EZP-30997: Fixed permission checks when copying translations during publishing

[pawbuj]

Question	Answer
JIRA issue	EZP-30997
Bug/Improvement	yes
New feature	no
Target version	7.5
BC breaks	no
Tests pass	no
Doc needed	no

TODO:

• Implement feature / fix a bug.
• Implement tests.
• Fix new code according to Coding Standards ($ composer fix-cs).
• Ask for Code Review.

[alongosz]

Overall looks good, some minor adjustments are required:

[alongosz]

While reviewing once again #2846 I've discovered yet another bug here. Consider the following use case:

public function testPublishVersionTranslationIsNotAllowed(): void
{
    $repository = $this->getRepository();
    $contentService = $repository->getContentService();
    $permissionResolver = $repository->getPermissionResolver();

    $britishEditor = $this->createEditorUserWithLanguageLimitation(['eng-GB'], 'editor-uk');
    $americanEditor = $this->createEditorUserWithLanguageLimitation(['eng-US'], 'editor-us');

    // British editor publishes BrE content
    $permissionResolver->setCurrentUserReference($britishEditor);

    $folder = $this->createFolder(['eng-GB' => 'BrE Folder'], 2);

    // American editor creates and saves AmE draft
    $permissionResolver->setCurrentUserReference($americanEditor);

    $folder = $contentService->loadContent($folder->id);
    $folderDraft = $contentService->createContentDraft($folder->contentInfo);
    $folderUpdateStruct = $contentService->newContentUpdateStruct();
    $folderUpdateStruct->setField('name', 'AmE Folder', 'eng-US');
    $folderDraft = $contentService->updateContent(
        $folderDraft->versionInfo,
        $folderUpdateStruct
    );

    // British editor tries to publish AmE translation
    $permissionResolver->setCurrentUserReference($britishEditor);
    $folderDraftVersionInfo = $contentService->loadVersionInfo(
        $folderDraft->contentInfo,
        $folderDraft->versionInfo->versionNo
    );
    self::assertTrue($folderDraftVersionInfo->isDraft());
    $this->expectException(UnauthorizedException::class);
    $this->expectExceptionMessage("User does not have access to 'publish' 'content'");
    $contentService->publishVersion($folderDraftVersionInfo, ['eng-US']);
}

private function createEditorUserWithLanguageLimitation(
    array $allowedTranslationsList,
    string $login = 'editor'
): User {
    $limitations = [
        // limitation for specific translations
        new LanguageLimitation(['limitationValues' => $allowedTranslationsList]),
    ];

    return $this->createUserWithPolicies(
        $login,
        [
            ['module' => 'content', 'function' => 'read'],
            ['module' => 'content', 'function' => 'versionread'],
            ['module' => 'content', 'function' => 'view_embed'],
            ['module' => 'content', 'function' => 'create', 'limitations' => $limitations],
            ['module' => 'content', 'function' => 'edit', 'limitations' => $limitations],
            ['module' => 'content', 'function' => 'publish', 'limitations' => $limitations],
        ]
    );
}

I'm not sure if this is reproducible with AdminUI (depends if ATM it's possible to edit someone else's draft - don't remember). However for the API it's an issue.

[alongosz]

Almost ok ;)

[alongosz]

@mikadamczyk one more request - could you incorporate #2846 here as well, as it touches the same portion of code? Would be easier to test.

[mikadamczyk]

Sure @alongosz I thought that they ware divided by some purpose, but definitely it touches the same part of code

[alongosz]

Sure @alongosz I thought that they were divided by some purpose, but definitely it touches the same part of code

Yes, initially they were, but given the changes here it no longer makes sense :)