pimcore / data-hub

Data delivery & consumption platform for Pimcore.
Other
128 stars 110 forks source link

[Bug]: isGranted of PermissionEvent is ignored with NOT_ALLOWED_POLICY_NULL #909

Open fmaerkl-sw opened 2 weeks ago

fmaerkl-sw commented 2 weeks ago

Expected behavior

Elements where an event handler for PermissionEvents::PRE_CHECK sets isGranted to false should be returned as null or filtered out of the result of a GraphQL query when NOT_ALLOWED_POLICY_NULL is used. Just like an exception is thrown when NOT_ALLOWED_POLICY_EXCEPTION is used in the same situation.

Actual behavior

The contents of isGranted are completely ignored. It can be easily seen here that the value of $event->isGranted() has no effect if PimcoreDataHubBundle::getNotAllowedPolicy() !== PimcoreDataHubBundle::NOT_ALLOWED_POLICY_EXCEPTION:

https://github.com/pimcore/data-hub/blob/90aabfc4eaf648dcbb4056bf6b46dc07635fb2b0/src/WorkspaceHelper.php#L233-L248

Steps to reproduce

Register a handler for PermissionEvent and set isGranted to false:

use Symfony\Component\EventDispatcher\EventSubscriberInterface;
use Pimcore\Bundle\DataHubBundle\Event\GraphQL\Model\PermissionEvent;
use Pimcore\Bundle\DataHubBundle\Event\GraphQL\PermissionEvents;

class GraphQlSubscriber implements EventSubscriberInterface
{
    public static function getSubscribedEvents(): array
    {
        return [
            PermissionEvents::PRE_CHECK => 'adaptPermissions'
        ];
    }

    public function adaptPermissions(PermissionEvent $event): void
    {
        $event->setIsGranted(false);
    }
}