[FEATURE]: CustomFieldValue Resource Policies #369

New issue

Closed

opened 2026-01-27 12:46:02 +01:00 by moritz · 0 comments

moritz commented

2026-01-27 12:46:02 +01:00

Owner

Description:

Add authorization policies to the CustomFieldValue resource. CustomFieldValues are linked to members, which are linked to users.

Tasks:

Open lib/mv/membership/custom_field_value.ex
Add policies block

Add special policy: Allow user to read/update custom field values of their linked member

policy action_type([:read, :update]) do
  authorize_if expr(member.user_id == ^actor(:id))
end

Add general policy: Check HasPermission
Ensure CustomFieldValue preloads :member relationship for scope checks
Preload :role relationship for actor

Policy Order:

Allow user to read/update properties of linked member
Check HasPermission
Default: Forbid

Acceptance Criteria:

User can access properties of their linked member
Policy traverses Member -> User relationship correctly
HasPermission check works for other scopes
Actor preloads :role relationship

Test Strategy (TDD):

Linked CustomFieldValues Tests (:own_data):

User can read custom field values of their linked member
User can update custom field values of their linked member
User cannot read custom field values of unlinked members
Verify relationship traversal works (custom_field_value.member.user_id)

Read-Only Tests:

User with :read_only can read all custom field values
User with :read_only cannot create/update custom field values

Normal User Tests:

User with :normal_user can CRUD custom field values

Admin Tests:

Admin can perform all operations

Test File: test/mv/membership/custom_field_value_policies_test.exs

**Description:** Add authorization policies to the CustomFieldValue resource. CustomFieldValues are linked to members, which are linked to users. **Tasks:** 1. Open `lib/mv/membership/custom_field_value.ex` 2. Add `policies` block 3. Add special policy: Allow user to read/update custom field values of their linked member ```elixir policy action_type([:read, :update]) do authorize_if expr(member.user_id == ^actor(:id)) end ``` 4. Add general policy: Check HasPermission 5. Ensure CustomFieldValue preloads :member relationship for scope checks 6. Preload :role relationship for actor **Policy Order:** 1. Allow user to read/update properties of linked member 2. Check HasPermission 3. Default: Forbid **Acceptance Criteria:** - [ ] User can access properties of their linked member - [ ] Policy traverses Member -> User relationship correctly - [ ] HasPermission check works for other scopes - [ ] Actor preloads :role relationship **Test Strategy (TDD):** **Linked CustomFieldValues Tests (:own_data):** - User can read custom field values of their linked member - User can update custom field values of their linked member - User cannot read custom field values of unlinked members - Verify relationship traversal works (custom_field_value.member.user_id) **Read-Only Tests:** - User with :read_only can read all custom field values - User with :read_only cannot create/update custom field values **Normal User Tests:** - User with :normal_user can CRUD custom field values **Admin Tests:** - Admin can perform all operations **Test File:** `test/mv/membership/custom_field_value_policies_test.exs` ---