Elements: Element start node permissions

src/Umbraco.Cms.Api.Management/Controllers/Element/ElementControllerBase.cs

@@ -9,8 +9,7 @@ namespace Umbraco.Cms.Api.Management.Controllers.Element;
 
 [VersionedApiBackOfficeRoute(Constants.UdiEntityType.Element)]
 [ApiExplorerSettings(GroupName = nameof(Constants.UdiEntityType.Element))]
-// TODO ELEMENTS: backoffice authorization policies
-[Authorize(Policy = AuthorizationPolicies.TreeAccessDocuments)]
+[Authorize(Policy = AuthorizationPolicies.TreeAccessElements)]
 public class ElementControllerBase : ContentControllerBase
 {
 }

src/Umbraco.Cms.Api.Management/Controllers/Element/Folder/ElementFolderControllerBase.cs

@@ -1,15 +1,17 @@
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Management.Routing;
 using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Security;
 using Umbraco.Cms.Core.Services;
+using Umbraco.Cms.Web.Common.Authorization;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Element.Folder;
 
 [VersionedApiBackOfficeRoute($"{Constants.UdiEntityType.Element}/folder")]
 [ApiExplorerSettings(GroupName = nameof(Constants.UdiEntityType.Element))]
-// TODO ELEMENTS: backoffice authorization policies
+[Authorize(Policy = AuthorizationPolicies.TreeAccessElements)]
 public abstract class ElementFolderControllerBase : FolderManagementControllerBase<IElement>
 {
     protected ElementFolderControllerBase(

src/Umbraco.Cms.Api.Management/Controllers/Element/MoveElementController.cs

@@ -1,9 +1,8 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Management.ViewModels.Element;
 using Umbraco.Cms.Core;
-using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Security;
 using Umbraco.Cms.Core.Services;
 using Umbraco.Cms.Core.Services.OperationStatus;

src/Umbraco.Cms.Api.Management/Controllers/Element/PublishElementController.cs

@@ -1,4 +1,4 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Management.Factories;

src/Umbraco.Cms.Api.Management/Controllers/Element/RecycleBin/ElementRecycleBinControllerBase.cs

@@ -16,11 +16,9 @@
 namespace Umbraco.Cms.Api.Management.Controllers.Element.RecycleBin;
 
 [VersionedApiBackOfficeRoute($"{Constants.Web.RoutePath.RecycleBin}/{Constants.UdiEntityType.Element}")]
-// TODO ELEMENTS: backoffice authorization policies
-[RequireDocumentTreeRootAccess]
+[RequireElementTreeRootAccess]
 [ApiExplorerSettings(GroupName = nameof(Constants.UdiEntityType.Element))]
-// TODO ELEMENTS: backoffice authorization policies
-[Authorize(Policy = AuthorizationPolicies.TreeAccessDocuments)]
+[Authorize(Policy = AuthorizationPolicies.TreeAccessElements)]
 public class ElementRecycleBinControllerBase : RecycleBinControllerBase<ElementRecycleBinItemResponseModel>
 {
     private readonly IEntityService _entityService;

src/Umbraco.Cms.Api.Management/Controllers/Element/Tree/AncestorsElementTreeController.cs

@@ -2,17 +2,27 @@
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Management.Factories;
+using Umbraco.Cms.Api.Management.Services.Entities;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
-using Umbraco.Cms.Core.Mapping;
+using Umbraco.Cms.Core.Cache;
+using Umbraco.Cms.Core.Security;
 using Umbraco.Cms.Core.Services;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Element.Tree;
 
 [ApiVersion("1.0")]
 public class AncestorsElementTreeController : ElementTreeControllerBase
 {
-    public AncestorsElementTreeController(IEntityService entityService, IUmbracoMapper umbracoMapper, IElementPresentationFactory elementPresentationFactory)
-        : base(entityService, umbracoMapper, elementPresentationFactory)
+    public AncestorsElementTreeController(
+        IEntityService entityService,
+        FlagProviderCollection flagProviders,
+        IUserStartNodeEntitiesService userStartNodeEntitiesService,
+        IDataTypeService dataTypeService,
+        AppCaches appCaches,
+        IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
+        IElementPresentationFactory elementPresentationFactory)
+        : base(entityService, flagProviders, userStartNodeEntitiesService, dataTypeService, appCaches, backOfficeSecurityAccessor, elementPresentationFactory)
     {
     }
 

src/Umbraco.Cms.Api.Management/Controllers/Element/Tree/ChildrenElementTreeController.cs

@@ -3,17 +3,27 @@
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
 using Umbraco.Cms.Api.Management.Factories;
+using Umbraco.Cms.Api.Management.Services.Entities;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
-using Umbraco.Cms.Core.Mapping;
+using Umbraco.Cms.Core.Cache;
+using Umbraco.Cms.Core.Security;
 using Umbraco.Cms.Core.Services;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Element.Tree;
 
 [ApiVersion("1.0")]
 public class ChildrenElementTreeController : ElementTreeControllerBase
 {
-    public ChildrenElementTreeController(IEntityService entityService, IUmbracoMapper umbracoMapper, IElementPresentationFactory elementPresentationFactory)
-        : base(entityService, umbracoMapper, elementPresentationFactory)
+    public ChildrenElementTreeController(
+        IEntityService entityService,
+        FlagProviderCollection flagProviders,
+        IUserStartNodeEntitiesService userStartNodeEntitiesService,
+        IDataTypeService dataTypeService,
+        AppCaches appCaches,
+        IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
+        IElementPresentationFactory elementPresentationFactory)
+        : base(entityService, flagProviders, userStartNodeEntitiesService, dataTypeService, appCaches, backOfficeSecurityAccessor, elementPresentationFactory)
     {
     }
 

src/Umbraco.Cms.Api.Management/Controllers/Element/Tree/ElementTreeControllerBase.cs

@@ -1,48 +1,82 @@
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Management.Controllers.Tree;
 using Umbraco.Cms.Api.Management.Factories;
 using Umbraco.Cms.Api.Management.Routing;
-using Umbraco.Cms.Api.Management.ViewModels.DocumentType;
+using Umbraco.Cms.Api.Management.Services.Entities;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core;
-using Umbraco.Cms.Core.Mapping;
+using Umbraco.Cms.Core.Cache;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Models.Entities;
+using Umbraco.Cms.Core.Security;
 using Umbraco.Cms.Core.Services;
+using Umbraco.Cms.Web.Common.Authorization;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Element.Tree;
 
 [VersionedApiBackOfficeRoute($"{Constants.Web.RoutePath.Tree}/{Constants.UdiEntityType.Element}")]
 [ApiExplorerSettings(GroupName = nameof(Constants.UdiEntityType.Element))]
-// TODO ELEMENTS: backoffice authorization policies
-public class ElementTreeControllerBase : FolderTreeControllerBase<ElementTreeItemResponseModel>
+[Authorize(Policy = AuthorizationPolicies.SectionAccessForElementTree)]
+public class ElementTreeControllerBase : UserStartNodeFolderTreeControllerBase<ElementTreeItemResponseModel>
 {
-    private readonly IUmbracoMapper _umbracoMapper;
+    private readonly AppCaches _appCaches;
+    private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
     private readonly IElementPresentationFactory _elementPresentationFactory;
 
-    public ElementTreeControllerBase(IEntityService entityService, IUmbracoMapper umbracoMapper, IElementPresentationFactory elementPresentationFactory)
-        : base(entityService)
+    public ElementTreeControllerBase(
+        IEntityService entityService,
+        FlagProviderCollection flagProviders,
+        IUserStartNodeEntitiesService userStartNodeEntitiesService,
+        IDataTypeService dataTypeService,
+        AppCaches appCaches,
+        IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
+        IElementPresentationFactory elementPresentationFactory)
+        : base(entityService, flagProviders, userStartNodeEntitiesService, dataTypeService)
     {
-        _umbracoMapper = umbracoMapper;
+        _appCaches = appCaches;
+        _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
         _elementPresentationFactory = elementPresentationFactory;
     }
 
     protected override UmbracoObjectTypes ItemObjectType => UmbracoObjectTypes.Element;
 
     protected override UmbracoObjectTypes FolderObjectType => UmbracoObjectTypes.ElementContainer;
 
-    protected override ElementTreeItemResponseModel[] MapTreeItemViewModels(Guid? parentKey, IEntitySlim[] entities)
-        => entities.Select(entity =>
+    protected override int[] GetUserStartNodeIds()
+        => _backOfficeSecurityAccessor
+               .BackOfficeSecurity?
+               .CurrentUser?
+               .CalculateElementStartNodeIds(EntityService, _appCaches)
+           ?? [];
+
+    protected override string[] GetUserStartNodePaths()
+        => _backOfficeSecurityAccessor
+               .BackOfficeSecurity?
+               .CurrentUser?
+               .GetElementStartNodePaths(EntityService, _appCaches)
+           ?? [];
+
+    protected override ElementTreeItemResponseModel MapTreeItemViewModel(Guid? parentKey, IEntitySlim entity)
+    {
+        ElementTreeItemResponseModel responseModel = base.MapTreeItemViewModel(parentKey, entity);
+
+        if (entity is IElementEntitySlim elementEntitySlim)
         {
-            ElementTreeItemResponseModel responseModel = MapTreeItemViewModel(parentKey, entity);
-            if (entity is IElementEntitySlim elementEntitySlim)
-            {
-                responseModel.HasChildren = false;
-                responseModel.CreateDate = elementEntitySlim.CreateDate;
-                responseModel.DocumentType = _elementPresentationFactory.CreateDocumentTypeReferenceResponseModel(elementEntitySlim);
-                responseModel.Variants = _elementPresentationFactory.CreateVariantsItemResponseModels(elementEntitySlim);
-            }
-
-            return responseModel;
-        }).ToArray();
+            responseModel.HasChildren = false;
+            responseModel.CreateDate = elementEntitySlim.CreateDate;
+            responseModel.DocumentType = _elementPresentationFactory.CreateDocumentTypeReferenceResponseModel(elementEntitySlim);
+            responseModel.Variants = _elementPresentationFactory.CreateVariantsItemResponseModels(elementEntitySlim);
+        }
+
+        return responseModel;
+    }
+
+    protected override ElementTreeItemResponseModel MapTreeItemViewModelAsNoAccess(Guid? parentKey, IEntitySlim entity)
+    {
+        ElementTreeItemResponseModel viewModel = MapTreeItemViewModel(parentKey, entity);
+        viewModel.NoAccess = true;
+        return viewModel;
+    }
 }

src/Umbraco.Cms.Api.Management/Controllers/Element/Tree/RootElementTreeController.cs

@@ -3,17 +3,27 @@
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
 using Umbraco.Cms.Api.Management.Factories;
+using Umbraco.Cms.Api.Management.Services.Entities;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
-using Umbraco.Cms.Core.Mapping;
+using Umbraco.Cms.Core.Cache;
+using Umbraco.Cms.Core.Security;
 using Umbraco.Cms.Core.Services;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Element.Tree;
 
 [ApiVersion("1.0")]
 public class RootElementTreeController : ElementTreeControllerBase
 {
-    public RootElementTreeController(IEntityService entityService, IUmbracoMapper umbracoMapper, IElementPresentationFactory elementPresentationFactory)
-        : base(entityService, umbracoMapper, elementPresentationFactory)
+    public RootElementTreeController(
+        IEntityService entityService,
+        FlagProviderCollection flagProviders,
+        IUserStartNodeEntitiesService userStartNodeEntitiesService,
+        IDataTypeService dataTypeService,
+        AppCaches appCaches,
+        IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
+        IElementPresentationFactory elementPresentationFactory)
+        : base(entityService, flagProviders, userStartNodeEntitiesService, dataTypeService, appCaches, backOfficeSecurityAccessor, elementPresentationFactory)
     {
     }
 

src/Umbraco.Cms.Api.Management/Controllers/Element/Tree/SiblingsElementTreeController.cs

@@ -1,21 +1,34 @@
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
 using Umbraco.Cms.Api.Management.Factories;
+using Umbraco.Cms.Api.Management.Services.Entities;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
-using Umbraco.Cms.Core.Mapping;
+using Umbraco.Cms.Core.Cache;
+using Umbraco.Cms.Core.Security;
 using Umbraco.Cms.Core.Services;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Element.Tree;
 
+[ApiVersion("1.0")]
 public class SiblingsElementTreeController : ElementTreeControllerBase
 {
-    public SiblingsElementTreeController(IEntityService entityService, IUmbracoMapper umbracoMapper, IElementPresentationFactory elementPresentationFactory)
-        : base(entityService, umbracoMapper, elementPresentationFactory)
+    public SiblingsElementTreeController(
+        IEntityService entityService,
+        FlagProviderCollection flagProviders,
+        IUserStartNodeEntitiesService userStartNodeEntitiesService,
+        IDataTypeService dataTypeService,
+        AppCaches appCaches,
+        IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
+        IElementPresentationFactory elementPresentationFactory)
+        : base(entityService, flagProviders, userStartNodeEntitiesService, dataTypeService, appCaches, backOfficeSecurityAccessor, elementPresentationFactory)
     {
     }
 
     [HttpGet("siblings")]
+    [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(SubsetViewModel<ElementTreeItemResponseModel>), StatusCodes.Status200OK)]
     public async Task<ActionResult<SubsetViewModel<ElementTreeItemResponseModel>>> Siblings(
         CancellationToken cancellationToken,

src/Umbraco.Cms.Api.Management/Controllers/Element/UnpublishElementController.cs

@@ -1,7 +1,6 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Api.Management.Factories;
 using Umbraco.Cms.Api.Management.ViewModels.Element;
 using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Security;
@@ -15,16 +14,13 @@ public class UnpublishElementController : ElementControllerBase
 {
     private readonly IElementPublishingService _elementPublishingService;
     private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
-    private readonly IDocumentPresentationFactory _documentPresentationFactory;
 
     public UnpublishElementController(
         IElementPublishingService elementPublishingService,
-        IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
-        IDocumentPresentationFactory documentPresentationFactory)
+        IBackOfficeSecurityAccessor backOfficeSecurityAccessor)
     {
         _elementPublishingService = elementPublishingService;
         _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
-        _documentPresentationFactory = documentPresentationFactory;
     }
 
     [HttpPut("{id:guid}/unpublish")]