Skip to content

Permissions: Only check for document permissions when verifying entity actions for a document (closes #20097) #20127

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
+27 −22
Open

Permissions: Only check for document permissions when verifying entity actions for a document (closes #20097) #20127

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
18f3f82
Only check for document permissions when verifying entity actions for…
AndyButland Sep 11, 2025
01fce5c
Extracted method.
AndyButland Sep 11, 2025
c794f55
Fixed self import.
AndyButland Sep 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 27 additions & 22 deletions ...ents/documents/user-permissions/document/conditions/document-user-permission.condition.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ import type { UmbConditionControllerArguments, UmbExtensionCondition } from '@um
import type { UmbControllerHost } from '@umbraco-cms/backoffice/controller-api';
import type { DocumentPermissionPresentationModel } from '@umbraco-cms/backoffice/external/backend-api';
import { UmbConditionBase } from '@umbraco-cms/backoffice/extension-registry';
import { UMB_DOCUMENT_ENTITY_TYPE } from '../../../entity.js';

export class UmbDocumentUserPermissionCondition
extends UmbConditionBase<UmbDocumentUserPermissionConditionConfig>
Expand Down Expand Up @@ -69,38 +70,42 @@ export class UmbDocumentUserPermissionCondition
if (!this.#entityType) return;
if (this.#unique === undefined) return;

const hasDocumentPermissions = this.#documentPermissions.length > 0;
const hasDocumentPermissions = this.#isDocumentWithPermissions();

// if there is no permissions for any documents we use the fallback permissions
// If there are no permissions for any documents we use the fallback permissions
if (!hasDocumentPermissions) {
this.#check(this.#fallbackPermissions);
return;
}

// If there are document permissions, we need to check the full path to see if any permissions are defined for the current document
// If we find multiple permissions in the same path, we will apply the closest one
if (hasDocumentPermissions) {
// Path including the current document and all ancestors
const path = [...this.#ancestors, this.#unique].filter((unique) => unique !== null);
// Reverse the path to find the closest document permission quickly
const reversedPath = [...path].reverse();
const documentPermissionsMap = new Map(this.#documentPermissions.map((p) => [p.document.id, p]));

// Find the closest document permission in the path
const closestDocumentPermission = reversedPath.find((id) => documentPermissionsMap.has(id));

// Retrieve the corresponding permission data
const match = closestDocumentPermission ? documentPermissionsMap.get(closestDocumentPermission) : undefined;

// no permissions for the current document - use the fallback permissions
if (!match) {
this.#check(this.#fallbackPermissions);
return;
}

// we found permissions - check them
this.#check(match.verbs);
// Path including the current document and all ancestors
const path = [...this.#ancestors, this.#unique].filter((unique) => unique !== null);

// Reverse the path to find the closest document permission quickly
const reversedPath = [...path].reverse();
const documentPermissionsMap = new Map(this.#documentPermissions.map((p) => [p.document.id, p]));

// Find the closest document permission in the path
const closestDocumentPermission = reversedPath.find((id) => documentPermissionsMap.has(id));

// Retrieve the corresponding permission data
const match = closestDocumentPermission ? documentPermissionsMap.get(closestDocumentPermission) : undefined;

// No permissions for the current document - use the fallback permissions
if (!match) {
this.#check(this.#fallbackPermissions);
return;
}

// We found permissions - check them
this.#check(match.verbs);
}

#isDocumentWithPermissions() {
return this.#entityType === UMB_DOCUMENT_ENTITY_TYPE && this.#documentPermissions.length > 0;
}

#check(verbs: Array<string>) {
Expand Down
Loading