Commit graph

552 commits

Author SHA1 Message Date
a1fe36b7f2 Delegate can_access_page? to CheckPagePermission
- UI uses same rules as plug (reserved 'new', own/linked path checks)
2026-01-30 10:22:31 +01:00
d318dad612 Add /users/:id (own) and /members/:id/show/edit for redirect and normal_user
- read_only and normal_user: allow /users/:id, /users/:id/edit, /users/:id/show/edit (own only)
- normal_user: allow /members/:id/show/edit
- Fixes redirect loop when sidebar links to profile
2026-01-30 10:22:27 +01:00
b55f356762
fix: handle nil member in MembershipFeeHelpers
- get_last_completed_cycle/2 and get_current_cycle/2 return nil when member is nil.
- Avoids FunctionClauseError when MemberLive.Show receives no member (e.g. after
  redirect or policy filter). Add unit tests for nil member.
2026-01-30 00:00:32 +01:00
626e8a872e
feat: restrict own_data to profile and linked member pages
- Remove "/" from own_data pages (Mitglied redirected to profile at root).
- Add /users/:id, /users/:id/edit, /users/:id/show/edit and member edit pages
  for own_data so members can access own profile and linked member only.
2026-01-30 00:00:31 +01:00
b10b9c893c
feat: add CheckPagePermission plug for page-level authorization
- Plug checks PermissionSets page list; redirects unauthorized to profile or sign-in.
- Router: add plug to :browser pipeline; LiveHelpers: check_page_permission_on_params
  for client-side navigation (push_patch).
2026-01-30 00:00:31 +01:00
d7f6d1c03c Merge pull request 'Change Logo closes #385' (#389) from feature/385-mila-logo into main
All checks were successful
continuous-integration/drone/push Build is passing
Reviewed-on: #389
2026-01-29 16:20:34 +01:00
5a2f035ecc CustomField policies: actor required, no system-actor fallback, error handling
- list_required_custom_fields: require actor (two clauses, no default)
- Member validation: use context.actor only, differentiate Forbidden vs transient errors
- stream_custom_fields: log + send flash on error instead of returning []
- GlobalSettingsLive: handle_info for custom_fields_load_error, put_flash
- Seeds: use Membership.update_member with actor, format
2026-01-29 16:10:12 +01:00
9a7622ebed fix: pass actor to CustomFieldLive.FormComponent for save
IndexComponent now passes actor to FormComponent; FormComponent uses
assigns[:actor] instead of current_actor(socket). Add test that submits
new custom field form on settings page.
2026-01-29 16:10:12 +01:00
1d17c4f2dd fix: CustomField policies, no system-actor fallback, guidelines
- Tests and UI pass actor for CustomField create/read/destroy; seeds use actor
- Member required-custom-fields validation uses context.actor only (no fallback)
- CODE_GUIDELINES: add rule forbidding system-actor fallbacks
2026-01-29 16:10:12 +01:00
36b5d5880b Add CustomField resource policies and tests
- Add policies block with HasPermission for read/create/update/destroy
- Add authorizers: [Ash.Policy.Authorizer] to CustomField resource
- Add custom_field_policies_test.exs (read all roles, write admin only)
- Fix CustomField path in roles-and-permissions doc (lib/membership)
2026-01-29 16:10:12 +01:00
8fa337bd81
feat: change logo
All checks were successful
continuous-integration/drone/push Build is passing
continuous-integration/drone/promote/production Build is passing
2026-01-29 15:55:15 +01:00
b4adf63e83
feix: optimize queries for groups
Some checks failed
continuous-integration/drone/push Build is failing
2026-01-29 15:22:40 +01:00
124ab295a6
fix: select all checkbox handling 2026-01-29 15:14:36 +01:00
bb7e3cbe77
fix: make sure all tests run
All checks were successful
continuous-integration/drone/push Build is passing
2026-01-29 14:49:39 +01:00
59aefe9521
fix: minor bugs
All checks were successful
continuous-integration/drone/push Build is passing
2026-01-28 10:45:05 +01:00
ddc8335cc0
refactor: improve groups LiveView based on code review feedback
All checks were successful
continuous-integration/drone/push Build is passing
2026-01-28 10:33:27 +01:00
3eb4cde0b7
Merge remote-tracking branch 'origin/main' into feature/372-groups-management
All checks were successful
continuous-integration/drone/push Build is passing
2026-01-27 23:48:31 +01:00
9991291b2f
test: adapt tests to reflect implementation details
All checks were successful
continuous-integration/drone/push Build is passing
2026-01-27 23:40:12 +01:00
5e0b6580ae
refactor: fix credo warnings, update gettext
Some checks failed
continuous-integration/drone/push Build is failing
2026-01-27 22:32:37 +01:00
05c81af6e9
feat: add groups to sidebar #372 2026-01-27 22:05:21 +01:00
6faa9847f4
feat: add groups administration #372 2026-01-27 21:55:17 +01:00
2b4e1e3963
Sync user email to member when changing password (admin_set_password)
All checks were successful
continuous-integration/drone/push Build is passing
Add SyncUserEmailToMember change to admin_set_password so email+password
updates in the user form sync the new email to the linked member.
2026-01-27 17:58:35 +01:00
cbcb93418e feat(user_live): handle system user in form and show
Early return / load_user_or_redirect, use system_user? to avoid editing system actor.
2026-01-27 17:39:04 +01:00
d98b32af8d feat(accounts): block update/destroy on system-actor user
Validation prevents modifying system actor user (required for internal ops).
2026-01-27 17:39:04 +01:00
7d33acde9f feat(system_actor): add system_user?/1 and normalize email
Case-insensitive email comparison for system-actor detection.
2026-01-27 17:39:04 +01:00
41bc031cc6 refactor(web): extract format_ash_error to MvWeb.ErrorHelpers
Use shared ErrorHelpers in UserLive.Index for consistent Ash error formatting.
2026-01-27 17:39:04 +01:00
8ad5201e1a Hide system actor from user list and block show/edit
Index: filter out SystemActor.system_user_email() in query. Show/Form:
redirect to /users with flash when viewing or editing system actor user.
Index format_error: handle Ash errors without :message field.
2026-01-27 17:39:04 +01:00
b7f37c80bd Prevent deletion of system actor user
Add destroy validation and explicit destroy action (primary, require_atomic? false).
Validation blocks destroy when email == SystemActor.system_user_email().
2026-01-27 17:39:04 +01:00
5df1da1573 Merge branch 'main' into feature/371-groups-resource
All checks were successful
continuous-integration/drone/push Build is passing
2026-01-27 17:16:34 +01:00
e92c98b559
refactor: fix review issues - member_count aggregate, migration down, docs, actor handling
All checks were successful
continuous-integration/drone/push Build is passing
2026-01-27 17:09:07 +01:00
fc8306cfee
test: resolve warnings
All checks were successful
continuous-integration/drone/push Build is passing
2026-01-27 16:38:17 +01:00
4d3a249b0c HasPermission: remove unused _authorizer from strict_check helper 2026-01-27 16:07:01 +01:00
3f95a2dd84 CustomFieldValue: remove unused require Ash.Query 2026-01-27 16:07:01 +01:00
7153af23ee CustomFieldValueCreateScope: use get_argument_or_attribute for member_id
- Read member_id via Ash.Changeset.get_argument_or_attribute/2 so it works
  when set as attribute or argument
- Remove unused require Logger
- Document member_id source in moduledoc
2026-01-27 16:07:01 +01:00
bf2d0352c1 Add authorization policies to CustomFieldValue resource
- Authorizer and policies: bypass for read (member_id == actor.member_id),
  CustomFieldValueCreateScope for create, HasPermission for read/update/destroy.
- HasPermission: pass authorizer into strict_check helper; document that create
  must use a dedicated check (no filter).
2026-01-27 16:07:01 +01:00
c7c6b318ac Add CustomFieldValueCreateScope check for create actions
Ash cannot apply filters to create; this check enforces :linked/:all scope
via strict_check only (no filter).
2026-01-27 16:07:01 +01:00
8f5f69744c Add CustomFieldValue create/destroy :linked to own_data permission set
Allows members to create and delete custom field values for their linked member.
2026-01-27 16:07:01 +01:00
6db64bf996
feat: add groups resource #371
Some checks failed
continuous-integration/drone/push Build is failing
2026-01-27 16:03:21 +01:00
5195fd0d45 Fix missing max_errors assign in GlobalSettingsLive
All checks were successful
continuous-integration/drone/push Build is passing
Set max_errors as socket assign in mount/3 to make it
available in templates. Fixes KeyError in CSV import UI.
2026-01-25 18:36:33 +01:00
1d0ac6d280 Improve CSV import error messages
Include email address in duplicate email error messages.
Add German translation for email uniqueness errors.
Ensure locale is set for translations in async tasks.
2026-01-25 18:33:28 +01:00
5acb5e304d Fix CSV upload file reading
Handle consume_uploaded_entries returning [content] directly
instead of [{:ok, content}]. Add locale support for translations
in background tasks.
2026-01-25 18:33:27 +01:00
562265f212 Security: Require actor parameter in CSV import
Remove fallback to system_actor in process_chunk to prevent
unauthorized access. Actor must now be explicitly provided.
2026-01-25 18:33:25 +01:00
79361c72d2
fix tests and linting 2026-01-25 17:31:49 +01:00
b841c306fc
formatting 2026-01-25 17:31:49 +01:00
0fe4a55e80
formatting and refactoring 2026-01-25 17:31:48 +01:00
bf7e47ce5c
refactor 2026-01-25 17:31:42 +01:00
04b0916c1e
refactor 2026-01-25 17:30:07 +01:00
092fd99d48
fat: adds csv import live view to settings 2026-01-25 17:30:03 +01:00
bdd2e6e103 Fix: Don't cache nil in default_role_id to prevent bootstrap issues
All checks were successful
continuous-integration/drone/push Build is passing
- Only cache non-nil role_id values to allow retry after role creation
- Prevents processes from being permanently stuck with nil if first call
  happens before the 'Mitglied' role exists
- Update documentation to explain bootstrap safety mechanism
2026-01-25 17:11:05 +01:00
2d446f63ea
Add NOT NULL constraint to users.role_id and optimize default_role_id
All checks were successful
continuous-integration/drone/push Build is passing
- Add database-level NOT NULL constraint for users.role_id
- Update SystemActor tests to verify NOT NULL constraint enforcement
- Add process dictionary caching for default_role_id/0 to reduce DB queries
2026-01-25 17:04:48 +01:00