DataManager doesn't check entityAttributePermissions

[racoy]

Environment

• Platform version: 7.2.17
• Browser: Chrome
• Database: PostgreSQL
• Operating system: Windows

Description of the bug or enhancement

DataManager doesn't check @EntityAttributeAccess on Entity. For example: StoreEmployeeRole can change importantField(view only in security settings)

    @Role(name = StoreEmployeeRole.NAME)
public class StoreEmployeeRole extends AnnotatedRoleDefinition {
    public final static String NAME = "StoreEmployee";

    @EntityAccess(entityClass = Store.class, operations = {EntityOp.READ, EntityOp.UPDATE})
    @Override
    public EntityPermissionsContainer entityPermissions() {
        return super.entityPermissions();
    }

    @EntityAttributeAccess(entityClass = Store.class, view = "*", modify = "notImportantField")
    @Override
    public EntityAttributePermissionsContainer entityAttributePermissions() {
        return super.entityAttributePermissions();
    }

    @ScreenAccess(screenIds = {"seccollapse_Store.browse", "seccollapse_Store.edit", "network-menu", "application-seccollapse"})
    @Override
    public ScreenPermissionsContainer screenPermissions() {
        return super.screenPermissions();
    }
}

1) Create user with SoreEmployee role 2) Create Store instance 3) click on "just button" in store editor

    @Subscribe("justBtn")
    public void onJustBtnClick(Button.ClickEvent event) {
        storeDc.getItem().setImportantField((long) (Math.random()*1000));
    }

4) click "Ok" for save entity

ER-Exception AR-successful commit

Simple demostrate project here: seccollapse.zip

[knstvk]

DataManager checks entity attribute permissions only if you set cuba.entityAttributePermissionChecking to true. See https://doc.cuba-platform.com/manual-7.2/data_access_checks.html