Commit graph

183 commits

Author SHA1 Message Date
145a76348c
Pass actor parameter in seeds and update test setup
Ensure cycle generation in seeds uses admin actor and update test
to use global admin_user from ConnCase setup.
2026-01-13 15:17:05 +01:00
075a06ba6f
Refactor test setup: use global setup and fix MembershipFees domain alias
- Remove redundant setup blocks from member_live tests
- Add build_unauthenticated_conn helper for AuthController tests
- Add global setup in conn_case.ex
2026-01-13 15:15:56 +01:00
c95a6fac69
Improve: Make deny_filter robust and add regression test
- Change deny_filter from [id: {:in, []}] to expr(false)
- Add regression test to ensure deny-filter matches 0 records
2026-01-13 15:01:55 +01:00
42a463f422
Security: Fix critical deny-filter bug and improve authorization
CRITICAL FIX: Deny-filter was allowing all records instead of denying
Fix: User validation in Member now uses actor from changeset.context
2026-01-13 15:01:55 +01:00
70729bdd73
Fix: HasPermission auto_filter and strict_check implementation
Fixes security issue where auto_filter returned nil instead of proper
filter expressions, which could lead to incorrect authorization behavior.
2026-01-13 15:01:54 +01:00
93190d558f
test: add Member resource policy tests 2026-01-13 15:01:53 +01:00
6fe75db56d formatting
Some checks failed
continuous-integration/drone/push Build is failing
2026-01-13 10:50:33 +01:00
35895ac7fd fix tests
Some checks failed
continuous-integration/drone/push Build is failing
2026-01-13 10:48:44 +01:00
8a1b14fc79
fix: fix tests and remove navbar remainings
Some checks failed
continuous-integration/drone/push Build is failing
2026-01-12 15:16:31 +01:00
e7515b5450
Merge remote-tracking branch 'origin/main' into sidebar 2026-01-12 14:15:12 +01:00
922f9f93d0 Merge branch 'main' into feature/223_memberfields_settings
All checks were successful
continuous-integration/drone/push Build is passing
2026-01-12 13:15:40 +01:00
77908a1467 fix tests
All checks were successful
continuous-integration/drone/push Build is passing
2026-01-12 11:45:44 +01:00
db0a187058
fix: correct relationship filter paths in HasPermission check
All checks were successful
continuous-integration/drone/push Build is passing
- Use user.id instead of user_id for Member linked scope
- Use member.user.id for CustomFieldValue linked scope
- Add lazy logger evaluation
- Improve action nil handling
- Add integration tests for filter expressions
2026-01-08 17:45:02 +01:00
cba471dcac test: add tests for HasPermission policy check
Add comprehensive test suite for the HasPermission Ash Policy Check
covering permission lookup, scope application, error handling, and logging.
2026-01-08 16:48:42 +01:00
03c1f747c5
chore: update gettext files and test cleanup
Update translation files after code changes and remove unused
debug logging code from tests.
2026-01-08 16:20:22 +01:00
c9b83a501f
fix: prefix unused view variable with underscore
Fix compiler warning for unused variable in role_live_test.exs
2026-01-08 16:16:54 +01:00
9a86e0ec01
feat: implement role management LiveViews
Add complete CRUD interface for role management under /admin/roles.

- Index page with table showing name, description, permission_set_name, is_system_role
- Show page for role details
- Form component for create/edit with permission_set_name dropdown
- System role badge and disabled delete button
- Flash messages for success/error
- Authorization checks using MvWeb.Authorization helpers
- Comprehensive test coverage (22 tests)

Routes added under /admin scope. All LiveViews load user role
for authorization checks. Form uses custom dropdown for permission sets.
2026-01-08 16:16:53 +01:00
ff9c8d2d64
feat: add UI-level authorization helpers
Implement MvWeb.Authorization module with can?/3 and can_access_page?/2
functions for conditional rendering in LiveView templates.

- can?/3 supports both resource atoms and record structs with scope checking
- can_access_page?/2 checks page access permissions
- All functions use PermissionSets module for consistency with backend
- Graceful handling of nil users and invalid permission sets
- Comprehensive test coverage with 17 test cases
2026-01-08 16:16:53 +01:00
e565d1748e test: add tests for atomic member field visibility updates 2026-01-08 11:38:41 +01:00
36776f8e28 fix tests and linting 2026-01-07 18:11:36 +01:00
df8c6a1854 Merge branch 'main' into feature/223_memberfields_settings
Some checks failed
continuous-integration/drone/push Build is failing
2026-01-07 11:42:54 +01:00
909d4af2a2 Merge branch 'main' into feature/223_memberfields_settings 2026-01-07 11:11:02 +01:00
0c8a255476 Merge branch 'main' into feature/273_member_fields
Some checks failed
continuous-integration/drone/push Build is failing
2026-01-07 10:22:18 +01:00
9f97515d74 chore: movs display name helper to won helper module 2026-01-07 09:54:37 +01:00
18ec4bfd16 fix: add missing /custom_field_values/:id page to read_only and normal_user
All checks were successful
continuous-integration/drone/push Build is passing
- Add /custom_field_values/:id to read_only pages (users can view list, should also view details)
- Add /custom_field_values/:id to normal_user pages
- Refactor tests to reduce duplication (use for-comprehension for structure tests)
- Add tests for invalid input types in valid_permission_set?/1
- Update @spec for valid_permission_set?/1 to accept any() type
2026-01-06 22:17:33 +01:00
7845117fad refactor: improve error handling and documentation in PermissionSets
All checks were successful
continuous-integration/drone/push Build is passing
- Add explicit ArgumentError for invalid permission set names with helpful message
- Soften performance claim in documentation (intended to be constant-time)
- Add tests for error handling
- Improve maintainability with guard clause for invalid inputs
2026-01-06 21:55:52 +01:00
9b0d022767 fix: add missing /profile page to read_only and normal_user permission sets
Both permission sets allow User:update :own, so users should be able
to access their profile page. This makes the implementation consistent
with the documentation and the logical permission model.
2026-01-06 21:55:13 +01:00
4bd08e85bb fix: use Enum.empty? instead of != [] to fix type warning
All checks were successful
continuous-integration/drone/push Build is passing
Replace comparison with empty list using Enum.empty?/1 to satisfy
type checker and avoid redundant comparison warning
2026-01-06 21:35:59 +01:00
3a0fb4e84f
feat: implement PermissionSets module with all 4 permission sets
- Add types for scope, action, resource_permission, permission_set
- Implement get_permissions/1 for all 4 sets (own_data, read_only, normal_user, admin)
- Implement valid_permission_set?/1 for string and atom validation
- Implement permission_set_name_to_atom/1 with error handling
2026-01-06 21:33:39 +01:00
3265468bd6 test: update role tests for is_system_role API change
All checks were successful
continuous-integration/drone/push Build is passing
Use Ash.Changeset.force_change_attribute to set is_system_role in tests
since it's no longer settable via public API. Remove unused nil clause
from error_message helper.
2026-01-06 19:04:05 +01:00
73763b1f58 refactor: improve error_message test helper robustness
All checks were successful
continuous-integration/drone/push Build is passing
Use Enum.reject for nil field case to explicitly filter errors
without field. Update test to use :is_system_role field since
validation error includes field.
2026-01-06 18:44:04 +01:00
c6a766377a refactor: improve error_message test helper
Add pattern matching for nil field case to handle errors
without specific field (e.g., system role deletion).
2026-01-06 18:37:38 +01:00
9bb0fe5e37 test: add unit tests for Role validations
Add tests for permission_set_name validation, system role
deletion protection, and name uniqueness constraints.
2026-01-06 18:14:20 +01:00
b59a4ef61a feat: adds email as fallback for name in member details
Some checks failed
continuous-integration/drone/push Build is failing
2026-01-06 16:43:13 +01:00
ff625c91c5
Merge remote-tracking branch 'origin/main' into sidebar
Some checks failed
continuous-integration/drone/push Build is failing
2026-01-06 10:52:55 +01:00
aba8737c38
feat: improve sidebar handling
Some checks failed
continuous-integration/drone/push Build is failing
2026-01-06 10:29:20 +01:00
7188315577 tests: fixes tests 2026-01-02 16:20:39 +01:00
08f563a412 Merge branch 'main' into bugfix/274_required_custom_fields
Some checks failed
continuous-integration/drone/push Build is failing
2026-01-02 13:47:24 +01:00
0df5d1c0b9
Merge branch 'main' into feature/280_membership_fee_ui
All checks were successful
continuous-integration/drone/push Build is passing
2025-12-26 23:14:10 +01:00
6f568bfe54 test: fix tests after join_date validation and UI changes
Update test to expect join_date validation error. Fix toggle button selector in cycle view test. Remove unnecessary cleanup from create_cycle helper.
2025-12-26 21:41:30 +01:00
f87e6d3e1d fix tests
All checks were successful
continuous-integration/drone/push Build is passing
2025-12-23 18:21:15 +01:00
398a63a98f add tests for empty custom field section 2025-12-23 17:07:52 +01:00
324425a991 test: Add tests for empty string validation in custom fields 2025-12-23 17:02:23 +01:00
def399122c fix tests with async true 2025-12-23 16:14:58 +01:00
16ca4efc03
feat: implement standard-compliant sidebar with comprehensive tests
Some checks failed
continuous-integration/drone/push Build is failing
Implement a new sidebar component based on DaisyUI Drawer pattern without
custom CSS variants. The sidebar supports desktop (expanded/collapsed states)
and mobile (overlay drawer) with full accessibility compliance.

Sidebar Implementation:
- Refactor sidebar component with sidebar_header, menu_item, menu_group,
  sidebar_footer sub-components
- Add logo (mila.svg) with size-8 (32px) always visible
- Implement toggle button with icon swap (chevron-left/right) for desktop
- Add nested menu support with details/summary (expanded) and dropdown
  (collapsed) patterns
- Implement footer with language selector (expanded-only), theme toggle,
  and user menu with avatar
- Update layouts.ex to use drawer pattern with data-sidebar-expanded
  attribute for state management

CSS & JavaScript:
- Add CSS styles for sidebar state management via data-attribute selectors
- Implement SidebarState JavaScript hook for localStorage persistence
- Add smooth width transitions (w-64 ↔ w-16) for desktop collapsed state
- Add CSS classes for expanded-only, menu-label, and icon visibility

Documentation:
- Add sidebar-analysis-current-state.md: Analysis of current implementation
- Add sidebar-requirements-v2.md: Complete specification for new sidebar
- Add daisyui-drawer-pattern.md: DaisyUI pattern documentation
- Add umsetzung-sidebar.md: Step-by-step implementation guide

Testing:
- Add comprehensive component tests for all sidebar sub-components
- Add integration tests for sidebar state management and mobile drawer
- Extend accessibility tests (ARIA labels, roles, keyboard navigation)
- Add regression tests for duplicate IDs, hover effects, and tooltips
- Ensure full test coverage per specification requirements
2025-12-18 16:36:16 +01:00
e3d615acb8
Fix failing tests after filter refactoring
Some checks failed
continuous-integration/drone/push Build is failing
Update tests to use new cycle_status_filter parameter instead of
membership_fee_filter. Fix button selector for toggle_cycle_view to
target the header button. Fix edit cycle amount test to click on
span element instead of button.
2025-12-18 15:11:04 +01:00
46fb12c3f4
Add German translations and fix Credo warnings
Add translations for 'Current Cycle Payment Status' and 'Last Cycle
Payment Status'. Replace length/1 with Enum.empty?/1 in seeds tests
to fix Credo warnings.
2025-12-18 15:11:04 +01:00
39de5c9237
Fix seeds test: add Ash.Query require 2025-12-18 15:11:03 +01:00
239d784f3c
Update seeds: member without fee type, cycles with various statuses
Add member without membership fee type. Generate cycles for members
with fee types and set different statuses: all paid, all unpaid, and
mixed (paid/unpaid/suspended). Update tests accordingly.
2025-12-18 15:11:03 +01:00
f25e198b0e
Update cycle button styling and text
Make cycle button match PaymentFilterComponent and Columns button style.
Show 'Current Cycle Payment Status' or 'Last Cycle Payment Status'
based on active state. Button shows active state when current cycle
is selected.
2025-12-18 15:11:03 +01:00