1152 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
Moritz	40e75f4066	refactor: reduce nesting in HasPermission.strict_check_with_permissions ... Extract strict_check_filter_scope/4 to satisfy Credo max depth 2.	2026-02-04 13:29:41 +01:00
Moritz	f7ba98c36b	refactor: reduce nesting in SyncUserEmailToMember.sync_email ... Extract apply_sync/1 and sync_by_record_type/4 to satisfy Credo max depth 2.	2026-02-04 13:03:36 +01:00
Renovate Bot	6aadf4f93b	Update Mix dependencies	2026-02-04 12:13:20 +01:00
moritz	d13fbef890	Merge pull request 'Complete Permissions for Groups, Membership Fees, and User Role Assignment closes #404' (#405) from feature/404_permission_completeness into main ... Reviewed-on: #405	2026-02-04 11:47:17 +01:00
Moritz	083592489f	ARIA: set aria-sort on th for sortable columns ... - Table: optional col sort_field; th gets aria-sort when col is sorted. - User index: pass sort_field/sort_order to table, sort_field: :email on email col.	2026-02-04 11:40:23 +01:00
Moritz	24d130ffb5	OIDC: use UserHelpers.has_oidc? in index and show ... - Index OIDC column and show OIDC item use has_oidc? instead of raw oidc_id. - Avoids empty string showing as Linked.	2026-02-04 11:40:21 +01:00
Moritz	503401f2e6	Setting: remove unused actor in default_fee_type validation ... - Docs: Regenerate Cycles server-side enforcement note in membership-fee-architecture.	2026-02-04 11:40:19 +01:00
Moritz	d7c6d20483	User form: red warning for OIDC users when setting/changing password ... - Show alert when user has oidc_id and password section is visible. - Explains that password here does not change SSO/identity provider password.	2026-02-04 11:07:01 +01:00
Moritz	b6d1a27bc9	Seeds: only admin gets password; additional users without password ... - Additional users (hans, greta, maria, thomas) created without admin_set_password. - Removed no-password@example.de user.	2026-02-04 11:06:59 +01:00
Moritz	541c79e501	ARIA: remove aria-sort from sort button; Password column tests ... - Sort button: aria-sort removed (button role does not support it). - Index tests: remove aria-sort assertions; add Password column display tests.	2026-02-04 11:06:55 +01:00
Moritz	c6082f2831	Users list and show: Role, Password, OIDC columns; UserHelpers ... - Index: load :role; columns Role, Password (has_password?), OIDC; contrast fix. - Show: Role, OIDC (Linked/Not linked); has_password? for Password Authentication. - UserHelpers: has_password?/1, has_oidc?/1. Gettext: new strings and DE translations.	2026-02-04 11:06:52 +01:00
Moritz	7eba21dc9c	Hide Regenerate Cycles button when no membership fee type assigned ... - Button only shown when @member.membership_fee_type is set (same as Create Cycle). - Test: no-type view asserts Regenerate Cycles button is not present.	2026-02-04 09:38:26 +01:00
Moritz	c035d0f141	Docs: groups and roles/permissions architecture, Group moduledoc ... - groups-architecture: normal_user and admin can manage groups. - roles-and-permissions: matrix and MembershipFeeCycle :linked for own_data. - group_policies_test: update moduledoc.	2026-02-04 09:20:26 +01:00
Moritz	178f5a01c7	MembershipFeeCycle: own_data read :linked via bypass and HasPermission scope ... - own_data gets read scope :linked; apply_scope in HasPermission; bypass check for own_data. - PermissionSetsTest expects own_data :linked, others :all for MFC read.	2026-02-04 09:20:10 +01:00
Moritz	890a4d3752	MemberGroup: restrict bypass to own_data via MemberGroupReadLinkedForOwnData ... - ActorPermissionSetIs check; bypass policy filters by member_id for own_data only. - Admin with member_id still gets :all via HasPermission. Tests added.	2026-02-04 09:19:57 +01:00
Moritz	67ce514ba0	User: fix last-admin validation and forbid non-admin role_id change ... - Last-admin only when target role is non-admin (admins may switch admin roles). - Use Ash.Changeset.get_attribute for new role_id. Tests: admin role switch, non-admin update_user role_id forbidden.	2026-02-04 09:19:47 +01:00
Moritz	dbd0a57292	Secure regenerate_cycles: require can?(:create, MembershipFeeCycle) in handler ... - Handler returns flash error when non-admin triggers event (e.g. DevTools). - Test: read_only cannot create MembershipFeeCycle so handler rejects.	2026-02-04 09:19:37 +01:00
Moritz	03d3a7eb1b	Docs and tests: fix CODE_GUIDELINES structure, use Mv.Fixtures in show_membership_fees_test ... - CODE_GUIDELINES: correct custom_field/custom_field_value descriptions, add fixtures.ex to test support - show_membership_fees_test: use Mv.Fixtures.member_fixture, remove redundant create_member helper	2026-02-04 01:02:22 +01:00
Moritz	a2e1054c8d	Tests: use Mv.Fixtures, fix warnings, Credo TODO disable ... - Policy tests: use Fixtures where applicable; create_custom_field() fix in custom_field_value. - Replace unused actor with _actor, remove unused alias Accounts in policy tests. - profile_navigation_test: disable Credo for intentional TODO comment.	2026-02-04 00:34:12 +01:00
Moritz	3a92398d54	user_policies_test: data-driven tests for own_data, read_only, normal_user ... Single describe with @tag permission_set and for-loop; one setup per permission set.	2026-02-04 00:34:02 +01:00
Moritz	085b6be769	show_membership_fees_test: format long assert line	2026-02-04 00:34:01 +01:00
Moritz	182d34fe58	MemberLive: confirm_delete_all_cycles via Ash.destroy, reduce current_actor ... - Delete each cycle with Ash.destroy(actor:) so policies apply; add do_delete_all_cycles/5. - Use positive can? check; remove duplicate current_actor(socket) in change_membership_fee_type.	2026-02-04 00:34:00 +01:00
Moritz	e799f0271c	Refactor PermissionSets: define admin permissions via perm_all() ... Use perm/3 helper for admin resource permissions (DRY). MemberGroup keeps read/create/destroy only (no update in domain).	2026-02-04 00:33:58 +01:00
Moritz	c4459ebb92	Docs, gettext, and remaining test updates ... - groups-architecture and membership-fee-architecture docs - Gettext: add/correct German for authorization and membership fee type - membership_fee_helpers_test and membership_fee_status_test adjustments	2026-02-03 23:52:31 +01:00
Moritz	101fd39f18	Fee settings and fee type form: pass actor for MembershipFeeType read ... - membership_fee_settings_live: current_actor(socket), Ash.read! with actor - membership_fee_type_live/form: Ash.get! with actor in mount - check_page_permission_test: normal_user /groups/new and /groups/:slug/edit allowed - membership_fee_type_live form_test: actor for Ash.read_one!/get!	2026-02-03 23:52:27 +01:00
Moritz	e3bea17827	Member show & MembershipFees: permissions, delete all, regenerate, errors ... - Show: handle_info :member_updated and :put_flash; Linked User only when can_access_page? /users - MembershipFeesComponent: can_create_cycle/can_destroy_cycle/can_update_cycle; buttons gated - Delete all cycles via Ash.destroy (policy enforced); format_error Forbidden - Regenerate cycles for normal_user and admin (no admin-only check) - Member form: format_error tuple for membership_fee_type_id; Select a membership fee type (no None) - show_membership_fees_test: read_only UI and policy tests	2026-02-03 23:52:24 +01:00
Moritz	8ec4a07103	User form: persist role, member linking, Forbidden handling ... - User resource: update_user accepts role_id, manage_relationship :member - user_live/form: touch role_id, params_with_member_if_unchanged to avoid unlink - Handle Forbidden in form, extract error message for display - user_policies_test and form_test coverage	2026-02-03 23:52:20 +01:00
Moritz	5ed41555e9	Member/Setting/validations: domain, actor, and seeds ... - setting.ex: domain/authorize for default_membership_fee_type_id check - validate_same_interval: require membership_fee_type (no None) - set_membership_fee_start_date: domain/actor for fee type lookup - Validations: domain/authorize for cross-resource checks - helpers.ex, email_sync change, seeds.exs actor/authorize fixes - Update related tests	2026-02-03 23:52:16 +01:00
Moritz	5889683854	Add resource policies for Group, MemberGroup, MembershipFeeType, MembershipFeeCycle ... - Group/MemberGroup/MembershipFeeType/MembershipFeeCycle: HasPermission policy - normal_user: Group and MembershipFeeCycle create/update/destroy; pages /groups/new, /groups/:slug/edit - Add policy tests for all four resources	2026-02-03 23:52:12 +01:00
Moritz	893f9453bd	Add PermissionSets for Group, MemberGroup, MembershipFeeType, MembershipFeeCycle ... - Extend permission_sets.ex with resources and pages for new domains - Adjust HasPermission check for resource/action/scope - Update roles-and-permissions and implementation-plan docs - Add permission_sets_test.exs coverage	2026-02-03 23:52:09 +01:00
moritz	36b7031dca	Merge pull request 'chore(deps): update renovate/renovate docker tag to v42.95' (#393) from renovate/renovate-renovate-42.x into main ... Reviewed-on: #393	2026-02-03 19:52:08 +01:00
Renovate Bot	fa5afba6ba	chore(deps): update renovate/renovate docker tag to v42.95	2026-02-03 19:51:42 +01:00
moritz	0c313824fb	Merge pull request 'chore(deps): update ghcr.io/sebadob/rauthy docker tag to v0.34.2' (#391) from renovate/ghcr.io-sebadob-rauthy-0.x into main ... Reviewed-on: #391	2026-02-03 19:51:09 +01:00
Renovate Bot	f45ae66f18	chore(deps): update ghcr.io/sebadob/rauthy docker tag to v0.34.2	2026-02-03 19:49:48 +01:00
moritz	c2bafe4acf	Merge pull request 'Apply UI Authorization to Existing LiveViews closes #400' (#403) from feature/400_ui_authorization into main ... Reviewed-on: #403	2026-02-03 17:30:15 +01:00
Moritz	cbc9376b7b	Tests: data-testid selectors, scoped delete, sidebar testid ... Member/User auth tests use data-testid and #row-id selectors. Sidebar auth tests assert on data-testid=sidebar-administration. Sidebar test expects data-testid in expanded-menu-group markup.	2026-02-03 17:16:15 +01:00
Moritz	ee6bfbacbb	User LiveViews: row_id and data-testid for actions ... Table row_id for scoped selectors; data-testid on New/Edit/Delete.	2026-02-03 17:16:13 +01:00
Moritz	a4b13cef49	Member LiveViews: row_id and data-testid for actions ... Table row_id for scoped selectors; data-testid on New/Edit/Delete.	2026-02-03 17:16:11 +01:00
Moritz	286972964d	CoreComponents: allow data-testid on button ... Include data-testid in button rest for test selectors.	2026-02-03 17:16:10 +01:00
Moritz	c36812bf3f	Authorization: document can_access_page? nil-safety ... Doc and example for nil user returning false.	2026-02-03 17:16:09 +01:00
Moritz	2ddd22078d	Sidebar: use PagePaths, add testid for Administration ... Gate menu items via PagePaths; add data-testid=sidebar-administration for stable tests. menu_group accepts optional testid attr.	2026-02-03 17:16:08 +01:00
Moritz	9e8910344e	Add MvWeb.PagePaths for central sidebar/page paths ... Single source for path strings used by Sidebar and can_access_page?. Keep in sync with router when routes change.	2026-02-03 17:16:07 +01:00
Moritz	1426ef1d38	Add sidebar authorization tests ... Assert menu visibility per role: admin, read_only, normal_user, own_data, nil user, user without role.	2026-02-03 16:56:52 +01:00
Moritz	f779fd61e0	Gate sidebar menu items by can_access_page? ... Members, Fee Types and Administration subitems only shown when user has page permission. Add admin_menu_visible? helper. Sidebar test uses admin user so menu items render.	2026-02-03 16:56:52 +01:00
Moritz	cc9e530d80	Add User LiveView authorization tests ... Covers admin, read_only, member, normal_user for Index and Show. Asserts New User / Edit / Delete visibility and redirect for non-admin.	2026-02-03 16:56:51 +01:00
Moritz	2f67c7099d	Apply UI authorization to User LiveViews (Index and Show) ... Gate New User button, Edit and Delete links with can?/3. Edit button on User Show visible only when user can update the user.	2026-02-03 16:56:51 +01:00
Moritz	5e361ba400	Add Member LiveView authorization tests ... Covers read_only, normal_user, admin, own_data for Index and Show. Asserts New Member / Edit / Delete visibility and redirect for Mitglied.	2026-02-03 16:56:51 +01:00
Moritz	505e31653a	Apply UI authorization to Member LiveViews (Index and Show) ... Gate New Member button, Edit and Delete links with can?/3. Edit button on Member Show visible only when user can update the member.	2026-02-03 16:56:51 +01:00
moritz	d3ad7c5013	Merge pull request 'Member Email Validation for Linked Members closes #397' (#399) from feature/397_emailsync_permission into main ... Reviewed-on: #399	2026-02-03 16:35:40 +01:00
Moritz	131904f172	Test: assert on error field :email instead of message string	2026-02-03 16:07:47 +01:00