From 445fa91f8b5325e97a1090a4718a259a8e24faf5 Mon Sep 17 00:00:00 2001
From: Stefdev13 <stef.bekaert@proton.me>
Date: Wed, 18 Mar 2026 16:26:48 +0100
Subject: [PATCH 1/7] Added Member role

- Added member role
- Added a check on the relevant navlinks to only be present when the user in not a member
- Added new Plug "redirect_member" to redirect members to events page if they go to non-allowed url
- Added the new Plug to the router and split the scope into 2 scopes: 1 for all user-roles and 1 for admin and superuser only
---
 lib/mailgun_logger/roles/roles.ex             |  1 +
 .../plugs/redirect_member.ex                  | 27 +++++++++++++++++++
 lib/mailgun_logger_web/router.ex              | 17 +++++++++---
 .../templates/layout/app.html.heex            |  8 +++---
 4 files changed, 47 insertions(+), 6 deletions(-)
 create mode 100644 lib/mailgun_logger_web/plugs/redirect_member.ex

diff --git a/lib/mailgun_logger/roles/roles.ex b/lib/mailgun_logger/roles/roles.ex
index 8a873bb..3ec4c06 100644
--- a/lib/mailgun_logger/roles/roles.ex
+++ b/lib/mailgun_logger/roles/roles.ex
@@ -69,6 +69,7 @@ defmodule MailgunLogger.Roles do
 
   def is?(%User{roles: roles}, :superuser), do: is(roles, "superuser")
   def is?(%User{roles: roles}, :admin), do: is(roles, "admin")
+  def is?(%User{roles: roles}, :member), do: is(roles, "member")
   def is?(_, _), do: raise("Roles.is/2 requires roles to be preloaded")
 
   defp is(roles, role) when is_binary(role), do: Enum.map(roles, & &1.name) |> Enum.member?(role)
diff --git a/lib/mailgun_logger_web/plugs/redirect_member.ex b/lib/mailgun_logger_web/plugs/redirect_member.ex
new file mode 100644
index 0000000..618c8e1
--- /dev/null
+++ b/lib/mailgun_logger_web/plugs/redirect_member.ex
@@ -0,0 +1,27 @@
+defmodule MailgunLoggerWeb.Plugs.RedirectMember do
+  import Plug.Conn
+  import Phoenix.Controller
+
+  alias MailgunLogger.Roles
+  alias MailgunLogger.User
+  alias MailgunLoggerWeb.Router.Helpers, as: Routes
+
+  def init(opts), do: opts
+
+  def call(conn, _opts) do
+    case conn.assigns[:current_user] do
+      %User{} = user ->
+        if Roles.is?(user, :member) do
+          conn
+          |> redirect(to: Routes.event_path(conn, :index))
+          |> halt()
+        else
+          conn
+        end
+      _ ->
+        conn
+    end
+  end
+
+
+end
diff --git a/lib/mailgun_logger_web/router.ex b/lib/mailgun_logger_web/router.ex
index 7297982..d9f1bf5 100644
--- a/lib/mailgun_logger_web/router.ex
+++ b/lib/mailgun_logger_web/router.ex
@@ -23,6 +23,10 @@ defmodule MailgunLoggerWeb.Router do
     plug(MailgunLoggerWeb.Plugs.Auth)
   end
 
+  pipeline :redirect_member do
+    plug(MailgunLoggerWeb.Plugs.RedirectMember)
+  end
+
   # Always except in prod
   if Application.compile_env(:mailgun_logger, :env) == :dev do
     forward("/sent_emails", Bamboo.SentEmailViewerPlug)
@@ -69,6 +73,7 @@ defmodule MailgunLoggerWeb.Router do
     post("/", SetupController, :create_root)
   end
 
+  # - Scope for all authenticated users
   scope "/", MailgunLoggerWeb do
     pipe_through([:browser, :auth])
 
@@ -76,15 +81,21 @@ defmodule MailgunLoggerWeb.Router do
 
     resources("/events", EventController, only: [:index, :show])
     get("/events/:id/stored_message", EventController, :stored_message)
-    resources("/accounts", AccountController, except: [:show])
     get("/profile", ProfileController, :edit)
     put("/profile", ProfileController, :update)
-    resources("/users", UserController, except: [:show])
 
     get("/", PageController, :index)
     post("/trigger-run", PageController, :trigger_run)
-    get("/stats", PageController, :stats)
     get("/graphs", PageController, :graphs)
     get("/non-affiliation", PageController, :non_affiliation)
   end
+
+  # - Only for users with role set as admin or superuser, members get redirected
+  scope "/", MailgunLoggerWeb do
+    pipe_through([:browser, :auth, :redirect_member])
+
+    resources("/users", UserController, except: [:show])
+    resources("/accounts", AccountController, except: [:show])
+    get("/stats", PageController, :stats)
+  end
 end
diff --git a/lib/mailgun_logger_web/templates/layout/app.html.heex b/lib/mailgun_logger_web/templates/layout/app.html.heex
index 6a78307..3c246e7 100644
--- a/lib/mailgun_logger_web/templates/layout/app.html.heex
+++ b/lib/mailgun_logger_web/templates/layout/app.html.heex
@@ -39,9 +39,11 @@
           <ul>
             <%= if assigns[:current_user] do %>
               <li><.link href={Routes.event_path(@conn, :index)} class={active_link_class(@conn, MailgunLoggerWeb.EventController)}>Events</.link></li>
-              <li><.link href={Routes.page_path(@conn, :stats)} class={active_link_class(@conn, MailgunLoggerWeb.PageController, :index)}>Stats</.link></li>
-              <li><.link href={Routes.account_path(@conn, :index)} class={active_link_class(@conn, MailgunLoggerWeb.AccountController, :index)}>Accounts</.link></li>
-              <li><.link href={Routes.user_path(@conn, :index)} class={active_link_class(@conn, MailgunLoggerWeb.UserController, :index)}>Users</.link></li>
+              <%= if not MailgunLogger.Roles.is?(@current_user, :member) do %>
+                <li><.link href={Routes.page_path(@conn, :stats)} class={active_link_class(@conn, MailgunLoggerWeb.PageController, :index)}>Stats</.link></li>
+                <li><.link href={Routes.account_path(@conn, :index)} class={active_link_class(@conn, MailgunLoggerWeb.AccountController, :index)}>Accounts</.link></li>
+                <li><.link href={Routes.user_path(@conn, :index)} class={active_link_class(@conn, MailgunLoggerWeb.UserController, :index)}>Users</.link></li>
+              <% end %>
               <li class="nav-right">
                 <details class="nav-dropdown">
                   <summary class="nav-dropdown-toggle">

From e2f6710d275323aa631ef400eb4802f0ade0c863 Mon Sep 17 00:00:00 2001
From: Stefdev13 <stef.bekaert@proton.me>
Date: Thu, 19 Mar 2026 14:43:22 +0100
Subject: [PATCH 2/7] Added Role changing functionality

- Added role update functionality in backend and frontend
---
 lib/mailgun_logger/users/user.ex                | 17 +++++++++++++++--
 .../controllers/user_controller.ex              | 13 ++++++++++++-
 .../templates/user/edit.html.heex               |  2 +-
 .../templates/user/form.html.heex               |  8 ++++++++
 .../templates/user/new.html.heex                |  2 +-
 .../templates/user/profile.html.heex            |  2 +-
 6 files changed, 38 insertions(+), 6 deletions(-)

diff --git a/lib/mailgun_logger/users/user.ex b/lib/mailgun_logger/users/user.ex
index 9ed75cf..4af4d61 100644
--- a/lib/mailgun_logger/users/user.ex
+++ b/lib/mailgun_logger/users/user.ex
@@ -36,6 +36,8 @@ defmodule MailgunLogger.User do
     field(:theme, :string, default: "system")
     field(:password, :string, virtual: true)
 
+    field(:current_role, :string, virtual: true)
+
     many_to_many(:roles, Role, join_through: UserRole, on_replace: :delete)
 
     timestamps()
@@ -45,7 +47,7 @@ defmodule MailgunLogger.User do
   @spec changeset(User.t(), map()) :: Ecto.Changeset.t()
   def changeset(%User{} = user, attrs \\ %{}) do
     user
-    |> cast(attrs, [:firstname, :lastname, :email, :password, :theme])
+    |> cast(attrs, [:firstname, :lastname, :email, :password, :theme, :current_role])
     |> validate_required([:email, :password])
     |> update_change(:email, &String.downcase/1)
     |> validate_format(:email, @email_format)
@@ -53,16 +55,18 @@ defmodule MailgunLogger.User do
     |> unique_constraint(:email)
     |> hash_password()
     |> generate_token()
+    |> update_role()
   end
 
   @doc false
   @spec update_changeset(User.t(), map()) :: Ecto.Changeset.t()
   def update_changeset(%User{} = user, attrs \\ %{}) do
     user
-    |> cast(attrs, [:firstname, :lastname, :email, :theme])
+    |> cast(attrs, [:firstname, :lastname, :email, :theme, :current_role])
     |> update_change(:email, &String.downcase/1)
     |> validate_format(:email, @email_format)
     |> unique_constraint(:email)
+    |> update_role()
   end
 
   @doc "Used when creating an admin, e.g. from the setup flow"
@@ -109,6 +113,15 @@ defmodule MailgunLogger.User do
     put_change(changeset, :token, token)
   end
 
+  defp update_role(%Ecto.Changeset{} = changeset) do
+    case get_change(changeset, :current_role) do
+      nil  -> changeset
+      role_name ->
+        role = Roles.get_role_by_name(role_name)
+        put_assoc(changeset, :roles, [role])
+    end
+  end
+
   @doc false
   def full_name(nil), do: ""
   def full_name(%User{lastname: nil, firstname: nil, email: nil}), do: ""
diff --git a/lib/mailgun_logger_web/controllers/user_controller.ex b/lib/mailgun_logger_web/controllers/user_controller.ex
index 1128c69..ac836d5 100644
--- a/lib/mailgun_logger_web/controllers/user_controller.ex
+++ b/lib/mailgun_logger_web/controllers/user_controller.ex
@@ -23,7 +23,18 @@ defmodule MailgunLoggerWeb.UserController do
 
   def edit(conn, %{"id" => id}) do
     user = Users.get_user!(id)
-    changeset = User.changeset(user)
+
+    # Set the users current role so we can edit it.
+    current_role =
+      case List.first(user.roles) do
+        nil -> nil
+        role -> role.name
+      end
+
+    user = %{user | current_role: current_role}
+
+    changeset = User.update_changeset(user)
+
     render(conn, :edit, changeset: changeset, user: user)
   end
 
diff --git a/lib/mailgun_logger_web/templates/user/edit.html.heex b/lib/mailgun_logger_web/templates/user/edit.html.heex
index f9773ed..54ec646 100644
--- a/lib/mailgun_logger_web/templates/user/edit.html.heex
+++ b/lib/mailgun_logger_web/templates/user/edit.html.heex
@@ -1,4 +1,4 @@
 <h1>Edit user</h1>
-<%= render "form.html", action: Routes.user_path(@conn, :update, @user), changeset: @changeset, new?: false, flash: @flash %>
+<%= render "form.html", action: Routes.user_path(@conn, :update, @user), changeset: @changeset, new?: false, flash: @flash, current_user: @current_user %>
 <br />
 <.link href={Routes.user_path(@conn, :delete, @user)} method="delete" data-confirm="Are you sure?" class="btn btn-danger btn-sm">delete</.link>
diff --git a/lib/mailgun_logger_web/templates/user/form.html.heex b/lib/mailgun_logger_web/templates/user/form.html.heex
index dc048c0..a778ef7 100644
--- a/lib/mailgun_logger_web/templates/user/form.html.heex
+++ b/lib/mailgun_logger_web/templates/user/form.html.heex
@@ -11,6 +11,14 @@
   <.input field={f[:lastname]} label="Lastname" />
   <.input field={f[:email]} label="Email" />
   <.input :if={@new?} field={f[:password]} type="password" label="Password" />
+
+  <.input
+    :if={@current_user.id != @changeset.data.id}
+    field={f[:current_role]}
+    type="select"
+    label="Role"
+    options={[{"Member", "member"}, {"Superuser", "superuser"}, {"Admin", "admin"}]}
+  />
   <.input
     field={f[:theme]}
     type="select"
diff --git a/lib/mailgun_logger_web/templates/user/new.html.heex b/lib/mailgun_logger_web/templates/user/new.html.heex
index 138200d..d436662 100644
--- a/lib/mailgun_logger_web/templates/user/new.html.heex
+++ b/lib/mailgun_logger_web/templates/user/new.html.heex
@@ -1,2 +1,2 @@
 <h1>New user</h1>
-<%= render "form.html", action: Routes.user_path(@conn, :create), changeset: @changeset, flash: @flash, new?: true %>
+<%= render "form.html", action: Routes.user_path(@conn, :create), changeset: @changeset, flash: @flash, new?: true, current_user: @current_user %>
diff --git a/lib/mailgun_logger_web/templates/user/profile.html.heex b/lib/mailgun_logger_web/templates/user/profile.html.heex
index 08a1e49..d0e6f38 100644
--- a/lib/mailgun_logger_web/templates/user/profile.html.heex
+++ b/lib/mailgun_logger_web/templates/user/profile.html.heex
@@ -1,2 +1,2 @@
 <h1>Profile</h1>
-<%= render "form.html", action: Routes.profile_path(@conn, :update), changeset: @changeset, new?: false, flash: @flash %>
+<%= render "form.html", action: Routes.profile_path(@conn, :update), changeset: @changeset, new?: false, flash: @flash, current_user: @current_user  %>

From d338d720bf694e5eb6470df02e61cff84a64b4e0 Mon Sep 17 00:00:00 2001
From: Stefdev13 <stef.bekaert@proton.me>
Date: Thu, 19 Mar 2026 16:24:49 +0100
Subject: [PATCH 3/7] Change to allow multiple roles per user

- Changed current_roles to a map
- Changed select to several checkboxes
- Changed updating logic accordingly
- Changed formatting on roles in user/index.html.heex
- Changed logic for blocking members from special pages (from if role == :member to if role != :superuser or :admin)
---
 lib/mailgun_logger/users/user.ex              | 29 ++++++++++++-------
 .../controllers/user_controller.ex            | 23 +++++++++------
 .../plugs/redirect_member.ex                  |  2 +-
 .../templates/layout/app.html.heex            |  2 +-
 .../templates/user/form.html.heex             | 19 +++++++-----
 .../templates/user/index.html.heex            |  2 +-
 6 files changed, 47 insertions(+), 30 deletions(-)

diff --git a/lib/mailgun_logger/users/user.ex b/lib/mailgun_logger/users/user.ex
index 4af4d61..cb8e230 100644
--- a/lib/mailgun_logger/users/user.ex
+++ b/lib/mailgun_logger/users/user.ex
@@ -36,7 +36,7 @@ defmodule MailgunLogger.User do
     field(:theme, :string, default: "system")
     field(:password, :string, virtual: true)
 
-    field(:current_role, :string, virtual: true)
+    field(:current_roles, :map, virtual: true, default: %{})
 
     many_to_many(:roles, Role, join_through: UserRole, on_replace: :delete)
 
@@ -47,7 +47,7 @@ defmodule MailgunLogger.User do
   @spec changeset(User.t(), map()) :: Ecto.Changeset.t()
   def changeset(%User{} = user, attrs \\ %{}) do
     user
-    |> cast(attrs, [:firstname, :lastname, :email, :password, :theme, :current_role])
+    |> cast(attrs, [:firstname, :lastname, :email, :password, :theme, :current_roles])
     |> validate_required([:email, :password])
     |> update_change(:email, &String.downcase/1)
     |> validate_format(:email, @email_format)
@@ -55,18 +55,18 @@ defmodule MailgunLogger.User do
     |> unique_constraint(:email)
     |> hash_password()
     |> generate_token()
-    |> update_role()
+    |> update_roles()
   end
 
   @doc false
   @spec update_changeset(User.t(), map()) :: Ecto.Changeset.t()
   def update_changeset(%User{} = user, attrs \\ %{}) do
     user
-    |> cast(attrs, [:firstname, :lastname, :email, :theme, :current_role])
+    |> cast(attrs, [:firstname, :lastname, :email, :theme, :current_roles])
     |> update_change(:email, &String.downcase/1)
     |> validate_format(:email, @email_format)
     |> unique_constraint(:email)
-    |> update_role()
+    |> update_roles()
   end
 
   @doc "Used when creating an admin, e.g. from the setup flow"
@@ -113,12 +113,19 @@ defmodule MailgunLogger.User do
     put_change(changeset, :token, token)
   end
 
-  defp update_role(%Ecto.Changeset{} = changeset) do
-    case get_change(changeset, :current_role) do
-      nil  -> changeset
-      role_name ->
-        role = Roles.get_role_by_name(role_name)
-        put_assoc(changeset, :roles, [role])
+  defp update_roles(%Ecto.Changeset{} = changeset) do
+    case get_change(changeset, :current_roles) do
+      nil ->
+        changeset
+
+      roles_map when is_map(roles_map) ->
+        roles =
+          roles_map
+          |> Enum.filter(fn {_name, checked} -> checked == "true" or checked == true end)
+          |> Enum.map(fn {name, _} -> Roles.get_role_by_name(to_string(name)) end)
+          |> Enum.reject(&is_nil/1)
+
+        put_assoc(changeset, :roles, roles)
     end
   end
 
diff --git a/lib/mailgun_logger_web/controllers/user_controller.ex b/lib/mailgun_logger_web/controllers/user_controller.ex
index ac836d5..b3d591d 100644
--- a/lib/mailgun_logger_web/controllers/user_controller.ex
+++ b/lib/mailgun_logger_web/controllers/user_controller.ex
@@ -10,7 +10,8 @@ defmodule MailgunLoggerWeb.UserController do
   end
 
   def new(conn, _) do
-    changeset = User.changeset(%User{})
+    user = %User{current_roles: create_current_roles_map([])}
+    changeset = User.changeset(user)
     render(conn, :new, changeset: changeset)
   end
 
@@ -24,14 +25,8 @@ defmodule MailgunLoggerWeb.UserController do
   def edit(conn, %{"id" => id}) do
     user = Users.get_user!(id)
 
-    # Set the users current role so we can edit it.
-    current_role =
-      case List.first(user.roles) do
-        nil -> nil
-        role -> role.name
-      end
-
-    user = %{user | current_role: current_role}
+    # Add the current roles to the user
+    user = %{user | current_roles: create_current_roles_map(user.roles)}
 
     changeset = User.update_changeset(user)
 
@@ -60,4 +55,14 @@ defmodule MailgunLoggerWeb.UserController do
     |> put_flash(:info, "user deleted successfully.")
     |> redirect(to: Routes.user_path(conn, :index))
   end
+
+  defp create_current_roles_map(roles) do
+    # Iterate over the roles in the app and try to find them in the users roles, so we can set them to true or false
+    Enum.map([:member, :superuser, :admin], fn role ->
+        has_role =
+          Enum.any?(roles, fn r -> r.name == Atom.to_string(role) end)
+
+        {role, has_role}
+      end)
+  end
 end
diff --git a/lib/mailgun_logger_web/plugs/redirect_member.ex b/lib/mailgun_logger_web/plugs/redirect_member.ex
index 618c8e1..13e6ea8 100644
--- a/lib/mailgun_logger_web/plugs/redirect_member.ex
+++ b/lib/mailgun_logger_web/plugs/redirect_member.ex
@@ -11,7 +11,7 @@ defmodule MailgunLoggerWeb.Plugs.RedirectMember do
   def call(conn, _opts) do
     case conn.assigns[:current_user] do
       %User{} = user ->
-        if Roles.is?(user, :member) do
+        unless Roles.is?(user, :admin) or Roles.is?(user, :superuser) do
           conn
           |> redirect(to: Routes.event_path(conn, :index))
           |> halt()
diff --git a/lib/mailgun_logger_web/templates/layout/app.html.heex b/lib/mailgun_logger_web/templates/layout/app.html.heex
index 3c246e7..36a241f 100644
--- a/lib/mailgun_logger_web/templates/layout/app.html.heex
+++ b/lib/mailgun_logger_web/templates/layout/app.html.heex
@@ -39,7 +39,7 @@
           <ul>
             <%= if assigns[:current_user] do %>
               <li><.link href={Routes.event_path(@conn, :index)} class={active_link_class(@conn, MailgunLoggerWeb.EventController)}>Events</.link></li>
-              <%= if not MailgunLogger.Roles.is?(@current_user, :member) do %>
+              <%= if MailgunLogger.Roles.is?(@current_user, :superuser ) or MailgunLogger.Roles.is?(@current_user, :admin ) do %>
                 <li><.link href={Routes.page_path(@conn, :stats)} class={active_link_class(@conn, MailgunLoggerWeb.PageController, :index)}>Stats</.link></li>
                 <li><.link href={Routes.account_path(@conn, :index)} class={active_link_class(@conn, MailgunLoggerWeb.AccountController, :index)}>Accounts</.link></li>
                 <li><.link href={Routes.user_path(@conn, :index)} class={active_link_class(@conn, MailgunLoggerWeb.UserController, :index)}>Users</.link></li>
diff --git a/lib/mailgun_logger_web/templates/user/form.html.heex b/lib/mailgun_logger_web/templates/user/form.html.heex
index a778ef7..a956cfe 100644
--- a/lib/mailgun_logger_web/templates/user/form.html.heex
+++ b/lib/mailgun_logger_web/templates/user/form.html.heex
@@ -12,13 +12,18 @@
   <.input field={f[:email]} label="Email" />
   <.input :if={@new?} field={f[:password]} type="password" label="Password" />
 
-  <.input
-    :if={@current_user.id != @changeset.data.id}
-    field={f[:current_role]}
-    type="select"
-    label="Role"
-    options={[{"Member", "member"}, {"Superuser", "superuser"}, {"Admin", "admin"}]}
-  />
+  <div :if={@current_user.id != @changeset.data.id}>
+    <label>Roles</label>
+    <div style="margin-bottom: 1em; display: flex; gap: 2em; align-items: center;">
+      <%= for {role, checked} <- f[:current_roles].value || %{} do %>
+        <label style="display: flex; align-items: center; gap: 0.25em; margin-bottom: 0;">
+          <input type="hidden" name={"user[current_roles][#{role}]"} value="false" />
+          <input type="checkbox" name={"user[current_roles][#{role}]"} value="true" checked={checked} />
+          {Phoenix.Naming.humanize(role)}
+        </label>
+      <% end %>
+    </div>
+  </div>
   <.input
     field={f[:theme]}
     type="select"
diff --git a/lib/mailgun_logger_web/templates/user/index.html.heex b/lib/mailgun_logger_web/templates/user/index.html.heex
index fe2570c..f94a6f3 100644
--- a/lib/mailgun_logger_web/templates/user/index.html.heex
+++ b/lib/mailgun_logger_web/templates/user/index.html.heex
@@ -14,7 +14,7 @@
     <tr>
       <td><%= "#{user.firstname || ""} #{user.lastname || ""}" |> String.trim() %></td>
       <td><%= user.email %></td>
-      <td><%= Enum.map(user.roles, & &1.name) %></td>
+      <td><%= Enum.map_join(user.roles, ", ", & &1.name) %></td>
       <td><.link href={Routes.user_path(@conn, :edit, user)}>edit</.link></td>
     </tr>
     <% end %>

From 805fb6e06c912eb381082fa2869d8063ee5dcde7 Mon Sep 17 00:00:00 2001
From: Stefdev13 <stef.bekaert@proton.me>
Date: Thu, 19 Mar 2026 23:51:04 +0100
Subject: [PATCH 4/7] Member in seeder + role updating check on route

- Added the member role to the seeder
- Added blocking of updating your own roles in the update route on the user_controller
---
 lib/mailgun_logger/seeder.ex                          |  2 +-
 lib/mailgun_logger_web/controllers/user_controller.ex | 11 ++++++++++-
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/lib/mailgun_logger/seeder.ex b/lib/mailgun_logger/seeder.ex
index 6fe0588..d2d25f4 100644
--- a/lib/mailgun_logger/seeder.ex
+++ b/lib/mailgun_logger/seeder.ex
@@ -6,7 +6,7 @@ defmodule MailgunLogger.Seeder do
 
   # alias MailgunLogger.UserRole
 
-  @roles [%Role{name: "superuser"}, %Role{name: "admin"}]
+  @roles [%Role{name: "superuser"}, %Role{name: "admin"}, %Role{name: "member"}]
 
   def run do
     Enum.each(@roles, &insert_if_new(&1))
diff --git a/lib/mailgun_logger_web/controllers/user_controller.ex b/lib/mailgun_logger_web/controllers/user_controller.ex
index b3d591d..52a3e32 100644
--- a/lib/mailgun_logger_web/controllers/user_controller.ex
+++ b/lib/mailgun_logger_web/controllers/user_controller.ex
@@ -36,7 +36,16 @@ defmodule MailgunLoggerWeb.UserController do
   def update(conn, %{"id" => id, "user" => params}) do
     user = Users.get_user!(id)
 
-    case Users.update_user(user, params) do
+    current_user = conn.assigns.current_user
+    effective_params =
+      if current_user.id == user.id do
+        # Prevent self role changes, even for forged requests
+        Map.delete(params, "current_roles")
+      else
+        params
+      end
+
+    case Users.update_user(user, effective_params) do
       {:ok, _} ->
         redirect(conn, to: Routes.user_path(conn, :index))
 

From 1529dd211bfdba5b022a624820364f25cc3a13da Mon Sep 17 00:00:00 2001
From: Stefdev13 <stef.bekaert@proton.me>
Date: Fri, 20 Mar 2026 00:23:14 +0100
Subject: [PATCH 5/7] Added tests

- Created a conn_case file
- Created 4 tests:
   - Admin kan rollen van andere users aanpassen
   - Superuser kan rollen van andere users aanpassen
   - Admin kan eigen rollen niet aanpassen
   - Superuser kan eigen rollen niet aanpassen
Most of the code for these tests was generated by cursor with me orchestrating, testing and fixing it where it went wrong.
---
 .../controllers/user_controller_test.exs      | 129 ++++++++++++++++++
 test/support/conn_case.ex                     |  29 ++++
 2 files changed, 158 insertions(+)
 create mode 100644 test/lib/mailgun_logger_web/controllers/user_controller_test.exs
 create mode 100644 test/support/conn_case.ex

diff --git a/test/lib/mailgun_logger_web/controllers/user_controller_test.exs b/test/lib/mailgun_logger_web/controllers/user_controller_test.exs
new file mode 100644
index 0000000..3037fcd
--- /dev/null
+++ b/test/lib/mailgun_logger_web/controllers/user_controller_test.exs
@@ -0,0 +1,129 @@
+defmodule MailgunLoggerWeb.UserControllerTest do
+  use MailgunLoggerWeb.ConnCase
+
+  alias MailgunLogger.{Repo, Role, User, Users}
+
+  setup do
+    ensure_role!("admin")
+    ensure_role!("superuser")
+    ensure_role!("member")
+    :ok
+  end
+
+  test "admin can edit another user's roles", %{conn: conn} do
+    admin = user_with_roles(["admin"])
+    target = user_with_roles(["member"])
+
+    conn = login(conn, admin)
+
+    params = %{
+      "firstname" => "Updated",
+      "current_roles" => %{
+        "member" => "false",
+        "admin" => "true",
+        "superuser" => "false"
+      }
+    }
+    conn = put(conn, Routes.user_path(conn, :update, target.id), %{"user" => params})
+
+    assert redirected_to(conn) == Routes.user_path(conn, :index)
+
+    updated = reload_user!(target.id)
+    assert role_names(updated) == ["admin"]
+    assert updated.firstname == "Updated"
+  end
+
+  test "superuser can edit another user's roles", %{conn: conn} do
+    superuser = user_with_roles(["superuser"])
+    target = user_with_roles(["member"])
+
+    conn = login(conn, superuser)
+
+    params = %{
+      "firstname" => "Updated",
+      "current_roles" => %{
+        "member" => "false",
+        "admin" => "true",
+        "superuser" => "false"
+      }
+    }
+    conn = put(conn, Routes.user_path(conn, :update, target.id), %{"user" => params})
+
+    assert redirected_to(conn) == Routes.user_path(conn, :index)
+
+    updated = reload_user!(target.id)
+    assert role_names(updated) == ["admin"]
+    assert updated.firstname == "Updated"
+  end
+
+  test "admin cannot edit own roles", %{conn: conn} do
+    admin = user_with_roles(["admin"])
+
+    conn = login(conn, admin)
+
+    params = %{
+      "firstname" => "Updated",
+      "current_roles" => %{
+        "member" => "true",
+        "admin" => "false",
+        "superuser" => "false"
+      }
+    }
+    conn = put(conn, Routes.user_path(conn, :update, admin.id), %{"user" => params})
+
+    assert redirected_to(conn) == Routes.user_path(conn, :index)
+
+    updated = reload_user!(admin.id)
+    assert role_names(updated) == ["admin"]
+    assert role_names(updated) != ["member"]
+    assert updated.firstname == "Updated"
+  end
+
+  test "superuser cannot edit own roles", %{conn: conn} do
+    superuser = user_with_roles(["superuser"])
+
+    conn = login(conn, superuser)
+
+    params = %{
+      "firstname" => "Updated",
+      "current_roles" => %{
+        "member" => "true",
+        "admin" => "false",
+        "superuser" => "false"
+      }
+    }
+    conn = put(conn, Routes.user_path(conn, :update, superuser.id), %{"user" => params})
+
+    assert redirected_to(conn) == Routes.user_path(conn, :index)
+
+    updated = reload_user!(superuser.id)
+    assert role_names(updated) == ["superuser"]
+    assert role_names(updated) != ["member"]
+    assert updated.firstname == "Updated"
+  end
+
+
+  # --- helpers ---
+  defp login(conn, %User{id: id}) do
+    conn
+    |> init_test_session(%{})
+    |> put_session(:current_user_id, id)
+  end
+
+  defp user_with_roles(role_names) do
+    user = insert(:user)
+    roles = Enum.map(role_names, &ensure_role!/1)
+    user
+    |> Ecto.Changeset.change()
+    |> Ecto.Changeset.put_assoc(:roles, roles)
+    |> Repo.update!()
+  end
+
+  defp ensure_role!(name) do
+    Repo.get_by(Role, name: name) || Repo.insert!(%Role{name: name})
+  end
+
+  defp reload_user!(id), do: Users.get_user!(id)
+
+  defp role_names(user), do: user.roles |> Enum.map(& &1.name) |> Enum.sort()
+end
diff --git a/test/support/conn_case.ex b/test/support/conn_case.ex
new file mode 100644
index 0000000..ae84eef
--- /dev/null
+++ b/test/support/conn_case.ex
@@ -0,0 +1,29 @@
+defmodule MailgunLoggerWeb.ConnCase do
+  @moduledoc """
+  This module defines the test case to be used by tests
+  that require setting up a connection.
+  Such tests rely on `Phoenix.ConnTest` and also import
+  other functionality to make it easier to build common
+  data structures and query the data layer.
+  """
+  use ExUnit.CaseTemplate
+  using do
+    quote do
+      # The default endpoint for testing
+      @endpoint MailgunLoggerWeb.Endpoint
+      import Plug.Conn
+      import Phoenix.ConnTest
+      import MailgunLogger.Factory
+      import MailgunLogger.DataCase
+      alias MailgunLogger.Repo
+      alias MailgunLoggerWeb.Router.Helpers, as: Routes
+    end
+  end
+  setup tags do
+    :ok = Ecto.Adapters.SQL.Sandbox.checkout(MailgunLogger.Repo)
+    unless tags[:async] do
+      Ecto.Adapters.SQL.Sandbox.mode(MailgunLogger.Repo, {:shared, self()})
+    end
+    {:ok, conn: Phoenix.ConnTest.build_conn()}
+  end
+end

From 37a0e294c07c743c9a085cc5de3392e4c863fbd9 Mon Sep 17 00:00:00 2001
From: Stefdev13 <stef.bekaert@proton.me>
Date: Fri, 20 Mar 2026 00:27:30 +0100
Subject: [PATCH 6/7] Added architecture.md file

This file was generated at the start of working on the case for me to get an understanding of the codebase
---
 ARCHITECTURE.md | 360 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 360 insertions(+)
 create mode 100644 ARCHITECTURE.md

diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
new file mode 100644
index 0000000..5da6e68
--- /dev/null
+++ b/ARCHITECTURE.md
@@ -0,0 +1,360 @@
+## Mailgun Logger – Architecture Overview
+
+This document gives a high‑level overview of how the Mailgun Logger codebase is structured and how HTTP requests flow through it. It is written for developers who are **new to Elixir and Phoenix** but familiar with typical MVC / web application concepts.
+
+---
+
+## Big picture
+
+- **Goal**: Periodically pull email event data from Mailgun and store it in PostgreSQL, then provide a small web UI to browse/search those events and some basic statistics.
+- **Tech stack**:
+  - Elixir / OTP application
+  - Phoenix 1.8 for the web layer (router, controllers, views/templates, components)
+  - Ecto for database access (PostgreSQL)
+  - Quantum scheduler for background jobs (in non‑dev/test environments)
+  - ExAws for optional raw message storage in S3
+
+At runtime, the application is an **OTP supervision tree**:
+
+- `MailgunLogger.Application` (top‑level OTP application)
+  - `MailgunLogger.Repo` – database connection pool
+  - `MailgunLoggerWeb.Endpoint` – HTTP server entrypoint (Plug/Cowboy)
+  - `MailgunLogger.Scheduler` – background scheduler (only in non‑dev/test)
+
+---
+
+## Project layout
+
+- `lib/mailgun_logger/…` – **domain / business logic** (contexts, schemas, scheduler, mailer).
+- `lib/mailgun_logger_web/…` – **web interface** (endpoint, router, plugs, controllers, views, templates, UI components).
+- `priv/repo/…` – database migrations and seeds.
+- `priv/static/…` – compiled frontend assets (JS/CSS/images).
+- `config/*.exs` – environment‑specific configuration (HTTP port, HTTPS certs, DB connection, etc.).
+
+You can think of `lib/mailgun_logger` as “model & services” and `lib/mailgun_logger_web` as “MVC web layer” in more traditional terms.
+
+---
+
+## Startup & supervision
+
+### `MailgunLogger.Application`
+
+- Defined in `lib/mailgun_logger/application.ex`.
+- Implements `start/2`, which:
+  - Optionally validates configuration for S3 raw message storage.
+  - Starts a supervision tree with:
+    - `MailgunLogger.PubSub` – Phoenix PubSub instance.
+    - `MailgunLogger.Repo` – Ecto repo for Postgres.
+    - `MailgunLoggerWeb.Endpoint` – HTTP endpoint.
+    - `MailgunLogger.Scheduler` – **only** when `:env` is not `:dev` or `:test`.
+- Implements `config_change/3` so the endpoint can be reconfigured on upgrades.
+
+### `MailgunLogger.Repo`
+
+- Standard Ecto repo module (see `lib/mailgun_logger/repo.ex`).
+- Handles DB connections, queries, and transactions for all contexts.
+
+---
+
+## Web entrypoint: Endpoint, Router, Plugs
+
+### Endpoint – `MailgunLoggerWeb.Endpoint`
+
+Location: `lib/mailgun_logger_web/endpoint.ex`
+
+- This is the **top‑level HTTP interface**:
+  - Starts the WebSocket endpoint for LiveView at `/live`.
+  - Serves static assets from `priv/static` at `/`.
+  - In dev, enables live code reloading.
+  - Sets up standard plugs:
+    - `Plug.Parsers` for URL‑encoded, multipart, and JSON request bodies.
+    - `Plug.MethodOverride` / `Plug.Head`.
+    - `Plug.Session` for signed cookie sessions.
+  - Finally **delegates all remaining requests** to `MailgunLoggerWeb.Router`:
+
+    ```elixir
+    plug(MailgunLoggerWeb.Router)
+    ```
+
+You can think of the endpoint as “Express + middleware setup” in Node terms.
+
+### Router – `MailgunLoggerWeb.Router`
+
+Location: `lib/mailgun_logger_web/router.ex`
+
+- Declares **pipelines** and **routes**.
+- Pipelines are reusable chains of plugs (middleware) applied to groups of routes.
+
+#### Pipelines
+
+- `:browser`
+  - Accept `html`.
+  - Fetch session and LiveView flash.
+  - Set the default layout (`MailgunLoggerWeb.LayoutView, :app`).
+  - CSRF protection and secure browser headers.
+  - `Plug.Logger` for request logging.
+- `:ping`
+  - Minimal pipeline for health checks:
+    - Accept `html`.
+    - Secure browser headers.
+- `:auth`
+  - `MailgunLoggerWeb.Plugs.SetupCheck` – ensures the app has been initially configured (root user/account).
+  - `MailgunLoggerWeb.Plugs.Auth` – enforces authentication and loads current user.
+- `:redirect_member`
+  - `MailgunLoggerWeb.Plugs.RedirectMember` – redirects non‑admin users away from admin‑only routes.
+
+#### Routes / scopes (high level)
+
+- `/ping` and `/health`
+  - Pipelines: `:ping`
+  - Controller: `PingController.ping/2`
+  - Used for uptime/health checks.
+
+- `/login`
+  - Pipeline: `:browser`
+  - `AuthController`:
+    - `new` – login form.
+    - `create` – authenticate and start a session.
+
+- `/password-reset/...`
+  - Pipeline: `:browser`
+  - `PasswordResetController`:
+    - Request a reset email, show success/error pages, handle reset token flows.
+
+- `/setup`
+  - Pipeline: `:browser`
+  - `SetupController`:
+    - Initial installation flow to create the first/root account and user.
+
+- Authenticated user scope (`/`)
+  - Pipelines: `:browser`, `:auth`
+  - `AuthController.logout/2`
+  - `EventController` – listing and viewing events, viewing stored raw message HTML.
+  - `ProfileController` – edit/update the current user’s profile.
+  - `PageController` – dashboard, trigger a manual fetch run, graphs, non‑affiliation page.
+
+- Admin scope (`/` with extra plug)
+  - Pipelines: `:browser`, `:auth`, `:redirect_member`
+  - `UserController` – manage users (CRUD minus `show`).
+  - `AccountController` – manage Mailgun accounts/configurations.
+  - `PageController.stats/2` – higher‑level stats page.
+
+**Router summary**: It maps URL paths to controller actions and decides which authentication/authorization plugs run before a given controller.
+
+### Plugs
+
+Location: `lib/mailgun_logger_web/plugs/*.ex`
+
+- **`SetupCheck`**
+  - Runs on authenticated routes.
+  - Checks if initial setup (root user/account) is complete.
+  - If not, redirects the user to the `/setup` flow.
+
+- **`Auth`**
+  - Handles authentication:
+    - Looks at session/cookies.
+    - Redirects to `/login` if the user is not authenticated.
+  - Typically assigns `current_user` into the connection for controllers/views.
+
+- **`RedirectMember`**
+  - Authorization plug for admin‑only routes.
+  - If the current user is only a “member” (no admin/superuser role), they are redirected away from admin sections.
+
+Plugs are conceptually similar to middleware in other web frameworks: they receive the request/response and can transform or short‑circuit it.
+
+---
+
+## Controllers, views and templates
+
+Phoenix uses **controllers + views + templates** in a pattern that should feel familiar to MVC developers:
+
+- **Controller**: orchestrates a request: fetches data from contexts, decides which template to render or where to redirect.
+- **View**: presentation helpers / rendering logic for a given resource/domain.
+- **Template (`.heex`)**: HTML with embedded Elixir (server‑rendered).
+
+### Key controllers
+
+All controllers live under `lib/mailgun_logger_web/controllers/`.
+
+- **`PageController`**
+  - General pages:
+    - Dashboard / index.
+    - Triggering a manual Mailgun fetch run.
+    - Graphs/statistics view.
+    - Non‑affiliation info page.
+
+- **`EventController`**
+  - Works with the `MailgunLogger.Events` context.
+  - Actions:
+    - `index` – list events with filters and pagination via Flop.
+      - Loads all accounts via `Accounts.list_accounts/0`.
+      - Calls `Events.search_events/2` and passes results + metadata to the `:index` template.
+    - `show` – show a single event, preloading its associated account.
+    - `stored_message` – if an event has a stored raw message (in S3), fetch and display it as HTML in a stripped‑down layout.
+
+- **`AccountController`**
+  - Manages Mailgun accounts/config (domain, API key, etc.).
+  - Uses the `MailgunLogger.Accounts` context.
+
+- **`UserController`**
+  - Admin‑side user management (create/edit/delete users).
+  - Uses the `MailgunLogger.Users` context.
+
+- **`ProfileController`**
+  - Lets the **current authenticated user** edit their own profile.
+
+- **`AuthController`**
+  - Session management / login/logout.
+
+- **`PasswordResetController`**
+  - Handles password reset request and token‑based reset flows.
+  - Uses email sending (via `MailgunLogger.Mailer` / Bamboo) for reset emails.
+
+- **`SetupController`**
+  - First‑time setup for the app: create initial root user and account.
+
+- **`PingController`**
+  - Simple health check endpoint used for `/ping` and `/health`.
+
+### Views and templates
+
+- Views live in `lib/mailgun_logger_web/views/*_view.ex`.
+- Templates live in `lib/mailgun_logger_web/templates/**.html.heex`.
+- Layouts:
+  - `LayoutView` and templates under `templates/layout/` (e.g. `app.html.heex`, `setup.html.heex`).
+  - The router’s `:browser` pipeline wires `app.html.heex` as default layout.
+
+For example, the events UI is composed of:
+
+- Controller: `MailgunLoggerWeb.EventController`
+- View: `MailgunLoggerWeb.EventView`
+- Templates: `templates/event/index.html.heex`, `templates/event/show.html.heex`, `templates/event/stored_message.html.heex`
+
+### Components and helpers
+
+- `lib/mailgun_logger_web/components/core_components.ex`
+  - Reusable UI components (buttons, forms, tables, etc.), written for Phoenix 1.8.
+- `lib/mailgun_logger_web/components/flop.ex`
+  - Components/helpers for pagination and filtering using Flop.
+- `lib/mailgun_logger_web/helpers/view_helpers.ex`
+  - Miscellaneous presentation helpers used from templates.
+
+---
+
+## Domain / data layer (contexts & schemas)
+
+The non‑web logic lives in `lib/mailgun_logger/` and is split into **contexts** (service‑style modules) and **schemas** (Ecto models).
+
+### Schemas
+
+Some important schemas (in `lib/mailgun_logger/**.ex`):
+
+- `MailgunLogger.Event`
+  - Represents a single Mailgun event (accepted, delivered, failed, clicked, opened, stored, …).
+  - Stores metadata such as timestamp, recipient, subject, message ID, log level, and the raw event payload.
+
+- `MailgunLogger.Account`
+  - Represents a Mailgun account configuration (domain, API key, etc.).
+
+- `MailgunLogger.User`
+  - Represents an application user (email, password hash, roles, etc.).
+
+- `MailgunLogger.Role` and `MailgunLogger.UserRole`
+  - Basic role/permission modeling (admin, superuser, member).
+
+### Contexts
+
+Contexts encapsulate queries and domain logic; controllers call contexts rather than working with `Repo` directly.
+
+- **`MailgunLogger.Events`**
+  - Searching and listing events with filtering/pagination (via Flop).
+  - Loading a single event and its “linked” events (sharing the same message ID).
+  - Persisting raw events fetched from Mailgun (`save_events/2`):
+    - Transforms raw JSON from Mailgun into schema attributes.
+    - Uses `Ecto.Multi` to batch‑insert with `on_conflict: :nothing` to avoid duplicates.
+  - Computing statistics over the last N hours (`get_stats/1`) for graphing.
+  - Managing the `has_stored_message` flag when raw messages are stored externally.
+
+- **`MailgunLogger.Accounts`**
+  - Listing, creating, updating, and deleting accounts.
+
+- **`MailgunLogger.Users`**
+  - User CRUD and authentication‑related logic (password hashing via Argon2, etc.).
+
+- **`MailgunLogger.Roles`**
+  - Helpers around roles and authorizations.
+
+- **`MailgunLogger.Emails`**
+  - High‑level API for sending emails (e.g. password reset email content).
+
+- **`MailgunLogger.Mailer`**
+  - Bamboo mailer module used by `Emails` to actually send messages.
+
+- **`MailgunLogger.Scheduler`**
+  - Quantum scheduler module that defines periodic jobs:
+    - Regularly calling the Mailgun API.
+    - Using contexts to persist new events.
+
+- **`MailgunLogger.Seeder`**
+  - Helpers for database seeding (e.g. creating default roles/admin user).
+
+---
+
+## External integrations
+
+- **Mailgun API**
+  - Accessed via modules under `lib/mailgun/` (separate from `MailgunLogger.*` namespaces).
+  - Responsible for:
+    - Fetching events from the Mailgun Events API.
+    - Optionally fetching raw message contents for stored messages.
+
+- **PostgreSQL**
+  - Used via `MailgunLogger.Repo` and Ecto schemas.
+  - Migrations define tables and indexes (see `priv/repo/migrations`).
+
+- **AWS S3 (optional)**
+  - If `store_messages` is enabled and ExAws is configured:
+    - Raw message bodies are stored in S3 rather than the DB.
+    - The events table keeps metadata, and UI can load the stored raw message on demand.
+
+---
+
+## Request lifecycle (end‑to‑end)
+
+Below is a simplified sequence for a typical authenticated web request, e.g. “view events list”:
+
+1. **TCP/HTTP** request comes in on the configured port (dev: HTTPS on port 7070).
+2. `MailgunLoggerWeb.Endpoint` receives it and runs global plugs:
+   - Static asset check (for `/assets/...`).
+   - Body parsing, method override, session handling, etc.
+3. The request is **forwarded to `MailgunLoggerWeb.Router`**.
+4. The router matches the path to a route, e.g. `GET /events`:
+   - Applies the `:browser` and `:auth` pipelines:
+     - Session & flash.
+     - CSRF protection.
+     - Loads current user (Auth plug).
+   - Optional authorization via `:redirect_member` for admin‑only routes.
+5. The matched controller action runs, e.g. `EventController.index/2`:
+   - Calls the appropriate **context functions** (`Events.search_events/2`, `Accounts.list_accounts/0`).
+   - Decides which template to render (or where to redirect).
+6. The controller calls `render/3`:
+   - Phoenix chooses the corresponding **view** (`EventView`) and **template** (`templates/event/index.html.heex`).
+   - View helpers and components are used to build the final HTML.
+7. The rendered HTML is sent back via the endpoint to the client.
+
+Other flows (login, password reset, admin management) follow the same pattern but talk to different contexts and render different templates.
+
+---
+
+## How to explore further
+
+If you are new to Elixir/Phoenix and want to understand more:
+
+- Start with the **router**: `lib/mailgun_logger_web/router.ex`
+  - This tells you which URLs exist and which controllers handle them.
+- For any controller action, follow its call into a **context** in `lib/mailgun_logger/`.
+- Look at the **view** and `.heex` template with the same name to see what gets rendered.
+- Check `config/dev.exs` for how the dev server is configured (HTTPS certs, port 7070, etc.).
+
+With that path (router → controller → context → view/template), you can usually trace any request or feature in this application.
+

From 2ea73f93dfb7e49121d950837811b325f7d50d2c Mon Sep 17 00:00:00 2001
From: Stefdev13 <stef.bekaert@proton.me>
Date: Fri, 20 Mar 2026 00:41:51 +0100
Subject: [PATCH 7/7] Fix from code review

Ran a code review in cursor and fixed an non-breaking issue it flagged.
---
 lib/mailgun_logger_web/controllers/user_controller.ex | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/mailgun_logger_web/controllers/user_controller.ex b/lib/mailgun_logger_web/controllers/user_controller.ex
index 52a3e32..4cf44b7 100644
--- a/lib/mailgun_logger_web/controllers/user_controller.ex
+++ b/lib/mailgun_logger_web/controllers/user_controller.ex
@@ -67,7 +67,7 @@ defmodule MailgunLoggerWeb.UserController do
 
   defp create_current_roles_map(roles) do
     # Iterate over the roles in the app and try to find them in the users roles, so we can set them to true or false
-    Enum.map([:member, :superuser, :admin], fn role ->
+    Enum.into([:member, :superuser, :admin], %{}, fn role ->
         has_role =
           Enum.any?(roles, fn r -> r.name == Atom.to_string(role) end)