diff --git a/app/Auth/Permissions/EntityPermissionEvaluator.php b/app/Auth/Permissions/EntityPermissionEvaluator.php index f5e75be3e..51db45bbc 100644 --- a/app/Auth/Permissions/EntityPermissionEvaluator.php +++ b/app/Auth/Permissions/EntityPermissionEvaluator.php @@ -66,6 +66,10 @@ class EntityPermissionEvaluator $permitsByType[$type][$roleId] = $permission->{$this->action}; } } + + if (isset($permitsByType['fallback'][0])) { + break; + } } return $permitsByType; diff --git a/dev/docs/permission-scenario-testing.md b/dev/docs/permission-scenario-testing.md index 54b1bcfe1..7a9cc1126 100644 --- a/dev/docs/permission-scenario-testing.md +++ b/dev/docs/permission-scenario-testing.md @@ -317,4 +317,27 @@ User granted page permission. - Role B has no entity chapter permissions. - User has Role A & B. +User denied page permission. + +#### test_90_fallback_overrides_parent_entity_role_deny + +- Chapter permissions have inherit disabled. +- Page permissions have inherit disabled. +- Chapter fallback has entity deny permission. +- Page fallback has entity deny permission. +- Role A has entity allow chapter permission. +- User has Role A. + +User denied page permission. + +#### test_91_fallback_overrides_parent_entity_role_inherit + +- Book permissions have inherit disabled. +- Chapter permissions have inherit disabled. +- Page permissions have inherit enabled. +- Book fallback has entity deny permission. +- Chapter fallback has entity deny permission. +- Role A has entity allow book permission. +- User has Role A. + User denied page permission. \ No newline at end of file diff --git a/tests/Permissions/Scenarios/EntityRolePermissionsTest.php b/tests/Permissions/Scenarios/EntityRolePermissionsTest.php index c8f1401e7..bd5b31fdc 100644 --- a/tests/Permissions/Scenarios/EntityRolePermissionsTest.php +++ b/tests/Permissions/Scenarios/EntityRolePermissionsTest.php @@ -293,4 +293,31 @@ class EntityRolePermissionsTest extends PermissionScenarioTestCase $this->assertNotVisibleToUser($page, $user); } + + public function test_90_fallback_overrides_parent_entity_role_deny() + { + [$user, $roleA] = $this->users->newUserWithRole(); + $page = $this->entities->page(); + $chapter = $page->chapter; + + $this->permissions->setFallbackPermissions($chapter, []); + $this->permissions->setFallbackPermissions($page, []); + $this->permissions->addEntityPermission($chapter, ['view'], $roleA); + + $this->assertNotVisibleToUser($page, $user); + } + + public function test_91_fallback_overrides_parent_entity_role_inherit() + { + [$user, $roleA] = $this->users->newUserWithRole(); + $page = $this->entities->page(); + $chapter = $page->chapter; + $book = $page->book; + + $this->permissions->setFallbackPermissions($book, []); + $this->permissions->setFallbackPermissions($chapter, []); + $this->permissions->addEntityPermission($book, ['view'], $roleA); + + $this->assertNotVisibleToUser($page, $user); + } }