[FEATURE]: CustomField Resource Policies #386

New issue

Closed

opened 2026-01-29 11:55:44 +01:00 by moritz · 0 comments

moritz commented

2026-01-29 11:55:44 +01:00

Owner

Description

Add authorization policies to the CustomField resource. CustomFields are admin-managed; all authenticated users can read them (scope :all). No bypass policy is needed for read, because read uses scope :all and HasPermission authorizes list reads directly.

Tasks

Open lib/membership/custom_field.ex
Add a policies block
Add one policy: action_type([:read, :create, :update, :destroy]) with authorize_if Mv.Authorization.Checks.HasPermission
Do not add a bypass policy for read (unlike User/Member/CustomFieldValue; CustomField read uses scope :all)

Acceptance Criteria

All users (with valid role) can read custom fields
Only admin can create/update/destroy custom fields
Policies are tested

Test Strategy (TDD)

Test file: test/mv/membership/custom_field_policies_test.exs

Structure and helpers can follow test/mv/membership/custom_field_value_policies_test.exs (system_actor setup, users with each permission set, etc.).

Read access (all roles)

User with :own_data can read all custom fields
User with :read_only can read all custom fields
User with :normal_user can read all custom fields
User with :admin can read all custom fields

Write access (admin only)

Non-admin cannot create custom field (Forbidden)
Non-admin cannot update custom field (Forbidden)
Non-admin cannot destroy custom field (Forbidden)
Admin can create custom field
Admin can update custom field
Admin can destroy custom field

Notes

Action names: CustomField uses destroy :destroy_with_values (primary). HasPermission uses action_type :destroy, so no PermissionSets or policy change is needed for the destroy action.
PermissionSets: CustomField is already defined for all four permission sets (read for all, create/update/destroy for admin only). No change required there.

## Description Add authorization policies to the CustomField resource. CustomFields are admin-managed; all authenticated users can read them (scope :all). No bypass policy is needed for read, because read uses scope :all and HasPermission authorizes list reads directly. --- ## Tasks 1. Open `lib/membership/custom_field.ex` 2. Add a `policies` block 3. Add one policy: `action_type([:read, :create, :update, :destroy])` with `authorize_if Mv.Authorization.Checks.HasPermission` 4. Do **not** add a bypass policy for read (unlike User/Member/CustomFieldValue; CustomField read uses scope :all) --- ## Acceptance Criteria - [ ] All users (with valid role) can read custom fields - [ ] Only admin can create/update/destroy custom fields - [ ] Policies are tested --- ## Test Strategy (TDD) **Test file:** `test/mv/membership/custom_field_policies_test.exs` Structure and helpers can follow `test/mv/membership/custom_field_value_policies_test.exs` (system_actor setup, users with each permission set, etc.). ### Read access (all roles) - User with `:own_data` can read all custom fields - User with `:read_only` can read all custom fields - User with `:normal_user` can read all custom fields - User with `:admin` can read all custom fields ### Write access (admin only) - Non-admin cannot create custom field (Forbidden) - Non-admin cannot update custom field (Forbidden) - Non-admin cannot destroy custom field (Forbidden) - Admin can create custom field - Admin can update custom field - Admin can destroy custom field --- ## Notes - **Action names:** CustomField uses `destroy :destroy_with_values` (primary). HasPermission uses action_type `:destroy`, so no PermissionSets or policy change is needed for the destroy action. - **PermissionSets:** CustomField is already defined for all four permission sets (read for all, create/update/destroy for admin only). No change required there.