mend

Issue 52: Add access control to set preview operation for unpublished entities.
donquixote · Nov 21, 2024 · cfb3089 · cfb3089
1 parent 012031f
commit cfb3089
Show file tree

Hide file tree

Showing 3 changed files with 7 additions and 10 deletions.
diff --git a/modules/collabora_online_group/src/Plugin/Group/RelationHandler/CollaboraAccessControl.php b/modules/collabora_online_group/src/Plugin/Group/RelationHandler/CollaboraAccessControl.php
@@ -9,14 +9,14 @@
 use Drupal\group\Plugin\Group\RelationHandlerDefault\AccessControl;
 
 /**
- * Provides access control for group relations.
+ * Provides access control for collabora group.
  */
 class CollaboraAccessControl extends AccessControl {
 
   use AccessControlTrait;
 
   /**
-   * Constructs a new GroupMediaPermissionProvider.
+   * Constructs a new GroupAccessControllProvider.
    *
    * @param \Drupal\group\Plugin\Group\RelationHandler\AccessControlInterface $parent
    *   The default access control.
@@ -32,11 +32,7 @@ public function entityAccess(EntityInterface $entity, $operation, AccountInterfa
     // Add support for unpublished vs published for "preview in collabora".
     $check_published = $operation === 'preview in collabora' && $this->implementsPublishedInterface;
 
-    if (!$check_published) {
-      return $this->parent->entityAccess($entity, $operation, $account, $return_as_object);
-    }
-
-    if (!$entity->isPublished()) {
+    if ($check_published && !$entity->isPublished()) {
       $operation .= ' unpublished';
     }
 

diff --git a/...s/collabora_online_group/src/Plugin/Group/RelationHandler/CollaboraPermissionProvider.php b/...s/collabora_online_group/src/Plugin/Group/RelationHandler/CollaboraPermissionProvider.php
@@ -52,10 +52,12 @@ public function getPermission($operation, $target, $scope = 'any'): bool|string
           if ($scope === 'any') {
             return "preview $this->pluginId in collabora";
           }
+          return FALSE;
         case 'preview in collabora unpublished':
-          if ($scope === 'own') {
+          if ($this->implementsPublishedInterface && $scope === 'own') {
             return "preview $scope unpublished $this->pluginId in collabora";
           }
+          return FALSE;
         case 'edit in collabora':
           return "edit $scope $this->pluginId in collabora";
       }

diff --git a/modules/collabora_online_group/tests/src/Kernel/AccessTest.php b/modules/collabora_online_group/tests/src/Kernel/AccessTest.php
@@ -169,9 +169,8 @@ protected function getTestScenarios(): array {
                 'status' => 0,
                 'scope' => 'own',
             ],
-            // To check: owner get access allowed on entities they own.
             'preview:published:own::preview_own' => [
-                'result' => TRUE,
+                'result' => FALSE,
                 'permissions' => [],
                 'group_permissions' => ['preview own unpublished group_media:document in collabora'],
                 'operation' => 'preview in collabora',