Overview

In #3516657: Update `ApiContentControllers::list()` to expose available content entity operations in `meta` we exposed the operations that can be executed on content.

The 'duplicate' operation relies on 'update' access, while it should be creation access.

Proposed resolution

Fix permissions + test

User interface changes

Duplicate will be visible only when we can create content.

Issue fork experience_builder-3533728

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

penyaskito created an issue. See original summary.

penyaskito credited jessebaker.

penyaskito’s picture

penyaskito
he/him
Primary language Spanish
Location 🧑🏽‍🌾 Seville 💃 Andalusia, UTC+2 🇪🇺
commented

Jesse found this while working on #3516641: Make the XB UI show only UI elements/operations available to the current user

penyaskito opened merge request !1222

penyaskito’s picture

penyaskito
he/him
Primary language Spanish
Location 🧑🏽‍🌾 Seville 💃 Andalusia, UTC+2 🇪🇺
commented
Assigned: Unassigned » wim leers
Status: Active » Needs review
wim leers’s picture

wim leers
Location Ghent 🇧🇪🇪🇺
commented
Title: Duplicate operation should require 'create' permission » Duplicate operation should require 'create' permission, not 'update' permission
Assigned: wim leers » Unassigned
Status: Needs review » Reviewed & tested by the community
Related issues: +#3516657: Update `ApiContentControllers::list()` to expose available content entity operations in `meta`

Whoops! Silly oversight in #3516657: Update `ApiContentControllers::list()` to expose available content entity operations in `meta` 😅

wim leers’s picture

wim leers
Location Ghent 🇧🇪🇪🇺
commented
Status: Reviewed & tested by the community » Needs work

Shoot, needs some test expectations to be updated in XbContentEntityHttpApiTest.

isholgueras’s picture

isholgueras commented
Assigned: Unassigned » isholgueras
isholgueras’s picture

isholgueras commented
Assigned: isholgueras » wim leers
Status: Needs work » Needs review
wim leers’s picture

wim leers
Location Ghent 🇧🇪🇪🇺
commented
Assigned: wim leers » Unassigned
Status: Needs review » Reviewed & tested by the community

Perfect :)

wim leers’s picture

wim leers
Location Ghent 🇧🇪🇪🇺
commented
Status: Reviewed & tested by the community » Fixed
mayur-sose’s picture

mayur-sose commented

I have verified below scenarios:

ID Test Scenario Steps Expected Result Pass/Fail
TC1 User with "create" permission but not "edit"
  1. Assign user only the "create" permission for the content type.
  2. Remove the "edit" permission.
  3. Login as this user and view a list/detail view of content.
 "Duplicate" button/action is not visible.

User is unable to create or duplicate content. 		Pass
TC2 User with "edit" but not "create" cannot see "Duplicate"
  1. Assign user only the "edit" permission for the content type.
  2. Remove the "create" permission.
  3. Login and view content.
 "Duplicate" button/action is not visible.

User cannot duplicate content. 		Pass
TC3 User with both "create" and "edit" can duplicate and edit
  1. Assign user both "create" and "update" permissions.
  2. Login and view content.
  3. Use "Duplicate".
 "Duplicate" action is visible.

User can duplicate and then edit the resulting new content. 		Pass
TC4 User with neither permission cannot see "Duplicate"
  1. Remove both "create" and "edit" from user.
  2. Login and view content.
 "Duplicate" option is not visible and cannot be accessed directly. Pass
TC5 UI shows/hides Duplicate action dynamically when permissions change
  1. As admin, modify the user's permissions on-the-fly while user is looking at content (grant/revoke "create" permission).
 "Duplicate" button appears/disappears after refresh it matches permissions. Pass
TC6 "Duplicate" option only appears for content types where user has "create"
  1. Assign "create" to just one content type (e.g., "Article"), not others (e.g., "Page").
  2. Login and browse both.
 "Duplicate" is only visible and usable for content types where user can create new items. Pass
TC7 Regression: user with only "edit" could previously see "duplicate"
  1. Assign only "edit" and try old or bookmarked "Duplicate" URLs.
  2. Try to access duplicate by UI and direct link.
 Operation is not available by UI or direct URL; correct permission required. Pass
wim leers’s picture

wim leers
Location Ghent 🇧🇪🇪🇺
commented

Thanks!

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.