local-it/mitgliederverwaltung
2
3
Fork 0
Code Issues 72 Pull requests 3 Projects 4 Releases Packages 1 Activity Actions

Member Resource Policies closes #345 #346

Merged
moritz merged 33 commits from feature/345_member_policies_2 into main 2026-01-13 16:36:24 +01:00
Conversation 0 Commits 33 Files changed 49 +2593 -1102
moritz commented 2026-01-08 21:27:59 +01:00
Owner
Copy link

Description of the implemented changes

The changes were:

  • Bugfixing
  • New Feature
  • Breaking Change
  • Refactoring

What has been changed?

Definition of Done

Code Quality

  • No new technical depths
  • Linting passed
  • Documentation is added were needed

Accessibility

  • New elements are properly defined with html-tags
  • Colour contrast follows WCAG criteria
  • Aria labels are added when needed
  • Everything is accessible by keyboard
  • Tab-Order is comprehensible
  • All interactive elements have a visible focus

Testing

  • Tests for new code are written
  • All tests pass
  • axe-core dev tools show no critical or major issues

Additional Notes

## Description of the implemented changes The changes were: - [ ] Bugfixing - [x] New Feature - [ ] Breaking Change - [ ] Refactoring <!--- Describe the goal of the PR in a few words --> ## What has been changed? <!--- List the things you changed --> ## Definition of Done ### Code Quality - [ ] No new technical depths - [x] Linting passed - [x] Documentation is added were needed ### Accessibility - [ ] New elements are properly defined with html-tags - [ ] Colour contrast follows WCAG criteria - [ ] Aria labels are added when needed - [ ] Everything is accessible by keyboard - [ ] Tab-Order is comprehensible - [ ] All interactive elements have a visible focus ### Testing - [x] Tests for new code are written - [x] All tests pass - [ ] axe-core dev tools show no critical or major issues ## Additional Notes <!--- Add any additional information for the reviewers here -->
moritz added this to the Accounts & Logins milestone 2026-01-08 21:27:59 +01:00
moritz self-assigned this 2026-01-08 21:27:59 +01:00
moritz added 2 commits 2026-01-08 21:28:00 +01:00
feat: implement authorization policies for Member resource
All checks were successful
continuous-integration/drone/push Build is passing
Details
9d58c9d1ef
moritz added 4 commits 2026-01-08 22:57:01 +01:00 
Fixes security issue where auto_filter returned nil instead of proper
filter expressions, which could lead to incorrect authorization behavior.
This prevents security issues where :create/:read without actor would
be allowed in production. Now all operations require an actor in production.
This ensures seeds work correctly with the new fail-closed NoActor
policy in production, using proper authorization instead of bypass.
Docs: Correct :linked scope documentation
All checks were successful
continuous-integration/drone/push Build is passing
Details
e5eb3b7e89
moritz added 1 commit 2026-01-08 23:13:48 +01:00
Security: Fix critical deny-filter bug and improve authorization
Some checks reported errors
continuous-integration/drone/push Build was killed
Details
fecf98dc0e 
CRITICAL FIX: Deny-filter was allowing all records instead of denying
Fix: User validation in Member now uses actor from changeset.context
moritz force-pushed feature/345_member_policies_2 from fecf98dc0e to 05cbd833bc 2026-01-08 23:15:59 +01:00 Compare
moritz added 1 commit 2026-01-08 23:30:38 +01:00
Improve: Make deny_filter robust and add regression test
All checks were successful
continuous-integration/drone/push Build is passing
Details
dd4b88f0b7 
- Change deny_filter from [id: {:in, []}] to expr(false)
- Add regression test to ensure deny-filter matches 0 records
moritz added 3 commits 2026-01-09 02:26:50 +01:00 
Update comment from 'id IN [] = never matches' to 'expr(false) = match none'
to match the actual implementation of deny_filter().
- Add on_mount hook to ensure user role is loaded in all Member LiveViews
- Pass actor parameter to all Ash operations (read, get, create, update, destroy, load)
Refactor test setup: use global setup and fix MembershipFees domain alias
All checks were successful
continuous-integration/drone/push Build is passing
Details
23f00d2cba 
- Remove redundant setup blocks from member_live tests
- Add build_unauthenticated_conn helper for AuthController tests
- Add global setup in conn_case.ex
moritz added 8 commits 2026-01-09 05:27:17 +01:00 
Provides a single function to access current_user from socket assigns
across all LiveViews, ensuring consistent access pattern.
Extract actor from changeset context in Member hooks and pass it
through all cycle generation functions to ensure proper authorization.
Extract actor from changeset context and pass it to all email sync
loader functions to ensure proper authorization when loading linked
users and members.
Extract actor from changeset context and pass it to Ash.read and
Ash.load calls in email uniqueness validation.
Replace inconsistent actor access patterns with current_actor/1 helper
and ensure actor is passed to all Ash operations for proper authorization.
Add German and English translations for member deletion success and
error messages.
Ensure cycle generation in seeds uses admin actor and update test
to use global admin_user from ConnCase setup.
Fix error handling and actor access in MemberLive.Index
All checks were successful
continuous-integration/drone/push Build is passing
Details
7c821193fc 
Replace bang calls with proper error handling and use current_actor/1
helper for consistent actor access.
moritz added 8 commits 2026-01-13 14:35:39 +01:00 
- Add role tag support (@tag role: :admin/:member/:unauthenticated) to ConnCase
- Fix Keyword.get -> Map.get for tags Map
- Remove duplicate test file index_display_name_test.exs
- Fix CustomField creation in tests (remove slug, use :string instead of :text)
- Fix CustomFieldValue value format to use _union_type/_union_value
- Add Mv.Helpers module with ash_actor_opts/1 helper
- Add current_actor/1 with @spec to LiveHelpers
- Add ash_actor_opts/1 delegate and submit_form/3 wrapper to LiveHelpers
- Standardize actor access pattern across LiveViews
- Replace if actor, do: [actor: actor], else: [] with Mv.Helpers.ash_actor_opts/1
- Update email_sync/loader.ex, member validations, member.ex, cycle_generator.ex
- Consistent actor handling across non-LiveView modules
- Replace AshPhoenix.Form.submit with submit_form/3 wrapper
- Import current_actor and submit_form from LiveHelpers
- Consistent actor handling in all form submissions
- Replace Ash.get!/Ash.destroy! with Ash.get/Ash.destroy
- Add case statements for Forbidden, NotFound, and generic errors
- Display user-friendly flash messages for all error cases
- Use Enum.map_join/3 for efficient error formatting
- Extract handle_member_linking, perform_member_link_action helpers
- Extract handle_save_success, get_action_name, handle_member_link_error
- Replace hardcoded strings with gettext translations
- Use submit_form wrapper for consistent actor handling
- Group all handle_event/3 clauses together
- Add early return in load_members_for_linking if actor is nil
- Fill in empty msgstr entries in German translations
- Add translations for user actions, error messages, and form labels
- Ensure all UI strings are consistently translated
ci: Add check for empty German translations in lint task
All checks were successful
continuous-integration/drone/push Build is passing
Details
4aa429e3cb 
- Check that all German msgstr entries are filled (excluding header)
- Use awk to filter out header msgstr "" entries
- Fail lint if any empty translations are found
moritz added 4 commits 2026-01-13 15:01:23 +01:00 
- Replace Ash.read! with Ash.read and proper error handling in mount/3
i18n: Update POT and English translations
All checks were successful
continuous-integration/drone/push Build is passing
Details
7cff550749
moritz force-pushed feature/345_member_policies_2 from 7cff550749 to 4244779521 2026-01-13 16:13:36 +01:00 Compare
moritz changed title from WIP: Member Resource Policies closes #345 to Member Resource Policies closes #345 2026-01-13 16:14:05 +01:00
moritz added 1 commit 2026-01-13 16:30:41 +01:00
i18n: Update English translations
All checks were successful
continuous-integration/drone/push Build is passing
Details
b103ae3a5f
moritz merged commit e9bcfe4fa6 into main 2026-01-13 16:36:24 +01:00
moritz deleted branch feature/345_member_policies_2 2026-01-13 16:36:28 +01:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
bug

Something is not working

  
duplicate

This issue or pull request already exists

  
enhancement

New feature

  
help wanted

Need some help

  
high priority

   
invalid

Something is wrong

  
L

5 h

  
low priority

   
M

3 h

  
medium priority

   
needs refinement

   
optional

   
question

More information is needed

  
S

1 h

  
UX research

   
wontfix

This won't be fixed

No labels
bug
duplicate
enhancement
help wanted
high priority
invalid
L
low priority
M
medium priority
needs refinement
optional
question
S
UX research
wontfix
Milestone
Clear milestone
No items
No milestone
Accounts & Logins
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
moritz
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: local-it/mitgliederverwaltung#346
No description provided.
Delete branch "feature/345_member_policies_2"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?