EZP-32321: Added deleteTranslations target to fix 'content/remove' permission check

eZ/Publish/API/Repository/Tests/ContentServiceAuthorizationTest.php

@@ -10,6 +10,7 @@
 use eZ\Publish\API\Repository\Repository;
 use eZ\Publish\API\Repository\Values\Content\ContentInfo;
 use eZ\Publish\API\Repository\Values\Content\Location;
+use eZ\Publish\API\Repository\Values\User\Limitation\LanguageLimitation;
 use eZ\Publish\API\Repository\Values\User\Limitation\LocationLimitation;
 use eZ\Publish\API\Repository\Values\User\Limitation\SubtreeLimitation;
 
@@ -584,6 +585,56 @@ public function testDeleteContentThrowsUnauthorizedException()
         $this->contentService->deleteContent($contentInfo);
     }
 
+    /**
+     * @covers \eZ\Publish\API\Repository\ContentService::deleteContent()
+     */
+    public function testDeleteContentThrowsUnauthorizedExceptionWithLanguageLimitation(): void
+    {
+        $contentVersion2 = $this->createMultipleLanguageContentVersion2();
+        $contentInfo = $contentVersion2->contentInfo;
+        $limitations = [
+            new LanguageLimitation(['limitationValues' => ['eng-US']]),
+        ];
+
+        $user = $this->createUserWithPolicies(
+            'user',
+            [
+                ['module' => 'content', 'function' => 'remove', 'limitations' => $limitations],
+            ]
+        );
+
+        $this->permissionResolver->setCurrentUserReference($user);
+
+        $this->expectException(UnauthorizedException::class);
+        $this->expectExceptionMessageRegExp('/\'remove\' \'content\'/');
+
+        $this->contentService->deleteContent($contentInfo);
+    }
+
+    /**
+     * @covers \eZ\Publish\API\Repository\ContentService::deleteContent()
+     */
+    public function testDeleteContentWithLanguageLimitation(): void
+    {
+        $contentVersion2 = $this->createMultipleLanguageContentVersion2();
+        $contentInfo = $contentVersion2->contentInfo;
+
+        $limitations = [
+            new LanguageLimitation(['limitationValues' => ['eng-US', 'eng-GB']]),
+        ];
+
+        $user = $this->createUserWithPolicies(
+            'user',
+            [
+                ['module' => 'content', 'function' => 'remove', 'limitations' => $limitations],
+            ]
+        );
+
+        $this->permissionResolver->setCurrentUserReference($user);
+
+        self::assertSame([$contentInfo->mainLocationId], $this->contentService->deleteContent($contentInfo));
+    }
+
     /**
      * Test for the createContentDraft() method.
      *

eZ/Publish/API/Repository/Tests/Limitation/PermissionResolver/LanguageLimitationIntegrationTest.php

@@ -9,6 +9,7 @@
 namespace eZ\Publish\API\Repository\Tests\Limitation\PermissionResolver;
 
 use eZ\Publish\API\Repository\Values\User\Limitation\LanguageLimitation;
+use eZ\Publish\SPI\Limitation\Target;
 
 /**
  * Integration test for chosen use cases of calls to PermissionResolver::canUser.
@@ -160,4 +161,117 @@ public function testCanUserPublishContent(array $limitations, bool $expectedResu
 
         $this->assertCanUser($expectedResult, 'content', 'publish', $limitations, $content);
     }
+
+    /**
+     * Data provider for testCanUserDeleteContent.
+     *
+     * @see testCanUserDeleteContent
+     */
+    public function providerForCanUserDeleteContent(): array
+    {
+        $limitationForGerman = new LanguageLimitation();
+        $limitationForGerman->limitationValues = [self::LANG_GER_DE];
+
+        $limitationForBritishEnglish = new LanguageLimitation();
+        $limitationForBritishEnglish->limitationValues = [self::LANG_ENG_GB];
+
+        $multilingualLimitation = new LanguageLimitation();
+        $multilingualLimitation->limitationValues = [self::LANG_ENG_GB, self::LANG_GER_DE];
+
+        return [
+            [[$limitationForBritishEnglish], false],
+            [[$limitationForGerman], false],
+            // dealing with British and German content, so true only for multilingual Language Limitation
+            [[$multilingualLimitation], true],
+        ];
+    }
+
+    /**
+     * @dataProvider providerForCanUserDeleteContent
+     *
+     * @param \eZ\Publish\API\Repository\Values\User\Limitation[] $limitations
+     * @param bool $expectedResult
+     *
+     * @throws \eZ\Publish\API\Repository\Exceptions\ForbiddenException
+     * @throws \eZ\Publish\API\Repository\Exceptions\NotFoundException
+     * @throws \eZ\Publish\API\Repository\Exceptions\UnauthorizedException
+     */
+    public function testCanUserDeleteContent(array $limitations, bool $expectedResult): void
+    {
+        $content = $this->createFolder(
+            [
+                self::LANG_ENG_GB => 'British Folder',
+                self::LANG_GER_DE => 'German Folder',
+            ],
+            2
+        );
+
+        $this->loginAsEditorUserWithLimitations('content', 'remove', $limitations);
+
+        $target = (new Target\Version())->deleteTranslations($content->getVersionInfo()->languageCodes);
+        $this->assertCanUser($expectedResult, 'content', 'remove', $limitations, $content, [$target]);
+    }
+
+    /**
+     * Data provider for testCanUserDeleteContentTranslation.
+     *
+     * @see testCanUserDeleteContentTranslation
+     */
+    public function providerForCanUserDeleteContentTranslation(): iterable
+    {
+        $limitationForGerman = new LanguageLimitation();
+        $limitationForGerman->limitationValues = [self::LANG_GER_DE];
+
+        $limitationForBritishEnglish = new LanguageLimitation();
+        $limitationForBritishEnglish->limitationValues = [self::LANG_ENG_GB];
+
+        $multilingualLimitation = new LanguageLimitation();
+        $multilingualLimitation->limitationValues = [self::LANG_ENG_US, self::LANG_GER_DE];
+
+        yield 'Limitation with eng-GB should return true for eng-GB translation' => [
+            [$limitationForBritishEnglish],
+            self::LANG_ENG_GB,
+            true,
+        ];
+
+        yield 'Limitation with ger-de should return false for eng-GB translation' => [
+            [$limitationForGerman],
+            self::LANG_ENG_GB,
+            false,
+        ];
+
+        yield 'Limitation with neg-US and ger-de should return true for eng-US translation' => [
+            [$multilingualLimitation],
+            self::LANG_ENG_US,
+            true,
+        ];
+    }
+
+    /**
+     * @dataProvider providerForCanUserDeleteContentTranslation
+     *
+     * @param \eZ\Publish\API\Repository\Values\User\Limitation[] $limitations
+     * @param string $translation
+     * @param bool $expectedResult
+     *
+     * @throws \eZ\Publish\API\Repository\Exceptions\ForbiddenException
+     * @throws \eZ\Publish\API\Repository\Exceptions\NotFoundException
+     * @throws \eZ\Publish\API\Repository\Exceptions\UnauthorizedException
+     */
+    public function testCanUserDeleteContentTranslation(array $limitations, string $translation, bool $expectedResult): void
+    {
+        $content = $this->createFolder(
+            [
+                self::LANG_ENG_GB => 'British Folder',
+                self::LANG_GER_DE => 'German Folder',
+                self::LANG_ENG_US => 'US Folder',
+            ],
+            2
+        );
+
+        $this->loginAsEditorUserWithLimitations('content', 'remove', $limitations);
+
+        $target = (new Target\Builder\VersionBuilder())->translateToAnyLanguageOf([$translation])->build();
+        $this->assertCanUser($expectedResult, 'content', 'remove', $limitations, $content, [$target]);
+    }
 }

eZ/Publish/API/Repository/Tests/LocationServiceAuthorizationTest.php

@@ -6,7 +6,9 @@
  */
 namespace eZ\Publish\API\Repository\Tests;
 
+use eZ\Publish\API\Repository\Exceptions\UnauthorizedException;
 use eZ\Publish\API\Repository\Values\Content\Location;
+use eZ\Publish\API\Repository\Values\User\Limitation\LanguageLimitation;
 use eZ\Publish\API\Repository\Values\User\Limitation\OwnerLimitation;
 use eZ\Publish\API\Repository\Values\User\Limitation\SubtreeLimitation;
 
@@ -384,6 +386,39 @@ public function testDeleteLocationThrowsUnauthorizedException()
         /* END: Use Case */
     }
 
+    /**
+     * @covers \eZ\Publish\API\Repository\LocationService::deleteLocation()
+     */
+    public function testDeleteLocationThrowsUnauthorizedExceptionWithLanguageLimitation(): void
+    {
+        $repository = $this->getRepository();
+        $mediaLocationId = $this->generateId('location', 43);
+
+        $locationService = $repository->getLocationService();
+        $location = $locationService->loadLocation($mediaLocationId);
+
+        $limitations = [
+            new LanguageLimitation(['limitationValues' => ['ger-DE']]),
+        ];
+
+        $user = $this->createUserWithPolicies(
+            'user',
+            [
+                ['module' => 'content', 'function' => 'remove', 'limitations' => $limitations],
+                ['module' => 'content', 'function' => 'read'],
+                ['module' => 'content', 'function' => 'manage_locations'],
+            ]
+        );
+
+        $permissionResolver = $repository->getPermissionResolver();
+        $permissionResolver->setCurrentUserReference($user);
+
+        $this->expectException(UnauthorizedException::class);
+        $this->expectExceptionMessageRegExp('/\'remove\' \'content\'/');
+
+        $locationService->deleteLocation($location);
+    }
+
     /**
      * Test for the deleteLocation() method.
      *

eZ/Publish/API/Repository/Tests/TrashServiceAuthorizationTest.php

@@ -8,6 +8,7 @@
 
 use eZ\Publish\API\Repository\Exceptions\UnauthorizedException;
 use eZ\Publish\API\Repository\Values\Content\Location;
+use eZ\Publish\API\Repository\Values\User\Limitation\LanguageLimitation;
 use eZ\Publish\API\Repository\Values\User\Limitation\ObjectStateLimitation;
 use eZ\Publish\Core\Repository\Repository;
 use eZ\Publish\Core\Repository\TrashService;
@@ -76,6 +77,41 @@ public function testTrashThrowsUnauthorizedException()
         $trashService->trash($mediaLocation);
     }
 
+    /**
+     * Test for the trash() method without proper permissions.
+     *
+     * @covers \eZ\Publish\API\Repository\TrashService::trash
+     */
+    public function testTrashThrowsUnauthorizedExceptionWithLanguageLimitation(): void
+    {
+        $repository = $this->getRepository();
+        $trashService = $repository->getTrashService();
+        $locationService = $repository->getLocationService();
+
+        // Load "Media" page location to be trashed
+        $mediaLocation = $locationService->loadLocationByRemoteId(
+            '75c715a51699d2d309a924eca6a95145'
+        );
+
+        $limitations = [
+            new LanguageLimitation(['limitationValues' => ['ger-DE']]),
+        ];
+
+        $user = $this->createUserWithPolicies(
+            'user',
+            [
+                ['module' => 'content', 'function' => 'remove', 'limitations' => $limitations],
+            ]
+        );
+
+        $repository->getPermissionResolver()->setCurrentUserReference($user);
+
+        $this->expectException(UnauthorizedException::class);
+        $this->expectExceptionMessage('User does not have access to \'remove\' \'content\'');
+
+        $trashService->trash($mediaLocation);
+    }
+
     /**
      * Test for the trash() method with proper minimal permission set.
      *

eZ/Publish/Core/Limitation/LanguageLimitation/ContentDeleteEvaluator.php

@@ -0,0 +1,40 @@
+<?php
+
+/**
+ * @copyright Copyright (C) eZ Systems AS. All rights reserved.
+ * @license For full copyright and license information view LICENSE file distributed with this source code.
+ */
+declare(strict_types=1);
+
+namespace eZ\Publish\Core\Limitation\LanguageLimitation;
+
+use eZ\Publish\API\Repository\Values\User\Limitation;
+use eZ\Publish\Core\Limitation\LanguageLimitationType;
+use eZ\Publish\SPI\Limitation\Target;
+
+/**
+ * @internal for internal use by LanguageLimitation
+ */
+final class ContentDeleteEvaluator implements VersionTargetEvaluator
+{
+    public function accept(Target\Version $targetVersion): bool
+    {
+        return !empty($targetVersion->getTranslationsToDelete());
+    }
+
+    /**
+     * Allow access if all of the given language codes for content matches limitation values.
+     */
+    public function evaluate(Target\Version $targetVersion, Limitation $limitationValue): ?bool
+    {
+        $diff = array_diff(
+            $targetVersion->getTranslationsToDelete(),
+            $limitationValue->limitationValues
+        );
+        $accessVote = empty($diff)
+            ? LanguageLimitationType::ACCESS_GRANTED
+            : LanguageLimitationType::ACCESS_DENIED;
+
+        return $accessVote;
+    }
+}