Moritz 543fded102 Harden member user-link check: argument presence, nil actor, policy scope ... - Forbid on :user argument presence (not value) to block unlink via nil/empty - Defensive nil actor handling; policy restricted to create/update only - Test: Ash.load with actor; test non-admin cannot unlink via user: nil - Docs: unlink behaviour and policy split		2026-02-04 14:07:39 +01:00
..
accounts	User: fix last-admin validation and forbid non-admin role_id change	2026-02-04 09:19:47 +01:00
authorization	Add Role resource policies (defense-in-depth)	2026-02-04 14:07:38 +01:00
helpers	Add Role resource policies (defense-in-depth)	2026-02-04 14:07:38 +01:00
membership	Harden member user-link check: argument presence, nil actor, policy scope	2026-02-04 14:07:39 +01:00
membership_fees	MembershipFeeCycle: own_data read :linked via bypass and HasPermission scope	2026-02-04 09:20:10 +01:00