TASK: Add ability for read-only users to interact with nodes in the preview page and view node data in the inspector #3921

JamesAlias · 2025-02-12T10:23:26Z

What I did
Previous Behaviour:

When a view-only user clicks on a node on the preview page nothing happens.
The user can only select nodes via the content tree (left sidebar)
The user can not see any node data in the inspector (right sidebar)

Fixed Behaviour:

The user can interact with nodes on the preview page (highlighting is visible)
The user can view - but not edit - node data in the inspector (right sidebar)

How I did it

I let the backend send metadata to the client when the user has permission to read (previously it was only sent, when the user had permission to edit).
I handle the read-only case in CKEditor to prevent the user from editing and throwing errors that way.

This should also apply to read-only workspaces.

Note: When I tested editing content via circumventing browser behaviour (disabled fields etc) the server responded with an error. This has not been a very thorough test though.

How to verify it

Create a role (e.g. with the Sandstorm.NeosAcl package) that has permission to view but not to edit/create.
When browsing content the user should be able to click on nodes in the preview page and see their data in the inspector.

BEFORE

AFTER

…nd view node data in inspector

** THIS HAS TO BE REVERTED BEFORE MERGE ** There is no tag for this dev branch in neos-ui-compiled. just use 8.4.

packages/neos-ui-guest-frame/src/initializePropertyDomNode.js

packages/neos-ui-guest-frame/src/initializeGuestFrame.js

Classes/Aspects/AugmentationAspect.php

JamesAlias · 2025-02-12T10:49:24Z

composer.json

  "require": {
    "neos/neos": "^8.3.0",
-    "neos/neos-ui-compiled": "self.version"
+    "neos/neos-ui-compiled": "8.4.x-dev"


!!!Revert this before merging!!!

I had to do this to allow composer to install an existing neos/neos-ui-compiled version.

You could have probably also did this override from your root composer.json.
I don' remember having this issue.

I will revert this right before merging

skurfuerst

I really like this change; I reviewed this in depth.

IMHO, the functional change is a BUGFIX; so no need for a feature flag from my side.

Thanks <3

Sebobo

Thx for the change, this is useful!

Please look at my suggestion and solve the todos.

Classes/Service/NodePolicyService.php

mhsdesign · 2025-02-21T15:51:23Z

packages/neos-ui-ckeditor5-bindings/src/ckEditorApi.js

-                    debouncedOnChange.flush();
-                    return
-                }
+            editor.isReadOnly = isReadOnly;


i think i also attempted to use the IsReadOnly flag from ck and that did not work always correctly ... instead in #3842 i made it work by just NOT booting the ckeditor when there is no reason too and think we should do the same here? Not booting the ckeditor and still showing an outline or something is imo much more stable.

I see your point and feel free to implement this. For me personally I don't have the time and as long as it works like intended I will just keep it like this.

Sebobo

Works fine for me now.

Just noticed one editor that doesn't show a proper disabled state:

Not related to your change though.

mhsdesign

Okay aside from the comment regarding the ckeditor thing i actually cant get this change to work:

The neos ui doesnt go in restricted editing mode and i can still edit things and get raw errors back

Access denied for method Method: Neos\ContentRepository\Domain\Model\Node::setProperty() Evaluated following 1 privilege target(s): "RestrictEditing": ABSTAIN (0 granted, 0 denied, 1 abstained) Authenticated roles: Neos.Flow:Everybody, Neos.Flow:AuthenticatedUser, Neos.Neos:Administrator, Neos.Neos:Editor, Neos.Neos:AbstractEditor, Neos.ContentRepository:Administrator, Neos.ContentRepository:InternalWorkspaceAccess, Neos.Neos:LivePublisher

this is the configuration i used

privilegeTargets:
  'Neos\ContentRepository\Security\Authorization\Privilege\Node\EditNodePrivilege':
    'RestrictEditing':
      matcher: 'isDescendantNodeOf("/sites/")'

  'Neos\ContentRepository\Security\Authorization\Privilege\Node\ReadNodePropertyPrivilege':
    'RestrictReading':
      matcher: 'isDescendantNodeOf("/sites/")'

roles:
  'Neos.Neos:Editor':
    privileges:
      -
        privilegeTarget: 'RestrictReading'
        permission: GRANT

mhsdesign · 2025-03-06T12:55:04Z

Classes/Service/NodePolicyService.php

+     */
+    public function canReadNode(NodeInterface $node): bool
+    {
+        if (!isset(self::getUsedPrivilegeClassNames($this->objectManager)[ReadNodePropertyPrivilege::class])) {


The symbol ReadNodePropertyPrivilege was not imported and thus this is just a noop and returns always true

And when i import it i get a an exception

ReadNodePropertyPrivilege only support subjects of type PropertyAwareNodePrivilegeSubject or MethodPrivilegeSubject, but we got a subject of type: NodePrivilegeSubject

We decided to use the ReadNodePrivilege, which actually exists.

Some Context: The user will not see a node he can not read, so this check is obsolete. We still keep it for AOP shenanigans though.

okay i will have to retest now as we use the ReadNodePrivilege now instead of ReadNodePropertyPrivilege

@mhsdesign I will merge this next week on Tuesday or Wednesday.
If you like, you can test this again.
Thank you for the reviews so far 😊

mhsdesign · 2025-03-06T12:55:08Z

composer.json

  "require": {
    "neos/neos": "^8.3.0",
-    "neos/neos-ui-compiled": "self.version"
+    "neos/neos-ui-compiled": "8.4.x-dev"


mhsdesign · 2025-10-07T08:02:53Z

Hi dear Robert.

We just dug out this one ;)

Sebastian and me just re-reviewed and retested this to evaluate if it can make it as a late candidate in to the 8.4 release.

In the demo i used this policy so no one can edit the blog page of the demo

privilegeTargets:
  'Neos\ContentRepository\Security\Authorization\Privilege\Node\EditNodePrivilege':
    'RestrictEditing':
      matcher: 'isDescendantNodeOf("/sites/neosdemo/node-iyyapnswso4eu")'

On a blog page

Typing also still continues to work in the inspector and yields raw errors.

Access denied for method Method: Neos\ContentRepository\Domain\Model\Node::setProperty() Evaluated following 1 privilege target(s): "RestrictEditing": ABSTAIN (0 granted, 0 denied, 1 abstained) Authenticated roles: Neos.Flow:Everybody, Neos.Flow:AuthenticatedUser, Neos.Neos:Editor, Neos.Neos:AbstractEditor, Neos.ContentRepository:Administrator, Neos.ContentRepository:InternalWorkspaceAccess, Neos.Neos:LivePublisher

Sebastian and me found a place to disable the editor in the InspectorEditorEnvelope::options() method by checking if node.policy.canEdit is false. This would disable the editors which is i think what this change wants to do?

Typing also still continues to work in CKEditor and yields raw errors and needs some love?.

Access denied for method Method: Neos\ContentRepository\Domain\Model\Node::setProperty() Evaluated following 1 privilege target(s): "RestrictEditing": ABSTAIN (0 granted, 0 denied, 1 abstained) Authenticated roles: Neos.Flow:Everybody, Neos.Flow:AuthenticatedUser, Neos.Neos:Editor, Neos.Neos:AbstractEditor, Neos.ContentRepository:Administrator, Neos.ContentRepository:InternalWorkspaceAccess, Neos.Neos:LivePublisher

So thank you for your contribution but as the current state seems not to be working as expected which would need additional work last minute and we would not feel comfortable introducing a change to the neos ui policies that close before the release. Please dont be discouraged!

JamesAlias added 2 commits February 3, 2025 18:41

TASK: Add ability for view-only users to interact with preview page a…

f913346

…nd view node data in inspector

REVERT_ME: Fix composer install for testing locally

f5bf20d

** THIS HAS TO BE REVERTED BEFORE MERGE ** There is no tag for this dev branch in neos-ui-compiled. just use 8.4.

github-actions bot added Task 8.4 labels Feb 12, 2025

JamesAlias force-pushed the task/add-ability-for-view_only-users-to-interact-with-preview-page-and-view-data-in-inspector branch from f5bf20d to f913346 Compare February 12, 2025 10:23

JamesAlias self-assigned this Feb 12, 2025

JamesAlias requested a review from skurfuerst February 12, 2025 10:24

JamesAlias commented Feb 12, 2025

View reviewed changes

packages/neos-ui-guest-frame/src/initializePropertyDomNode.js Outdated Show resolved Hide resolved

JamesAlias commented Feb 12, 2025

View reviewed changes

packages/neos-ui-guest-frame/src/initializeGuestFrame.js Outdated Show resolved Hide resolved

JamesAlias commented Feb 12, 2025

View reviewed changes

Classes/Aspects/AugmentationAspect.php Outdated Show resolved Hide resolved

TASK: Fix linting error

fe9c23d

JamesAlias commented Feb 12, 2025

View reviewed changes

skurfuerst approved these changes Feb 14, 2025

View reviewed changes

Sebobo requested changes Feb 14, 2025

View reviewed changes

Classes/Service/NodePolicyService.php Outdated Show resolved Hide resolved

TASK: Fix Review issues

676d25b

JamesAlias requested a review from Sebobo February 17, 2025 09:51

JamesAlias force-pushed the task/add-ability-for-view_only-users-to-interact-with-preview-page-and-view-data-in-inspector branch from bd02edc to 676d25b Compare February 17, 2025 11:48

JamesAlias added the Bug Label to mark the change as bugfix label Feb 18, 2025

mhsdesign reviewed Feb 21, 2025

View reviewed changes

Sebobo approved these changes Feb 25, 2025

View reviewed changes

mhsdesign requested changes Mar 6, 2025

View reviewed changes

TASK: Change inspector node property access decision

b58e4c5

JamesAlias requested a review from mhsdesign March 31, 2025 09:45

markusguenther added this to Neos 8.4 Release Board Jul 8, 2025

markusguenther moved this to Review Required 👀 in Neos 8.4 Release Board Jul 8, 2025

Sebobo moved this from Review Required 👀 to Nice to have - upmerge problem in Neos 8.4 Release Board Aug 21, 2025

mhsdesign marked this pull request as draft October 7, 2025 08:03

mhsdesign moved this from Nice to have - upmerge problem to In progress, but not this time ... in Neos 8.4 Release Board Oct 7, 2025

Uh oh!

TASK: Add ability for read-only users to interact with nodes in the preview page and view node data in the inspector #3921

Are you sure you want to change the base?

TASK: Add ability for read-only users to interact with nodes in the preview page and view node data in the inspector #3921

Uh oh!

Conversation

JamesAlias commented Feb 12, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

JamesAlias Feb 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

skurfuerst left a comment

Choose a reason for hiding this comment

Uh oh!

Sebobo left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Sebobo left a comment

Choose a reason for hiding this comment

Uh oh!

mhsdesign left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mhsdesign commented Oct 7, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

JamesAlias Feb 12, 2025 •

edited

Loading