Require the Create action when saving a create form

src/Tests/Grand.Web.Admin.Tests/Controllers/CreateActionPermissionTests.cs

@@ -0,0 +1,40 @@
+using System.Reflection;
+using Grand.Domain.Permissions;
+using Grand.Web.Admin.Controllers;
+using Grand.Web.AdminShared.Controllers;
+using Grand.Web.Common.Security.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+
+namespace Grand.Web.Admin.Tests.Controllers;
+
+[TestClass]
+public class CreateActionPermissionTests
+{
+    // Opening a create form and submitting it are one operation, so a form that requires
+    // PermissionActionName.Create has to be submitted under the same action.
+    [TestMethod]
+    public void CreateFormPost_RequiresTheSameActionAsItsForm()
+    {
+        var forms = new[] { typeof(BaseProductController).Assembly, typeof(VendorController).Assembly }
+            .SelectMany(assembly => assembly.GetTypes())
+            .Where(type => typeof(Controller).IsAssignableFrom(type))
+            .SelectMany(type => type.GetMethods(BindingFlags.Public | BindingFlags.Instance | BindingFlags.DeclaredOnly))
+            .GroupBy(method => $"{method.DeclaringType!.Name}.{method.Name}")
+            .Where(action => action.Any(method => !IsPost(method) && RequiredAction(method) == PermissionActionName.Create))
+            .ToList();
+
+        var mismatched = forms
+            .Where(action => action.Any(method => IsPost(method) && RequiredAction(method) != PermissionActionName.Create))
+            .Select(action => action.Key)
+            .ToList();
+
+        Assert.IsTrue(forms.Any(action => action.Key == "BaseProductController.Create"));
+        Assert.AreEqual(0, mismatched.Count, string.Join(", ", mismatched));
+    }
+
+    private static bool IsPost(MethodInfo method) => method.IsDefined(typeof(HttpPostAttribute), false);
+
+    private static string RequiredAction(MethodInfo method) =>
+        method.GetCustomAttribute<PermissionAuthorizeActionAttribute>()?.PermissionAction;
+}

src/Web/Grand.Web.Admin/Controllers/AffiliateController.cs

@@ -72,7 +72,7 @@ public async Task<IActionResult> Create()
         return View(model);
     }
 
-    [PermissionAuthorizeAction(PermissionActionName.Edit)]
+    [PermissionAuthorizeAction(PermissionActionName.Create)]
     [HttpPost]
     [ArgumentNameFilter(KeyName = "save-continue", Argument = "continueEditing")]
     public async Task<IActionResult> Create(AffiliateModel model, bool continueEditing)

src/Web/Grand.Web.Admin/Controllers/CampaignController.cs

@@ -134,7 +134,7 @@ public async Task<IActionResult> Create()
         return View(model);
     }
 
-    [PermissionAuthorizeAction(PermissionActionName.Edit)]
+    [PermissionAuthorizeAction(PermissionActionName.Create)]
     [HttpPost]
     [ArgumentNameFilter(KeyName = "save-continue", Argument = "continueEditing")]
     public async Task<IActionResult> Create(CampaignModel model, bool continueEditing)

src/Web/Grand.Web.Admin/Controllers/CourseController.cs

@@ -145,7 +145,7 @@ public async Task<IActionResult> Create()
         return View(model);
     }
 
-    [PermissionAuthorizeAction(PermissionActionName.Edit)]
+    [PermissionAuthorizeAction(PermissionActionName.Create)]
     [HttpPost]
     [ArgumentNameFilter(KeyName = "save-continue", Argument = "continueEditing")]
     public async Task<IActionResult> Create(CourseModel model, bool continueEditing)
@@ -367,7 +367,7 @@ public async Task<IActionResult> CreateLesson(string courseId)
         return View(model);
     }
 
-    [PermissionAuthorizeAction(PermissionActionName.Edit)]
+    [PermissionAuthorizeAction(PermissionActionName.Create)]
     [HttpPost]
     [ArgumentNameFilter(KeyName = "save-continue", Argument = "continueEditing")]
     public async Task<IActionResult> CreateLesson(CourseLessonModel model, bool continueEditing)

src/Web/Grand.Web.Admin/Controllers/CustomerGroupController.cs

@@ -85,7 +85,7 @@ public IActionResult Create()
         return View(model);
     }
 
-    [PermissionAuthorizeAction(PermissionActionName.Edit)]
+    [PermissionAuthorizeAction(PermissionActionName.Create)]
     [HttpPost]
     [ArgumentNameFilter(KeyName = "save-continue", Argument = "continueEditing")]
     public async Task<IActionResult> Create(CustomerGroupModel model, bool continueEditing)

src/Web/Grand.Web.Admin/Controllers/DocumentController.cs

@@ -71,7 +71,7 @@ public async Task<IActionResult> CreateDocument(SimpleDocumentModel simpleModel)
         return View(model);
     }
 
-    [PermissionAuthorizeAction(PermissionActionName.Edit)]
+    [PermissionAuthorizeAction(PermissionActionName.Create)]
     [HttpPost]
     [ArgumentNameFilter(KeyName = "save-continue", Argument = "continueEditing")]
     public async Task<IActionResult> CreateDocument(DocumentModel model, bool continueEditing)
@@ -170,7 +170,7 @@ public IActionResult CreateType()
         return View(model);
     }
 
-    [PermissionAuthorizeAction(PermissionActionName.Edit)]
+    [PermissionAuthorizeAction(PermissionActionName.Create)]
     [HttpPost]
     [ArgumentNameFilter(KeyName = "save-continue", Argument = "continueEditing")]
     public async Task<IActionResult> CreateType(DocumentTypeModel model, bool continueEditing)

src/Web/Grand.Web.Admin/Controllers/KnowledgebaseController.cs

@@ -79,7 +79,7 @@ public async Task<IActionResult> CreateCategory()
         return View(model);
     }
 
-    [PermissionAuthorizeAction(PermissionActionName.Edit)]
+    [PermissionAuthorizeAction(PermissionActionName.Create)]
     [HttpPost]
     [ArgumentNameFilter(KeyName = "save-continue", Argument = "continueEditing")]
     public async Task<IActionResult> CreateCategory(KnowledgebaseCategoryModel model, bool continueEditing)
@@ -182,7 +182,7 @@ public async Task<IActionResult> CreateArticle(string parentCategoryId)
         return View(model);
     }
 
-    [PermissionAuthorizeAction(PermissionActionName.Edit)]
+    [PermissionAuthorizeAction(PermissionActionName.Create)]
     [HttpPost]
     [ArgumentNameFilter(KeyName = "save-continue", Argument = "continueEditing")]
     public async Task<IActionResult> CreateArticle(KnowledgebaseArticleModel model, bool continueEditing)

src/Web/Grand.Web.Admin/Controllers/VendorController.cs

@@ -116,7 +116,7 @@ public async Task<IActionResult> Create()
         return View(model);
     }
 
-    [PermissionAuthorizeAction(PermissionActionName.Edit)]
+    [PermissionAuthorizeAction(PermissionActionName.Create)]
     [HttpPost]
     [ArgumentNameFilter(KeyName = "save-continue", Argument = "continueEditing")]
     public async Task<IActionResult> Create(VendorModel model, bool continueEditing)

src/Web/Grand.Web.AdminShared/Controllers/BaseBlogController.cs

@@ -91,7 +91,7 @@ public async Task<IActionResult> Create()
         return View(model);
     }
 
-    [PermissionAuthorizeAction(PermissionActionName.Edit)]
+    [PermissionAuthorizeAction(PermissionActionName.Create)]
     [HttpPost]
     [ArgumentNameFilter(KeyName = "save-continue", Argument = "continueEditing")]
     public async Task<IActionResult> Create(BlogPostModel model, bool continueEditing)
@@ -252,7 +252,7 @@ public async Task<IActionResult> CategoryCreate()
         return View(model);
     }
 
-    [PermissionAuthorizeAction(PermissionActionName.Edit)]
+    [PermissionAuthorizeAction(PermissionActionName.Create)]
     [HttpPost]
     [ArgumentNameFilter(KeyName = "save-continue", Argument = "continueEditing")]
     public async Task<IActionResult> CategoryCreate(BlogCategoryModel model, bool continueEditing)

src/Web/Grand.Web.AdminShared/Controllers/BaseBrandController.cs

@@ -106,7 +106,7 @@ public async Task<IActionResult> Create([FromServices] CatalogSettings catalogSe
         return View(model);
     }
 
-    [PermissionAuthorizeAction(PermissionActionName.Edit)]
+    [PermissionAuthorizeAction(PermissionActionName.Create)]
     [HttpPost]
     [ArgumentNameFilter(KeyName = "save-continue", Argument = "continueEditing")]
     public async Task<IActionResult> Create(BrandModel model, bool continueEditing)

src/Web/Grand.Web.AdminShared/Controllers/BaseCategoryController.cs

@@ -84,7 +84,7 @@ public async Task<IActionResult> Create()
         return View(model);
     }
 
-    [PermissionAuthorizeAction(PermissionActionName.Edit)]
+    [PermissionAuthorizeAction(PermissionActionName.Create)]
     [HttpPost]
     [ArgumentNameFilter(KeyName = "save-continue", Argument = "continueEditing")]
     public async Task<IActionResult> Create(CategoryModel model, bool continueEditing)

src/Web/Grand.Web.AdminShared/Controllers/BaseCollectionController.cs

@@ -107,7 +107,7 @@ public async Task<IActionResult> Create([FromServices] CatalogSettings catalogSe
         return View(model);
     }
 
-    [PermissionAuthorizeAction(PermissionActionName.Edit)]
+    [PermissionAuthorizeAction(PermissionActionName.Create)]
     [HttpPost]
     [ArgumentNameFilter(KeyName = "save-continue", Argument = "continueEditing")]
     public async Task<IActionResult> Create(CollectionModel model, bool continueEditing)

src/Web/Grand.Web.AdminShared/Controllers/BaseNewsController.cs

@@ -81,7 +81,7 @@ public async Task<IActionResult> Create()
         return View(model);
     }
 
-    [PermissionAuthorizeAction(PermissionActionName.Edit)]
+    [PermissionAuthorizeAction(PermissionActionName.Create)]
     [HttpPost]
     [ArgumentNameFilter(KeyName = "save-continue", Argument = "continueEditing")]
     public async Task<IActionResult> Create(NewsItemModel model, bool continueEditing)

src/Web/Grand.Web.AdminShared/Controllers/BasePageController.cs

@@ -90,7 +90,7 @@ public async Task<IActionResult> Create()
         return View(model);
     }
 
-    [PermissionAuthorizeAction(PermissionActionName.Edit)]
+    [PermissionAuthorizeAction(PermissionActionName.Create)]
     [HttpPost]
     [ArgumentNameFilter(KeyName = "save-continue", Argument = "continueEditing")]
     public async Task<IActionResult> Create(PageModel model, bool continueEditing)

src/Web/Grand.Web.AdminShared/Controllers/BaseProductController.cs

@@ -89,7 +89,7 @@ public async Task<IActionResult> Create()
         return View(model);
     }
 
-    [PermissionAuthorizeAction(PermissionActionName.Edit)]
+    [PermissionAuthorizeAction(PermissionActionName.Create)]
     [HttpPost]
     [ArgumentNameFilter(KeyName = "save-continue", Argument = "continueEditing")]
     public async Task<IActionResult> Create(ProductModel model, bool continueEditing)

src/Web/Grand.Web.AdminShared/Controllers/BaseShipmentController.cs

@@ -180,7 +180,7 @@ public async Task<IActionResult> AddShipment(string orderId)
         return View(model);
     }
 
-    [PermissionAuthorizeAction(PermissionActionName.Edit)]
+    [PermissionAuthorizeAction(PermissionActionName.Create)]
     [HttpPost]
     [ArgumentNameFilter(KeyName = "save-continue", Argument = "continueEditing")]
     public async Task<IActionResult> AddShipment(AddShipmentModel model, bool continueEditing)