feat(permissions): Added member role & permissions

[JuanEstebanPradaEspinosa]

Propose changes

• Plug pipeline authorize added for every request check permissions by controller

• Added member role + seeder

• Defined a tiered permission hierarchy with roles:

• member — view_event, view_stats, view_graphs, view_profile

• admin — all member actions + trigger_run, view_users, edit_user, create_user, delete_user

• superuser — all admin actions (reserved for future superuser-only operations)

• Permissions are enforced at two layers: - Define guards action permissions

  1. Gate layer — the Authorize plug reads @action_permissions from each controller at runtime and denies access via Roles.can?/2 before the action runs.
  2. Resource layer — inline private guards in UserController handle fine-grained rules that the plug can't express.
  • can_manage?/2 — only users can manage other users if it has permissions for it.
  • sanitize_role_params/2 — the current user cannot grant roles to users that doesn't have the specific permission for it

• Added a role_ids virtual field to the User schema and a role <select> dropdown on the New User and Edit User forms.

• Extended User.changeset/2 and User.update_changeset/2 with put_roles_if_present/2 to resolve role_id → put_assoc(:roles, ...).

• Three inline safety guards in UserController:

  • changing_own_role?/3 — prevents users from changing their own role.
  • demoting_last_superuser?/2 — prevents removing the last superuser from the system.

Task 1:

• Permissions for member is looking at the events + details on \events pages && Profile changes on /Profile
• (Not: stats, Accounts, Users) interface & router off limits
• Update seeds to add the member role in database to use in the application

Task 2:

• Admin and superuser roles need to have the permissions to edit user & create user
• can add 1 or multiple roles to a user
• An user cannot downgrade himself!
• Write an unit test (Phoenix/ExUnit) for these task and permissions

[JuanEstebanPradaEspinosa]

Pushing this up as promised for end of week! The feature work is in place! Permission, roles, permissions on create/edit and some safety guards. Tests exist, but I'd like to do one more integration pass Monday morning before making it my final answer. Hope that's okay.

Happy Mother's Day to those celebrating!