local-it/mitgliederverwaltung
2
3
Fork 0
Code Issues 67 Pull requests 7 Projects 3 Releases Packages 1 Activity Actions

System Actor Mode for Systemic Flows closes #348 #361

Merged
moritz merged 16 commits from feature/348_system_actor into main 2026-01-21 08:36:41 +01:00
Conversation 0 Commits 16 Files changed 16 +43 -33
1 changed files with 43 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit b0ddf99117 - Show all commits

10
lib/mv_web/live/member_live/show/membership_fees_component.ex
View file

@ -554,6 +554,11 @@ defmodule MvWeb.MemberLive.Show.MembershipFeesComponent do
end end
def handle_event("regenerate_cycles", _params, socket) do def handle_event("regenerate_cycles", _params, socket) do
actor = current_actor(socket)
# SECURITY: Only admins can manually regenerate cycles via UI
# Cycle generation itself uses system actor, but UI access should be restricted
if actor.role && actor.role.permission_set_name == "admin" do
socket = assign(socket, :regenerating, true) socket = assign(socket, :regenerating, true)
member = socket.assigns.member member = socket.assigns.member
@ -594,6 +599,11 @@ defmodule MvWeb.MemberLive.Show.MembershipFeesComponent do
|> assign(:regenerating, false) |> assign(:regenerating, false)
|> put_flash(:error, format_error(error))} |> put_flash(:error, format_error(error))}
end end
else
{:noreply,
socket
|> put_flash(:error, gettext("Only administrators can regenerate cycles"))}
end
end end
def handle_event("edit_cycle_amount", %{"cycle_id" => cycle_id}, socket) do def handle_event("edit_cycle_amount", %{"cycle_id" => cycle_id}, socket) do