Skip to content

Commit

Permalink
Merge pull request #6572 from getkirby/fix/6400-preview-permission-pe…
Browse files Browse the repository at this point in the history 
…r-role

Support role permissions for  `preview` option
  • Loading branch information
@distantnative
distantnative authored Aug 1, 2024
2 parents a0d8090 + bc2e9fc commit a2a57a6
Show file tree
Hide file tree
Showing 6 changed files with 232 additions and 8 deletions.
8 changes: 7 additions & 1 deletion src/Cms/File.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -624,7 +624,7 @@ public function url(): string
* Page URL and the filename as a more stable
* alternative for the media URLs.
*/
public function previewUrl(): string
public function previewUrl(): string|null
{
$parent = $this->parent();
$url = Url::to($this->id());
Expand All @@ -633,6 +633,12 @@ public function previewUrl(): string
case 'page':
$preview = $parent->blueprint()->preview();

// user has no permission to preview page,
// also return null for file preview
if ($preview === false) {
return null;
}

// the page has a custom preview setting,
// thus the file is only accessible through
// the direct media URL
Expand Down
2 changes: 1 addition & 1 deletion src/Cms/PageBlueprint.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -180,7 +180,7 @@ public function preview(): string|bool
return $this->model->toString($preview);
}

return $preview;
return $this->model->permissions()->can('preview', true);
}

/**
Expand Down
2 changes: 1 addition & 1 deletion src/Cms/SiteBlueprint.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,6 @@ public function preview(): string|bool
return $this->model->toString($preview);
}

return $preview;
return $this->model->permissions()->can('preview', true);
}
}
154 changes: 153 additions & 1 deletion tests/Cms/Files/FileTest.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -725,6 +725,25 @@ public function testPermalink()

public function testPreviewUrl()
{
$app = $this->app->clone([
'users' => [
[
'id' => 'test',
'email' => '[email protected]',
'role' => 'editor'
]
],
'roles' => [
[
'id' => 'editor',
'name' => 'editor',
]
]
]);

// authenticate
$app->impersonate('[email protected]');

$page = new Page([
'slug' => 'test',
'files' => [
Expand All @@ -738,8 +757,42 @@ public function testPreviewUrl()
$this->assertSame('/test/test.pdf', $file->previewUrl());
}

public function testPreviewUrlUnauthenticated()
{
$page = new Page([
'slug' => 'test',
'files' => [
[
'filename' => 'test.pdf'
]
]
]);

$file = $page->file('test.pdf');
$this->assertNull($file->previewUrl());
}

public function testPreviewUrlForDraft()
{
$app = $this->app->clone([
'users' => [
[
'id' => 'test',
'email' => '[email protected]',
'role' => 'editor'
]
],
'roles' => [
[
'id' => 'editor',
'name' => 'editor',
]
]
]);

// authenticate
$app->impersonate('[email protected]');

$page = new Page([
'slug' => 'test',
'isDraft' => true,
Expand All @@ -754,7 +807,7 @@ public function testPreviewUrlForDraft()
$this->assertSame($file->url(), $file->previewUrl());
}

public function testPreviewUrlForPageWithCustomPreviewSetting()
public function testPreviewUrlForPageWithDeniedPreviewSetting()
{
$app = new App([
'blueprints' => [
Expand All @@ -779,15 +832,98 @@ public function testPreviewUrlForPageWithCustomPreviewSetting()
]
]
]
],
'users' => [
[
'id' => 'test',
'email' => '[email protected]',
'role' => 'editor'
]
],
'roles' => [
[
'id' => 'editor',
'name' => 'editor',
]
]
]);

// authenticate
$app->impersonate('[email protected]');

$file = $app->file('test/test.pdf');
$this->assertNull($file->previewUrl());
}

public function testPreviewUrlForPageWithCustomPreviewSetting()
{
$app = new App([
'blueprints' => [
'pages/test' => [
'options' => [
'preview' => '/foo/bar'
]
]
],
'roots' => [
'index' => '/dev/null'
],
'site' => [
'children' => [
[
'slug' => 'test',
'template' => 'test',
'files' => [
[
'filename' => 'test.pdf'
]
]
]
]
],
'users' => [
[
'id' => 'test',
'email' => '[email protected]',
'role' => 'editor'
]
],
'roles' => [
[
'id' => 'editor',
'name' => 'editor',
]
]
]);

// authenticate
$app->impersonate('[email protected]');

$file = $app->file('test/test.pdf');
$this->assertSame($file->url(), $file->previewUrl());
}

public function testPreviewUrlForUserFile()
{
$app = $this->app->clone([
'users' => [
[
'id' => 'test',
'email' => '[email protected]',
'role' => 'editor'
]
],
'roles' => [
[
'id' => 'editor',
'name' => 'editor',
]
]
]);

// authenticate
$app->impersonate('[email protected]');

$user = new User([
'email' => '[email protected]',
'files' => [
Expand Down Expand Up @@ -820,9 +956,25 @@ public function testPreviewUrlForExtendedComponent()
]
]
]
],
'users' => [
[
'id' => 'test',
'email' => '[email protected]',
'role' => 'editor'
]
],
'roles' => [
[
'id' => 'editor',
'name' => 'editor',
]
]
]);

// authenticate
$app->impersonate('[email protected]');

$file = $app->file('test/test.pdf');
$this->assertSame('https://getkirby.com/test.pdf', $file->previewUrl());
}
Expand Down
48 changes: 46 additions & 2 deletions tests/Cms/Pages/PageTest.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -583,9 +583,30 @@ public function testPreviewUrl()
'slug' => 'test'
]);

// authenticate
$app->impersonate('kirby');

$this->assertSame('/test', $page->previewUrl());
}

public function testPreviewUrlUnauthenticated()
{
new App([
'roots' => [
'index' => '/dev/null'
],
'urls' => [
'index' => '/'
]
]);

$page = new Page([
'slug' => 'test'
]);

$this->assertNull($page->previewUrl());
}

public static function previewUrlProvider(): array
{
return [
Expand All @@ -600,23 +621,46 @@ public static function previewUrlProvider(): array
['{{ page.url }}?preview=true', '/test?preview=true&{token}', true],
[false, null, false],
[false, null, true],
[null, null, false, false],
];
}

/**
* @dataProvider previewUrlProvider
*/
public function testCustomPreviewUrl($input, $expected, $draft)
{
public function testCustomPreviewUrl(
$input,
$expected,
bool $draft,
bool $authenticated = true
): void {
$app = new App([
'roots' => [
'index' => '/dev/null'
],
'urls' => [
'index' => '/'
],
'users' => [
[
'id' => 'test',
'email' => '[email protected]',
'role' => 'editor'
]
],
'roles' => [
[
'id' => 'editor',
'name' => 'editor',
]
]
]);

// authenticate
if ($authenticated) {
$app->impersonate('[email protected]');
}

$options = [];

if ($input !== null) {
Expand Down
26 changes: 24 additions & 2 deletions tests/Cms/Site/SiteTest.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -194,23 +194,45 @@ public static function previewUrlProvider(): array
['https://test.com', 'https://test.com'],
['{{ site.url }}#test', '/#test'],
[false, null],
[null, null, false],
];
}

/**
* @dataProvider previewUrlProvider
*/
public function testCustomPreviewUrl($input, $expected)
{
public function testCustomPreviewUrl(
$input,
$expected,
bool $authenticated = true
): void {
$app = new App([
'roots' => [
'index' => '/dev/null'
],
'urls' => [
'index' => '/'
],
'users' => [
[
'id' => 'test',
'email' => '[email protected]',
'role' => 'editor'
]
],
'roles' => [
[
'id' => 'editor',
'name' => 'editor',
]
]
]);

// authenticate
if ($authenticated) {
$app->impersonate('[email protected]');
}

$options = [];

if ($input !== null) {
Expand Down

0 comments on commit a2a57a6

Please sign in to comment.