Commit graph

54 commits

Author SHA1 Message Date
b545d2b9e1
Remove NoActor module, improve Member validation, update docs 2026-01-24 11:59:18 +01:00
71c13d0ac0
Fix missing actor parameters and restore AshAuthentication bypass tests
All checks were successful
continuous-integration/drone/push Build is passing
2026-01-24 08:51:58 +01:00
bebd7f6fe2
Fix tests: Remove redundant system_actor and update test descriptions 2026-01-24 02:21:09 +01:00
d8187484b8
Fix tests: Add missing actor parameters to Ash operations 2026-01-24 02:21:09 +01:00
b9d68a3417
Fix test helpers: Use actor parameter correctly 2026-01-24 02:21:09 +01:00
0f48a9b15a
Add actor parameter to all tests requiring authorization
This commit adds actor: system_actor to all Ash operations in tests that
require authorization.
2026-01-24 02:21:02 +01:00
427608578f Restrict Actor.ensure_loaded to Mv.Accounts.User only
All checks were successful
continuous-integration/drone/push Build is passing
Pattern match on %Mv.Accounts.User{} instead of generic actor.
Clearer intention, prevents accidental authorization bypasses.
Non-User actors are returned as-is (no-op).
2026-01-22 23:17:55 +01:00
f6096e194f Remove skipped get_by_subject test, add explanation
Test removed - JWT flow tested via AshAuthentication integration.
Direct test would require JWT mocking without value.
2026-01-22 23:04:58 +01:00
e60bb6926f Remove unused PolicyHelpers macro and PolicyConsistency test
All checks were successful
continuous-integration/drone/push Build is passing
Dead code - macro was never used in codebase.
PolicyConsistency test will be replaced with better implementation.
2026-01-22 22:37:09 +01:00
f2def20fce Add centralized Actor.ensure_loaded helper
Consolidate role loading logic from HasPermission and LiveHelpers.
Use Ash.Resource.Info.resource? for reliable Ash detection.
2026-01-22 22:37:07 +01:00
05c71132e4 Replace NoActor runtime Mix.env with compile-time config
Use Application.compile_env for release-safety.
Config only set in test.exs (defaults to false).
2026-01-22 22:37:04 +01:00
d97f6f4004 Add policy consistency tests
Enforce User.update :own across all permission sets.
Verify READ bypass + UPDATE HasPermission pattern.
2026-01-22 21:36:19 +01:00
7d0f5fde86 Replace for comprehension with explicit describe blocks
Fix Credo parsing error by removing for comprehension.
Duplicate tests for own_data, read_only, normal_user sets.
2026-01-22 21:36:16 +01:00
56144a7696 Add role loading fallback to HasPermission check
Extract ash_resource? helper to reduce nesting depth.
Add ensure_role_loaded fallback for unloaded actor roles.
2026-01-22 21:36:10 +01:00
93216f3ee6 Harden NoActor check with runtime environment guard
Add Mix.env() check to match?/3 for defense in depth.
Document NoActor pattern in CODE_GUIDELINES.md.
2026-01-22 21:36:09 +01:00
63d8c4668d test(auth): add User policies test suite
31 tests covering all 4 permission sets and bypass scenarios
Update HasPermission tests to expect false for scope :own without record
2026-01-22 19:19:25 +01:00
5eadd5f090 Refactor test setup into helper functions
All checks were successful
continuous-integration/drone/push Build is passing
Extract setup code into reusable helper functions to reduce
duplication and improve maintainability.
2026-01-20 23:16:40 +01:00
a3cf8571ff Document System Actor pattern in code guidelines
Add section explaining when and how to use system actor for systemic operations.
Include examples and distinction between user mode and system mode.
2026-01-20 22:10:11 +01:00
f1bb6a0f9a Add tests for System Actor helper
Test system actor retrieval, caching, fallback behavior,
and auto-creation in test environment.
2026-01-20 22:09:21 +01:00
0abcf540bb refactor: Replace length/1 with empty list comparison
Replace expensive length/1 calls with direct list comparison
to fix Credo warnings about performance
2026-01-20 15:58:15 +01:00
3cbd90ecdd feat: adds error capping 2026-01-19 12:02:28 +01:00
7da037d81d refactor: adds schemales changeset and validation constant 2026-01-19 11:43:51 +01:00
8b3cc6a6b2 feat: adds row validation 2026-01-19 11:22:11 +01:00
6dc398fa5a refactor: reduce complexity 2026-01-15 17:00:17 +01:00
0673684cc1 test: adds tests for header normalization 2026-01-15 16:11:02 +01:00
3bbe9895ee fix: improve CSV parser error handling 2026-01-15 11:08:22 +01:00
31cf07c071 test: updated tests 2026-01-15 10:10:14 +01:00
4b41ab37bb Merge branch 'main' into feature/330_import_service_skeleton 2026-01-14 12:30:40 +01:00
aa3fb0c49b fix linting 2026-01-14 10:48:36 +01:00
aa62e03409 skip test for now
Some checks failed
continuous-integration/drone/push Build is failing
2026-01-14 09:11:44 +01:00
c95a6fac69
Improve: Make deny_filter robust and add regression test
- Change deny_filter from [id: {:in, []}] to expr(false)
- Add regression test to ensure deny-filter matches 0 records
2026-01-13 15:01:55 +01:00
42a463f422
Security: Fix critical deny-filter bug and improve authorization
CRITICAL FIX: Deny-filter was allowing all records instead of denying
Fix: User validation in Member now uses actor from changeset.context
2026-01-13 15:01:55 +01:00
70729bdd73
Fix: HasPermission auto_filter and strict_check implementation
Fixes security issue where auto_filter returned nil instead of proper
filter expressions, which could lead to incorrect authorization behavior.
2026-01-13 15:01:54 +01:00
93190d558f
test: add Member resource policy tests 2026-01-13 15:01:53 +01:00
cc6d72b6b1 feat: add service skeleton and tests
Some checks failed
continuous-integration/drone/push Build is failing
2026-01-13 11:44:40 +01:00
db0a187058
fix: correct relationship filter paths in HasPermission check
All checks were successful
continuous-integration/drone/push Build is passing
- Use user.id instead of user_id for Member linked scope
- Use member.user.id for CustomFieldValue linked scope
- Add lazy logger evaluation
- Improve action nil handling
- Add integration tests for filter expressions
2026-01-08 17:45:02 +01:00
cba471dcac test: add tests for HasPermission policy check
Add comprehensive test suite for the HasPermission Ash Policy Check
covering permission lookup, scope application, error handling, and logging.
2026-01-08 16:48:42 +01:00
18ec4bfd16 fix: add missing /custom_field_values/:id page to read_only and normal_user
All checks were successful
continuous-integration/drone/push Build is passing
- Add /custom_field_values/:id to read_only pages (users can view list, should also view details)
- Add /custom_field_values/:id to normal_user pages
- Refactor tests to reduce duplication (use for-comprehension for structure tests)
- Add tests for invalid input types in valid_permission_set?/1
- Update @spec for valid_permission_set?/1 to accept any() type
2026-01-06 22:17:33 +01:00
7845117fad refactor: improve error handling and documentation in PermissionSets
All checks were successful
continuous-integration/drone/push Build is passing
- Add explicit ArgumentError for invalid permission set names with helpful message
- Soften performance claim in documentation (intended to be constant-time)
- Add tests for error handling
- Improve maintainability with guard clause for invalid inputs
2026-01-06 21:55:52 +01:00
9b0d022767 fix: add missing /profile page to read_only and normal_user permission sets
Both permission sets allow User:update :own, so users should be able
to access their profile page. This makes the implementation consistent
with the documentation and the logical permission model.
2026-01-06 21:55:13 +01:00
4bd08e85bb fix: use Enum.empty? instead of != [] to fix type warning
All checks were successful
continuous-integration/drone/push Build is passing
Replace comparison with empty list using Enum.empty?/1 to satisfy
type checker and avoid redundant comparison warning
2026-01-06 21:35:59 +01:00
3a0fb4e84f
feat: implement PermissionSets module with all 4 permission sets
- Add types for scope, action, resource_permission, permission_set
- Implement get_permissions/1 for all 4 sets (own_data, read_only, normal_user, admin)
- Implement valid_permission_set?/1 for string and atom validation
- Implement permission_set_name_to_atom/1 with error handling
2026-01-06 21:33:39 +01:00
3265468bd6 test: update role tests for is_system_role API change
All checks were successful
continuous-integration/drone/push Build is passing
Use Ash.Changeset.force_change_attribute to set is_system_role in tests
since it's no longer settable via public API. Remove unused nil clause
from error_message helper.
2026-01-06 19:04:05 +01:00
73763b1f58 refactor: improve error_message test helper robustness
All checks were successful
continuous-integration/drone/push Build is passing
Use Enum.reject for nil field case to explicitly filter errors
without field. Update test to use :is_system_role field since
validation error includes field.
2026-01-06 18:44:04 +01:00
c6a766377a refactor: improve error_message test helper
Add pattern matching for nil field case to handle errors
without specific field (e.g., system role deletion).
2026-01-06 18:37:38 +01:00
9bb0fe5e37 test: add unit tests for Role validations
Add tests for permission_set_name validation, system role
deletion protection, and name uniqueness constraints.
2026-01-06 18:14:20 +01:00
c25ffdc034
refactor: implement proper notification handling via after_action hooks
Refactor notification handling according to Ash best practices
2025-12-18 15:00:44 +01:00
d9ca6b1763 test: fix date dependencies in cycle generator tests
- Add create_member_with_cycles helper that uses fixed 'today' date
- Update tests to use explicit 'today:' option instead of Date.utc_today()
- Prevents test failures when current date changes (e.g., in 2026+)
- Tests now explicitly delete and regenerate cycles with fixed dates
- Ensures consistent test behavior regardless of execution date
2025-12-16 16:40:11 +01:00
de7a94ab07 fix: CycleGenerator generates from last cycle, not filling gaps
- Change algorithm to start from last existing cycle instead of start_date
- Deleted cycles (gaps) are no longer automatically filled
- Add test to verify gaps remain unfilled
- Update documentation to clarify gap handling behavior
2025-12-16 16:40:11 +01:00
539084fdf1 test: make CycleGenerator tests more robust
- Replace weak assertions (>= 0, if length > 0) with concrete expectations
- Remove unnecessary Process.sleep calls (tests run synchronously)
- Add get_member_cycles helper for direct cycle verification
- Tests now validate actual generated cycles instead of relying on async behavior
2025-12-16 16:40:11 +01:00