mirror of
https://github.com/docmost/docmost.git
synced 2026-05-23 18:52:43 +08:00
fix
This commit is contained in:
@@ -44,7 +44,7 @@ export class PageAccessService {
|
|||||||
async validateCanViewWithPermissions(
|
async validateCanViewWithPermissions(
|
||||||
page: Page,
|
page: Page,
|
||||||
user: User,
|
user: User,
|
||||||
): Promise<{ canEdit: boolean }> {
|
): Promise<{ canEdit: boolean; hasRestriction: boolean }> {
|
||||||
const ability = await this.spaceAbility.createForUser(user, page.spaceId);
|
const ability = await this.spaceAbility.createForUser(user, page.spaceId);
|
||||||
|
|
||||||
if (ability.cannot(SpaceCaslAction.Read, SpaceCaslSubject.Page)) {
|
if (ability.cannot(SpaceCaslAction.Read, SpaceCaslSubject.Page)) {
|
||||||
@@ -62,6 +62,7 @@ export class PageAccessService {
|
|||||||
canEdit: hasAnyRestriction
|
canEdit: hasAnyRestriction
|
||||||
? canEdit
|
? canEdit
|
||||||
: ability.can(SpaceCaslAction.Edit, SpaceCaslSubject.Page),
|
: ability.can(SpaceCaslAction.Edit, SpaceCaslSubject.Page),
|
||||||
|
hasRestriction: hasAnyRestriction,
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -70,7 +71,10 @@ export class PageAccessService {
|
|||||||
* If page has restrictions: page-level writer permission determines access.
|
* If page has restrictions: page-level writer permission determines access.
|
||||||
* If no restrictions: space-level edit permission determines access.
|
* If no restrictions: space-level edit permission determines access.
|
||||||
*/
|
*/
|
||||||
async validateCanEdit(page: Page, user: User): Promise<void> {
|
async validateCanEdit(
|
||||||
|
page: Page,
|
||||||
|
user: User,
|
||||||
|
): Promise<{ hasRestriction: boolean }> {
|
||||||
const ability = await this.spaceAbility.createForUser(user, page.spaceId);
|
const ability = await this.spaceAbility.createForUser(user, page.spaceId);
|
||||||
|
|
||||||
// User must be at least a space member
|
// User must be at least a space member
|
||||||
@@ -92,5 +96,7 @@ export class PageAccessService {
|
|||||||
throw new ForbiddenException();
|
throw new ForbiddenException();
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
return { hasRestriction: hasAnyRestriction };
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -67,10 +67,10 @@ export class PageController {
|
|||||||
throw new NotFoundException('Page not found');
|
throw new NotFoundException('Page not found');
|
||||||
}
|
}
|
||||||
|
|
||||||
const { canEdit } =
|
const { canEdit, hasRestriction } =
|
||||||
await this.pageAccessService.validateCanViewWithPermissions(page, user);
|
await this.pageAccessService.validateCanViewWithPermissions(page, user);
|
||||||
|
|
||||||
const permissions = { canEdit };
|
const permissions = { canEdit, hasRestriction };
|
||||||
|
|
||||||
if (dto.format && dto.format !== 'json' && page.content) {
|
if (dto.format && dto.format !== 'json' && page.content) {
|
||||||
const contentOutput =
|
const contentOutput =
|
||||||
@@ -124,10 +124,10 @@ export class PageController {
|
|||||||
createPageDto,
|
createPageDto,
|
||||||
);
|
);
|
||||||
|
|
||||||
const { canEdit } =
|
const { canEdit, hasRestriction } =
|
||||||
await this.pageAccessService.validateCanViewWithPermissions(page, user);
|
await this.pageAccessService.validateCanViewWithPermissions(page, user);
|
||||||
|
|
||||||
const permissions = { canEdit };
|
const permissions = { canEdit, hasRestriction };
|
||||||
|
|
||||||
if (
|
if (
|
||||||
createPageDto.format &&
|
createPageDto.format &&
|
||||||
@@ -153,7 +153,8 @@ export class PageController {
|
|||||||
throw new NotFoundException('Page not found');
|
throw new NotFoundException('Page not found');
|
||||||
}
|
}
|
||||||
|
|
||||||
await this.pageAccessService.validateCanEdit(page, user);
|
const { hasRestriction } =
|
||||||
|
await this.pageAccessService.validateCanEdit(page, user);
|
||||||
|
|
||||||
const updatedPage = await this.pageService.update(
|
const updatedPage = await this.pageService.update(
|
||||||
page,
|
page,
|
||||||
@@ -161,7 +162,7 @@ export class PageController {
|
|||||||
user,
|
user,
|
||||||
);
|
);
|
||||||
|
|
||||||
const permissions = { canEdit: true };
|
const permissions = { canEdit: true, hasRestriction };
|
||||||
|
|
||||||
if (
|
if (
|
||||||
updatePageDto.format &&
|
updatePageDto.format &&
|
||||||
|
|||||||
Reference in New Issue
Block a user