Session authorization is different

Author: riasvdv

src/Http/Controllers/PreviewController.php

@@ -4,6 +4,7 @@
 
 namespace CraftCms\Cms\Http\Controllers;
 
+use Craft;
 use craft\helpers\ElementHelper;
 use CraftCms\Cms\Http\EnforcesPermissions;
 use CraftCms\Cms\Http\Middleware\HandleTokenRequest;
@@ -25,9 +26,9 @@
     public function createToken(Request $request, RouteTokens $tokens, RouteToken $tokenData): JsonResponse|RedirectResponse
     {
         match (true) {
-            isset($tokenData->draftId) => $this->requirePermission("previewDraft:{$tokenData->draftId}"),
-            isset($tokenData->revisionId) => $this->requirePermission("previewRevision:{$tokenData->revisionId}"),
-            default => $this->requirePermission("previewElement:{$tokenData->getCanonicalId()}"),
+            isset($tokenData->draftId) => $this->requireSessionAuthorization("previewDraft:{$tokenData->draftId}"),
+            isset($tokenData->revisionId) => $this->requireSessionAuthorization("previewRevision:{$tokenData->revisionId}"),
+            default => $this->requireSessionAuthorization("previewElement:{$tokenData->getCanonicalId()}"),
         };
 
         $token = $tokens->createPreviewToken([
@@ -85,7 +86,7 @@ public function preview(Request $request, Kernel $kernel, RouteToken $tokenData)
             }
 
             $element->previewing = true;
-            \Craft::$app->getElements()->setPlaceholderElement($element);
+            Craft::$app->getElements()->setPlaceholderElement($element);
         }
 
         /** @var \Illuminate\Support\Uri $originalUri */

src/Http/Controllers/StructuresController.php

@@ -4,6 +4,7 @@
 
 namespace CraftCms\Cms\Http\Controllers;
 
+use Craft;
 use craft\base\ElementInterface;
 use CraftCms\Cms\Http\EnforcesPermissions;
 use CraftCms\Cms\Http\RespondsWithFlash;
@@ -36,15 +37,15 @@ public function __construct(
             'siteId' => ['required', 'integer'],
         ]);
 
-        $this->requirePermission("editStructure:$structureId");
+        $this->requireSessionAuthorization("editStructure:$structureId");
 
         abort_if(
             is_null($this->structure = $structures->getStructureById($structureId)),
             404,
             'Structure not found.'
         );
 
-        $elementsService = \Craft::$app->getElements();
+        $elementsService = Craft::$app->getElements();
 
         abort_if(
             is_null($elementType = $elementsService->getElementTypeById($elementId)),
@@ -77,10 +78,10 @@ public function moveElement(): Response
         $prevElementId = $this->request->input('prevId');
 
         if ($prevElementId) {
-            $prevElement = \Craft::$app->getElements()->getElementById($prevElementId, null, $this->element->siteId);
+            $prevElement = Craft::$app->getElements()->getElementById($prevElementId, null, $this->element->siteId);
             $success = $this->structures->moveAfter($this->structure->id, $this->element, $prevElement);
         } elseif ($parentElementId) {
-            $parentElement = \Craft::$app->getElements()->getElementById($parentElementId, null, $this->element->siteId);
+            $parentElement = Craft::$app->getElements()->getElementById($parentElementId, null, $this->element->siteId);
             $success = $this->structures->prepend($this->structure->id, $this->element, $parentElement);
         } else {
             $success = $this->structures->prependToRoot($this->structure->id, $this->element);

src/Http/EnforcesPermissions.php

@@ -39,6 +39,13 @@ protected function enforceEditEntryPermissions(Entry $entry, bool $duplicate = f
         abort_unless($canSave, 403, 'User is not authorized to perform this action.');
     }
 
+    protected function requireSessionAuthorization(string $permission): void
+    {
+        if (! Craft::$app->getSession()->checkAuthorization($permission)) {
+            abort(403, 'User is not authorized to perform this action.');
+        }
+    }
+
     protected function requirePermission(string $permission): void
     {
         if (! $user = Auth::user()) {

src/Structure/Data/Structure.php

@@ -4,7 +4,7 @@
 
 namespace CraftCms\Cms\Structure\Data;
 
-use Illuminate\Support\Facades\Auth;
+use Craft;
 use Spatie\LaravelData\Dto;
 
 final class Structure extends Dto
@@ -17,6 +17,6 @@ public function __construct(
 
     public function isSortable(): bool
     {
-        return Auth::user()?->can("editStructure:{$this->id}");
+        return Craft::$app->getSession()->checkAuthorization("editStructure:{$this->id}");
     }
 }