diff --git a/apps/server/src/ee b/apps/server/src/ee index 247e5eb7..05d3f55c 160000 --- a/apps/server/src/ee +++ b/apps/server/src/ee @@ -1 +1 @@ -Subproject commit 247e5eb7d1cd9830d15cc6848542a4c0c2f1e86a +Subproject commit 05d3f55c78c28c7cfc6ae1c5204b207bce6de2c6 diff --git a/apps/server/src/integrations/export/export.controller.ts b/apps/server/src/integrations/export/export.controller.ts index 3585a216..6608438d 100644 --- a/apps/server/src/integrations/export/export.controller.ts +++ b/apps/server/src/integrations/export/export.controller.ts @@ -16,6 +16,7 @@ import { User } from '@docmost/db/types/entity.types'; import SpaceAbilityFactory from '../../core/casl/abilities/space-ability.factory'; import { JwtAuthGuard } from '../../common/guards/jwt-auth.guard'; import { PageRepo } from '@docmost/db/repos/page/page.repo'; +import { PageAccessService } from '../../core/page-access/page-access.service'; import { SpaceCaslAction, SpaceCaslSubject, @@ -32,6 +33,7 @@ export class ExportController { private readonly exportService: ExportService, private readonly pageRepo: PageRepo, private readonly spaceAbility: SpaceAbilityFactory, + private readonly pageAccessService: PageAccessService, ) {} @UseGuards(JwtAuthGuard) @@ -50,10 +52,7 @@ export class ExportController { throw new NotFoundException('Page not found'); } - const ability = await this.spaceAbility.createForUser(user, page.spaceId); - if (ability.cannot(SpaceCaslAction.Read, SpaceCaslSubject.Page)) { - throw new ForbiddenException(); - } + await this.pageAccessService.validateCanView(page, user); const zipFileStream = await this.exportService.exportPages( dto.pageId,