role.name != "Mitglied"
|
|
||||||
end
|
|
||||||
|
|
||||||
test "skips assignment when role_id is already set in data (upsert scenario)" do
|
|
||||||
# Create user with role
|
|
||||||
role =
|
|
||||||
Role
|
|
||||||
|> Ash.Changeset.for_create(:create_role, %{
|
|
||||||
name: "Test Role #{System.unique_integer([:positive])}",
|
|
||||||
description: "Test role",
|
|
||||||
permission_set_name: "own_data"
|
|
||||||
})
|
|
||||||
|> Ash.create!(authorize?: false, domain: Mv.Authorization)
|
|
||||||
|
|
||||||
{:ok, existing_user} =
|
|
||||||
User
|
|
||||||
|> Ash.Changeset.for_create(:create_user, %{
|
|
||||||
email: "existing#{System.unique_integer([:positive])}@example.com"
|
|
||||||
})
|
|
||||||
|> Ash.create(authorize?: false, domain: Mv.Accounts)
|
|
||||||
|
|
||||||
# Update user to have role
|
|
||||||
{:ok, user_with_role} =
|
|
||||||
existing_user
|
|
||||||
|> Ash.Changeset.for_update(:update, %{})
|
|
||||||
|> Ash.Changeset.manage_relationship(:role, role, type: :append_and_remove)
|
|
||||||
|> Ash.update(authorize?: false, domain: Mv.Accounts)
|
|
||||||
|
|
||||||
# Reload to get role_id in data
|
|
||||||
{:ok, user_with_role} =
|
|
||||||
Ash.load(user_with_role, :role, domain: Mv.Accounts, authorize?: false)
|
|
||||||
|
|
||||||
# Verify user has the explicitly set role
|
|
||||||
assert user_with_role.role != nil
|
|
||||||
assert user_with_role.role.id == role.id
|
|
||||||
|
|
||||||
# Now update user again - AssignDefaultRole should skip (role already set)
|
|
||||||
{:ok, updated_user} =
|
|
||||||
user_with_role
|
|
||||||
|> Ash.Changeset.for_update(:update, %{})
|
|
||||||
|> Ash.update(authorize?: false, domain: Mv.Accounts)
|
|
||||||
|
|
||||||
# Reload to verify role didn't change
|
|
||||||
{:ok, updated_user_with_role} =
|
|
||||||
Ash.load(updated_user, :role, domain: Mv.Accounts, authorize?: false)
|
|
||||||
|
|
||||||
# Role should still be the same (not changed to "Mitglied")
|
|
||||||
assert updated_user_with_role.role.id == role.id
|
|
||||||
assert updated_user_with_role.role.name != "Mitglied"
|
|
||||||
end
|
|
||||||
|
|
||||||
test "handles missing Mitglied role gracefully" do
|
|
||||||
# Test that change handles nil role gracefully
|
|
||||||
# Since we can't easily delete the system role, we test the code path
|
|
||||||
# by verifying that when get_mitglied_role returns nil, changeset is unchanged
|
|
||||||
changeset =
|
|
||||||
User
|
|
||||||
|> Ash.Changeset.for_create(:create_user, %{
|
|
||||||
email: "test#{System.unique_integer([:positive])}@example.com"
|
|
||||||
})
|
|
||||||
|
|
||||||
# The change should handle nil role gracefully
|
|
||||||
# If role exists, it will be assigned; if not, changeset remains unchanged
|
|
||||||
result_changeset = Mv.Accounts.User.Changes.AssignDefaultRole.change(changeset, [], %{})
|
|
||||||
|
|
||||||
# Changeset should be valid regardless
|
|
||||||
assert result_changeset.valid?
|
|
||||||
|
|
||||||
# If role exists, it should be assigned (we check this in other tests)
|
|
||||||
# If role doesn't exist, changeset should be unchanged (no error)
|
|
||||||
end
|
|
||||||
|
|
||||||
test "assigns role correctly in integration test" do
|
|
||||||
email = "integration#{System.unique_integer([:positive])}@example.com"
|
|
||||||
|
|
||||||
{:ok, user} =
|
|
||||||
User
|
|
||||||
|> Ash.Changeset.for_create(:create_user, %{email: email})
|
|
||||||
|> Ash.create(authorize?: false, domain: Mv.Accounts)
|
|
||||||
|
|
||||||
# Load user with role
|
|
||||||
{:ok, user_with_role} = Ash.load(user, :role, domain: Mv.Accounts, authorize?: false)
|
|
||||||
|
|
||||||
# Verify role was assigned
|
|
||||||
assert user_with_role.role != nil
|
|
||||||
assert user_with_role.role.name == "Mitglied"
|
|
||||||
assert user_with_role.role.permission_set_name == "own_data"
|
|
||||||
end
|
|
||||||
end
|
|
||||||
end
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue