[FEATURE]: Member Resource Policies #345

New issue

Closed

opened 2026-01-08 17:13:34 +01:00 by moritz · 0 comments

moritz commented

2026-01-08 17:13:34 +01:00

Owner

Description:

Add authorization policies to the Member resource using the new HasPermission check.

Tasks:

Open lib/mv/membership/member.ex
Add policies block at top of resource (before actions)
Configure policy to Mv.Authorization.Checks.HasPermission
Add policy for each action:
- :read → check HasPermission for :read
- :create → check HasPermission for :create
- :update → check HasPermission for :update
- :destroy → check HasPermission for :destroy
Add special policy: Allow user to read/update their linked member (before general policy)
```
policy action_type(:read) do
  authorize_if expr(user_id == ^actor(:id))
end
```
Ensure policies load actor with :role relationship preloaded
Test policies with different actors

Policy Order (Critical!):

Allow user to access their own linked member (most specific)
Check HasPermission (general authorization)
Default: Forbid

Acceptance Criteria:

Policies block added to Member resource
All CRUD actions protected by HasPermission
Special case: User can always access linked member
Policy order is correct (specific before general)
Actor preloads :role relationship
All policies tested

Test Strategy (TDD):

Policy Tests for :own_data (Mitglied):

User can read their linked member (user_id matches)
User can update their linked member
User cannot read unlinked member (returns empty list or forbidden)
User cannot create member
Verify scope :linked works

Policy Tests for :read_only (Vorstand):

User can read all members (returns all records)
User cannot create member (returns Forbidden)
User cannot update any member (returns Forbidden)
User cannot destroy any member (returns Forbidden)

Policy Tests for :normal_user (Kassenwart):

User can read all members
User can create new member
User can update any member
User cannot destroy member (not in permission set)

Policy Tests for :admin:

User can perform all CRUD operations on any member
No restrictions

Test File: test/mv/membership/member_policies_test.exs

**Description:** Add authorization policies to the Member resource using the new `HasPermission` check. **Tasks:** 1. Open `lib/mv/membership/member.ex` 2. Add `policies` block at top of resource (before actions) 3. Configure policy to `Mv.Authorization.Checks.HasPermission` 4. Add policy for each action: - `:read` → check HasPermission for :read - `:create` → check HasPermission for :create - `:update` → check HasPermission for :update - `:destroy` → check HasPermission for :destroy 5. Add special policy: Allow user to read/update their linked member (before general policy) ```elixir policy action_type(:read) do authorize_if expr(user_id == ^actor(:id)) end ``` 6. Ensure policies load actor with `:role` relationship preloaded 7. Test policies with different actors **Policy Order (Critical!):** 1. Allow user to access their own linked member (most specific) 2. Check HasPermission (general authorization) 3. Default: Forbid **Acceptance Criteria:** - [x] Policies block added to Member resource - [x] All CRUD actions protected by HasPermission - [x] Special case: User can always access linked member - [x] Policy order is correct (specific before general) - [x] Actor preloads :role relationship - [x] All policies tested **Test Strategy (TDD):** **Policy Tests for :own_data (Mitglied):** - User can read their linked member (user_id matches) - User can update their linked member - User cannot read unlinked member (returns empty list or forbidden) - User cannot create member - Verify scope :linked works **Policy Tests for :read_only (Vorstand):** - User can read all members (returns all records) - User cannot create member (returns Forbidden) - User cannot update any member (returns Forbidden) - User cannot destroy any member (returns Forbidden) **Policy Tests for :normal_user (Kassenwart):** - User can read all members - User can create new member - User can update any member - User cannot destroy member (not in permission set) **Policy Tests for :admin:** - User can perform all CRUD operations on any member - No restrictions **Test File:** `test/mv/membership/member_policies_test.exs`