mirror of
https://github.com/docmost/docmost.git
synced 2026-06-10 01:52:43 +08:00
Philipinho
0615bcf222
BaseWsService.subscribe was the last surface that didn't go through the page-permission system. It checked authorization with a bespoke canReadBaseSpace(userId, spaceId) — which queried space membership directly and accepted ANY space role — so a user with a per-base restriction (revoked access via pagePermissionRepo) could still stream live updates and presence for a base they couldn't otherwise read. Replace it with pageAccessService.validateCanView(base, user) — the same gate the HTTP endpoints (info, list, rows query, etc.) and the page collab WS already use. Bases are pages structurally (isBase=true), so reusing the page validator keeps them on a single permission code path. Drops the now-unused SpaceMemberRepo / findHighestUserSpaceRole imports; injects UserRepo + PageAccessService instead (both are globally provided modules, no DI changes needed).
Docmost
Open-source collaborative wiki and documentation software.
Website |
Documentation |
Twitter / X
Getting started
To get started with Docmost, please refer to our documentation or try our cloud version .
Features
- Real-time collaboration
- Diagrams (Draw.io, Excalidraw and Mermaid)
- Spaces
- Permissions management
- Groups
- Comments
- Page history
- Search
- File attachments
- Embeds (Airtable, Loom, Miro and more)
- Translations (10+ languages)
Screenshots
License
Docmost core is licensed under the open-source AGPL 3.0 license.
Enterprise features are available under an enterprise license (Enterprise Edition).
All files in the following directories are licensed under the Docmost Enterprise license defined in packages/ee/License.
- apps/server/src/ee
- apps/client/src/ee
- packages/ee
Contributing
See the development documentation
Thanks
Special thanks to;
Crowdin for providing access to their localization platform.
Algolia for providing full-text search to the docs.