Commit graph

14 commits

Author SHA1 Message Date
fecf98dc0e
Security: Fix critical deny-filter bug and improve authorization
Some checks reported errors
continuous-integration/drone/push Build was killed
CRITICAL FIX: Deny-filter was allowing all records instead of denying
Fix: User validation in Member now uses actor from changeset.context
2026-01-08 23:12:54 +01:00
6cd18545bd
Fix: HasPermission auto_filter and strict_check implementation
Fixes security issue where auto_filter returned nil instead of proper
filter expressions, which could lead to incorrect authorization behavior.
2026-01-08 22:55:24 +01:00
f7cda66598
test: add Member resource policy tests 2026-01-08 21:22:15 +01:00
db0a187058
fix: correct relationship filter paths in HasPermission check
All checks were successful
continuous-integration/drone/push Build is passing
- Use user.id instead of user_id for Member linked scope
- Use member.user.id for CustomFieldValue linked scope
- Add lazy logger evaluation
- Improve action nil handling
- Add integration tests for filter expressions
2026-01-08 17:45:02 +01:00
cba471dcac test: add tests for HasPermission policy check
Add comprehensive test suite for the HasPermission Ash Policy Check
covering permission lookup, scope application, error handling, and logging.
2026-01-08 16:48:42 +01:00
18ec4bfd16 fix: add missing /custom_field_values/:id page to read_only and normal_user
All checks were successful
continuous-integration/drone/push Build is passing
- Add /custom_field_values/:id to read_only pages (users can view list, should also view details)
- Add /custom_field_values/:id to normal_user pages
- Refactor tests to reduce duplication (use for-comprehension for structure tests)
- Add tests for invalid input types in valid_permission_set?/1
- Update @spec for valid_permission_set?/1 to accept any() type
2026-01-06 22:17:33 +01:00
7845117fad refactor: improve error handling and documentation in PermissionSets
All checks were successful
continuous-integration/drone/push Build is passing
- Add explicit ArgumentError for invalid permission set names with helpful message
- Soften performance claim in documentation (intended to be constant-time)
- Add tests for error handling
- Improve maintainability with guard clause for invalid inputs
2026-01-06 21:55:52 +01:00
9b0d022767 fix: add missing /profile page to read_only and normal_user permission sets
Both permission sets allow User:update :own, so users should be able
to access their profile page. This makes the implementation consistent
with the documentation and the logical permission model.
2026-01-06 21:55:13 +01:00
4bd08e85bb fix: use Enum.empty? instead of != [] to fix type warning
All checks were successful
continuous-integration/drone/push Build is passing
Replace comparison with empty list using Enum.empty?/1 to satisfy
type checker and avoid redundant comparison warning
2026-01-06 21:35:59 +01:00
3a0fb4e84f
feat: implement PermissionSets module with all 4 permission sets
- Add types for scope, action, resource_permission, permission_set
- Implement get_permissions/1 for all 4 sets (own_data, read_only, normal_user, admin)
- Implement valid_permission_set?/1 for string and atom validation
- Implement permission_set_name_to_atom/1 with error handling
2026-01-06 21:33:39 +01:00
3265468bd6 test: update role tests for is_system_role API change
All checks were successful
continuous-integration/drone/push Build is passing
Use Ash.Changeset.force_change_attribute to set is_system_role in tests
since it's no longer settable via public API. Remove unused nil clause
from error_message helper.
2026-01-06 19:04:05 +01:00
73763b1f58 refactor: improve error_message test helper robustness
All checks were successful
continuous-integration/drone/push Build is passing
Use Enum.reject for nil field case to explicitly filter errors
without field. Update test to use :is_system_role field since
validation error includes field.
2026-01-06 18:44:04 +01:00
c6a766377a refactor: improve error_message test helper
Add pattern matching for nil field case to handle errors
without specific field (e.g., system role deletion).
2026-01-06 18:37:38 +01:00
9bb0fe5e37 test: add unit tests for Role validations
Add tests for permission_set_name validation, system role
deletion protection, and name uniqueness constraints.
2026-01-06 18:14:20 +01:00