Create Authorization Domain and Role Resource #321

New issue

Closed

opened 2026-01-06 16:13:01 +01:00 by moritz · 0 comments

moritz commented

2026-01-06 16:13:01 +01:00

Owner

Create the authorization domain in Ash with the Role resource. This establishes the foundation for all authorization logic.

Tasks:

Create lib/mv/authorization/ directory
Create lib/mv/authorization/role.ex Ash resource with:
- id (UUIDv7, primary key)
- name (String, unique, required) - e.g., "Vorstand", "Admin"
- description (String, optional)
- permission_set_name (String, required) - must be one of: "own_data", "read_only", "normal_user", "admin"
- is_system_role (Boolean, default false) - prevents deletion
- timestamps
Add validation: permission_set_name must exist in PermissionSets.all_permission_sets/0
Add role_id (UUID, nullable, foreign key) to users table
Add belongs_to :role relationship in User resource
Run mix ash.codegen to generate migrations
Review and apply migrations

Acceptance Criteria:

Role resource created with all fields
Migration applied successfully
User.role relationship works
Validation prevents invalid permission_set_name
is_system_role flag present

Create the authorization domain in Ash with the `Role` resource. This establishes the foundation for all authorization logic. **Tasks:** 1. Create `lib/mv/authorization/` directory 2. Create `lib/mv/authorization/role.ex` Ash resource with: - `id` (UUIDv7, primary key) - `name` (String, unique, required) - e.g., "Vorstand", "Admin" - `description` (String, optional) - `permission_set_name` (String, required) - must be one of: "own_data", "read_only", "normal_user", "admin" - `is_system_role` (Boolean, default false) - prevents deletion - timestamps 3. Add validation: `permission_set_name` must exist in `PermissionSets.all_permission_sets/0` 4. Add `role_id` (UUID, nullable, foreign key) to `users` table 5. Add `belongs_to :role` relationship in User resource 6. Run `mix ash.codegen` to generate migrations 7. Review and apply migrations **Acceptance Criteria:** - [ ] Role resource created with all fields - [ ] Migration applied successfully - [ ] User.role relationship works - [ ] Validation prevents invalid `permission_set_name` - [ ] `is_system_role` flag present