primocms / primo

Primo is a visual CMS with a built-in code editor, Svelte blocks, and static site generator.
https://primocms.org
MIT License
1.92k stars 474 forks source link

Contributors with the "content editor" role can edit code for blocks, pages, and the site. #320

Closed LucasGabrielBravo closed 11 months ago

LucasGabrielBravo commented 11 months ago

I noticed that contributors with the "content editor" role can access the code editor. The ideal is that only the "developers" access the code of the site, page and blocks.

mateomorris commented 11 months ago

Okay @LucasGabrielBravo should be fixed now - mind checking? I've also gone ahead and hidden the 'Page' and 'Site' fields when there aren't any fields for content editors to edit

LucasGabrielBravo commented 11 months ago

It worked, but it didn't work.

I logged in with an "EDITOR" user and the interface remained the same as a "DEV". I noticed that the "DEV" or "EDITOR" is stored in $userRole, so I did a $: console.log($userRole) and the output was DEV.

In the /src/lib/Primo.svelte file on line 23 there is

export let role = 'DEV'

$: $userRole = role

Changing to export let role = 'EDITOR' hides the code editor buttons.

I also logged in with the admin user by holding export let role="EDITOR' and doing that the admin also runs out of code editor buttons.

I believe that the "role" is not being passed to the store when creating the <Primo {data} /> component in /src/routes/[site]/+layout.svelte, but I don't know how to resolve it

mateomorris commented 11 months ago

@LucasGabrielBravo hmm, did you pull down the latest changes? See here, the role is being passed down.

LucasGabrielBravo commented 11 months ago

My mistake!

It's working perfectly.

I synced Builder but forgot to sync Primo.

Thank you very much

mateomorris commented 11 months ago

@LucasGabrielBravo ah okay, great!