[KrzysztofPajak]

Type: bugfix

Issue

A create form requires the Create action to open, but 19 actions check Edit when the form is saved. A customer group allowed to create but not to edit gets the form, fills it in, and is denied on save. The permission screen also does not do what it says: the two actions cannot be set independently for these entities.

Discounts, gift vouchers, customers, stores and several others already use Create on both sides.

Solution

Saving a form now requires the action its form requires. The attribute changes on the POST of:

• BaseBlogController (Create, CategoryCreate), BaseBrandController, BaseCategoryController, BaseCollectionController, BaseNewsController, BasePageController, BaseProductController and BaseShipmentController (AddShipment), shared by the panels
• AffiliateController, CampaignController, CourseController (Create, CreateLesson), CustomerGroupController, DocumentController (CreateDocument, CreateType), KnowledgebaseController (CreateCategory, CreateArticle) and VendorController in Admin

Popups that add a child record to an entity being edited, such as attribute values and tier prices, stay as they are: their form and their POST both use Edit.

CreateActionPermissionTests checks every Admin and AdminShared action whose form requires Create, so a new action cannot drift from its form.

No new resources, settings or migrations.

Breaking changes

A plugin or client that posts directly to one of these actions now needs the Create action instead of Edit. Anyone who can open the form can still save it, because both sides now check the same action. URLs and signatures are unchanged.

Testing

Unit tests pass: Grand.Web.Admin.Tests (1840), Grand.Web.Store.Tests (188), Grand.Web.Vendor.Tests (53). The new test fails without the attribute changes. The steps below were not run in a browser.

1. In Admin, open /Admin/Permission/Index and open the actions of the categories permission for a staff customer group.
2. Deny Edit and allow Create, List and Preview.
3. Sign in as a member of that group and create a category. It saves.
4. Back in Admin, allow Edit and deny Create for the same group.
5. As that member, open the category list and choose Add new. Access is denied, as it was before this change.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.