feat(core): add Forbid create object and Forbid edit object space permissions

foundations/core/packages/core/lang/cs.json

@@ -51,12 +51,16 @@
     "UpdateObject": "Aktualizovat objekt",
     "DeleteObject": "Smazat objekt",
     "ForbidDeleteObject": "Zakázat mazání objektu",
+    "ForbidCreateObject": "Zakázat vytváření objektu",
+    "ForbidUpdateObject": "Zakázat úpravu objektu",
     "UpdateSpace": "Aktualizovat prostor",
     "ArchiveSpace": "Archivovat prostor",
     "CreateObjectDescription": "Umožňuje uživatelům vytvářet objekty v prostoru",
     "UpdateObjectDescription": "Umožňuje uživatelům aktualizovat objekty v prostoru",
     "DeleteObjectDescription": "Umožňuje uživatelům mazat objekty v prostoru",
     "ForbidDeleteObjectDescription": "Zakazuje uživatelům mazání objektů v prostoru",
+    "ForbidCreateObjectDescription": "Zakazuje uživatelům vytváření objektů v prostoru",
+    "ForbidUpdateObjectDescription": "Zakazuje uživatelům úpravu objektů v prostoru",
     "UpdateSpaceDescription": "Umožňuje uživatelům aktualizovat prostor",
     "ArchiveSpaceDescription": "Umožňuje uživatelům archivovat prostor",
     "AutoJoin": "Automatické připojení",

foundations/core/packages/core/lang/de.json

@@ -51,12 +51,16 @@
     "UpdateObject": "Objekt aktualisieren",
     "DeleteObject": "Objekt löschen",
     "ForbidDeleteObject": "Objekt löschen verbieten",
+    "ForbidCreateObject": "Objekt erstellen verbieten",
+    "ForbidUpdateObject": "Objekt bearbeiten verbieten",
     "UpdateSpace": "Arbeitsbereich aktualisieren",
     "ArchiveSpace": "Arbeitsbereich archivieren",
     "CreateObjectDescription": "Gewährt Benutzern die Möglichkeit, Objekte im Arbeitsbereich zu erstellen",
     "UpdateObjectDescription": "Gewährt Benutzern die Möglichkeit, Objekte im Arbeitsbereich zu aktualisieren",
     "DeleteObjectDescription": "Gewährt Benutzern die Möglichkeit, Objekte im Arbeitsbereich zu löschen",
     "ForbidDeleteObjectDescription": "Verbietet Benutzern das Löschen von Objekten im Arbeitsbereich",
+    "ForbidCreateObjectDescription": "Verbietet Benutzern das Erstellen von Objekten im Arbeitsbereich",
+    "ForbidUpdateObjectDescription": "Verbietet Benutzern das Bearbeiten von Objekten im Arbeitsbereich",
     "UpdateSpaceDescription": "Gewährt Benutzern die Möglichkeit, den Arbeitsbereich zu aktualisieren",
     "ArchiveSpaceDescription": "Gewährt Benutzern die Möglichkeit, den Arbeitsbereich zu archivieren",
     "AutoJoin": "Automatisch beitreten",

foundations/core/packages/core/lang/en.json

@@ -51,12 +51,16 @@
     "UpdateObject": "Update object",
     "DeleteObject": "Delete object",
     "ForbidDeleteObject": "Forbid delete object",
+    "ForbidCreateObject": "Forbid create object",
+    "ForbidUpdateObject": "Forbid edit object",
     "UpdateSpace": "Update space",
     "ArchiveSpace": "Archive space",
     "CreateObjectDescription": "Grants users ability to create objects in the space",
     "UpdateObjectDescription": "Grants users ability to update objects in the space",
     "DeleteObjectDescription": "Grants users ability to delete objects in the space",
     "ForbidDeleteObjectDescription": "Forbid users deleting objects in the space",
+    "ForbidCreateObjectDescription": "Forbid users creating objects in the space",
+    "ForbidUpdateObjectDescription": "Forbid users editing objects in the space",
     "UpdateSpaceDescription": "Grants users ability to update the space",
     "ArchiveSpaceDescription": "Grants users ability to archive the space",
     "AutoJoin": "Auto join",

foundations/core/packages/core/lang/es.json

@@ -44,12 +44,16 @@
     "UpdateObject": "Actualizar objeto",
     "DeleteObject": "Eliminar objeto",
     "ForbidDeleteObject": "Prohibir eliminar objeto",
+    "ForbidCreateObject": "Prohibir crear objeto",
+    "ForbidUpdateObject": "Prohibir editar objeto",
     "UpdateSpace": "Actualizar espacio",
     "ArchiveSpace": "Archivar espacio",
     "CreateObjectDescription": "Concede a los usuarios la capacidad de crear objetos en el espacio",
     "UpdateObjectDescription": "Concede a los usuarios la capacidad de actualizar objetos en el espacio",
     "DeleteObjectDescription": "Concede a los usuarios la capacidad de eliminar objetos en el espacio",
     "ForbidDeleteObjectDescription": "Prohíbe a los usuarios eliminar objetos en el espacio",
+    "ForbidCreateObjectDescription": "Prohíbe a los usuarios crear objetos en el espacio",
+    "ForbidUpdateObjectDescription": "Prohíbe a los usuarios editar objetos en el espacio",
     "UpdateSpaceDescription": "Concede a los usuarios la capacidad de actualizar el espacio",
     "ArchiveSpaceDescription": "Concede a los usuarios la capacidad de archivar el espacio",
     "AutoJoin": "Auto unirse",

foundations/core/packages/core/lang/fr.json

@@ -51,12 +51,16 @@
     "UpdateObject": "Mettre à jour l'objet",
     "DeleteObject": "Supprimer l'objet",
     "ForbidDeleteObject": "Interdire la suppression de l'objet",
+    "ForbidCreateObject": "Interdire la création de l'objet",
+    "ForbidUpdateObject": "Interdire la modification de l'objet",
     "UpdateSpace": "Mettre à jour l'espace",
     "ArchiveSpace": "Archiver l'espace",
     "CreateObjectDescription": "Accorde aux utilisateurs la capacité de créer des objets dans l'espace",
     "UpdateObjectDescription": "Accorde aux utilisateurs la capacité de mettre à jour les objets dans l'espace",
     "DeleteObjectDescription": "Accorde aux utilisateurs la capacité de supprimer des objets dans l'espace",
     "ForbidDeleteObjectDescription": "Interdire aux utilisateurs de supprimer des objets dans l'espace",
+    "ForbidCreateObjectDescription": "Interdire aux utilisateurs de créer des objets dans l'espace",
+    "ForbidUpdateObjectDescription": "Interdire aux utilisateurs de modifier des objets dans l'espace",
     "UpdateSpaceDescription": "Accorde aux utilisateurs la capacité de mettre à jour l'espace",
     "ArchiveSpaceDescription": "Accorde aux utilisateurs la capacité d'archiver l'espace",
     "AutoJoin": "Rejoindre automatiquement",

foundations/core/packages/core/lang/it.json

@@ -51,12 +51,16 @@
     "UpdateObject": "Aggiorna oggetto",
     "DeleteObject": "Elimina oggetto",
     "ForbidDeleteObject": "Proibisci eliminazione oggetto",
+    "ForbidCreateObject": "Proibisci creazione oggetto",
+    "ForbidUpdateObject": "Proibisci modifica oggetto",
     "UpdateSpace": "Aggiorna spazio",
     "ArchiveSpace": "Archivia spazio",
     "CreateObjectDescription": "Concede agli utenti la possibilità di creare oggetti nello spazio",
     "UpdateObjectDescription": "Concede agli utenti la possibilità di aggiornare oggetti nello spazio",
     "DeleteObjectDescription": "Concede agli utenti la possibilità di eliminare oggetti nello spazio",
     "ForbidDeleteObjectDescription": "Proibisce agli utenti di eliminare oggetti nello spazio",
+    "ForbidCreateObjectDescription": "Proibisce agli utenti di creare oggetti nello spazio",
+    "ForbidUpdateObjectDescription": "Proibisce agli utenti di modificare oggetti nello spazio",
     "UpdateSpaceDescription": "Concede agli utenti la possibilità di aggiornare lo spazio",
     "ArchiveSpaceDescription": "Concede agli utenti la possibilità di archiviare lo spazio",
     "AutoJoin": "Partecipazione automatica",

foundations/core/packages/core/lang/ja.json

@@ -51,12 +51,16 @@
     "UpdateObject": "オブジェクトの更新",
     "DeleteObject": "オブジェクトの削除",
     "ForbidDeleteObject": "オブジェクトの削除禁止",
+    "ForbidCreateObject": "オブジェクトの作成禁止",
+    "ForbidUpdateObject": "オブジェクトの編集禁止",
     "UpdateSpace": "スペースの更新",
     "ArchiveSpace": "スペースのアーカイブ",
     "CreateObjectDescription": "ユーザーにスペース内でオブジェクトを作成する権限を付与します",
     "UpdateObjectDescription": "ユーザーにスペース内でオブジェクトを更新する権限を付与します",
     "DeleteObjectDescription": "ユーザーにスペース内でオブジェクトを削除する権限を付与します",
     "ForbidDeleteObjectDescription": "ユーザーによるスペース内のオブジェクトの削除を禁止します",
+    "ForbidCreateObjectDescription": "ユーザーによるスペース内のオブジェクトの作成を禁止します",
+    "ForbidUpdateObjectDescription": "ユーザーによるスペース内のオブジェクトの編集を禁止します",
     "UpdateSpaceDescription": "ユーザーにスペースを更新する権限を付与します",
     "ArchiveSpaceDescription": "ユーザーにスペースをアーカイブする権限を付与します",
     "AutoJoin": "自動参加",

foundations/core/packages/core/lang/ko.json

@@ -51,12 +51,16 @@
         "UpdateObject": "객체 업데이트",
         "DeleteObject": "객체 삭제",
         "ForbidDeleteObject": "객체 삭제 금지",
+        "ForbidCreateObject": "객체 생성 금지",
+        "ForbidUpdateObject": "객체 편집 금지",
         "UpdateSpace": "스페이스 업데이트",
         "ArchiveSpace": "스페이스 보관",
         "CreateObjectDescription": "스페이스에서 객체를 만들 수 있는 권한을 부여합니다",
         "UpdateObjectDescription": "스페이스에서 객체를 업데이트할 수 있는 권한을 부여합니다",
         "DeleteObjectDescription": "스페이스에서 객체를 삭제할 수 있는 권한을 부여합니다",
         "ForbidDeleteObjectDescription": "스페이스에서 객체 삭제를 금지합니다",
+        "ForbidCreateObjectDescription": "스페이스에서 객체 생성을 금지합니다",
+        "ForbidUpdateObjectDescription": "스페이스에서 객체 편집을 금지합니다",
         "UpdateSpaceDescription": "스페이스를 업데이트할 수 있는 권한을 부여합니다",
         "ArchiveSpaceDescription": "스페이스를 보관할 수 있는 권한을 부여합니다",
         "AutoJoin": "자동 참여",

foundations/core/packages/core/lang/pl.json

@@ -51,12 +51,16 @@
     "UpdateObject": "Zaktualizuj przedmiot",
     "DeleteObject": "Usuń przedmiot",
     "ForbidDeleteObject": "Zabroń usunięcia przedmiotu",
+    "ForbidCreateObject": "Zabroń utworzenia przedmiotu",
+    "ForbidUpdateObject": "Zabroń edycji przedmiotu",
     "UpdateSpace": "Zaktualizuj przestrzeń",
     "ArchiveSpace": "Archiwizuj przestrzeń",
     "CreateObjectDescription": "Pozwala użytkownikom tworzyć obiekty w przestrzeni",
     "UpdateObjectDescription": "Pozwala użytkownikom aktualizować obiekty w przestrzeni",
     "DeleteObjectDescription": "Pozwala użytkownikom usuwać obiekty w przestrzeni",
     "ForbidDeleteObjectDescription": "Uniemożliwia użytkownikom usuwania obiektów w przestrzeni",
+    "ForbidCreateObjectDescription": "Uniemożliwia użytkownikom tworzenie obiektów w przestrzeni",
+    "ForbidUpdateObjectDescription": "Uniemożliwia użytkownikom edycję obiektów w przestrzeni",
     "UpdateSpaceDescription": "Pozwala użytkownikom aktualizować przestrzeń",
     "ArchiveSpaceDescription": "Pozwala użytkownikom archiwizować przestrzeń",
     "AutoJoin": "Dołącz automatycznie",

foundations/core/packages/core/lang/pt-br.json

@@ -44,12 +44,16 @@
     "UpdateObject": "Atualizar objeto",
     "DeleteObject": "Apagar objeto",
     "ForbidDeleteObject": "Proibir apagar objeto",
+    "ForbidCreateObject": "Proibir criar objeto",
+    "ForbidUpdateObject": "Proibir editar objeto",
     "UpdateSpace": "Atualizar espaço",
     "ArchiveSpace": "Arquivar espaço",
     "CreateObjectDescription": "Concede aos usuários a capacidade de criar objetos no espaço",
     "UpdateObjectDescription": "Concede aos usuários a capacidade de atualizar objetos no espaço",
     "DeleteObjectDescription": "Concede aos usuários a capacidade de apagar objetos no espaço",
     "ForbidDeleteObjectDescription": "Proíbe aos usuários a capacidade de apagar objetos no espaço",
+    "ForbidCreateObjectDescription": "Proíbe aos usuários a capacidade de criar objetos no espaço",
+    "ForbidUpdateObjectDescription": "Proíbe aos usuários a capacidade de editar objetos no espaço",
     "UpdateSpaceDescription": "Concede aos usuários a capacidade de atualizar o espaço",
     "ArchiveSpaceDescription": "Concede aos usuários a capacidade de arquivar o espaço",
     "AutoJoin": "Auto adesão",

foundations/core/packages/core/lang/pt.json

@@ -44,12 +44,16 @@
     "UpdateObject": "Atualizar objeto",
     "DeleteObject": "Apagar objeto",
     "ForbidDeleteObject": "Proibir apagar objeto",
+    "ForbidCreateObject": "Proibir criar objeto",
+    "ForbidUpdateObject": "Proibir editar objeto",
     "UpdateSpace": "Atualizar espaço",
     "ArchiveSpace": "Arquivar espaço",
     "CreateObjectDescription": "Concede aos usuários a capacidade de criar objetos no espaço",
     "UpdateObjectDescription": "Concede aos usuários a capacidade de atualizar objetos no espaço",
     "DeleteObjectDescription": "Concede aos usuários a capacidade de apagar objetos no espaço",
     "ForbidDeleteObjectDescription": "Proíbe aos usuários a capacidade de apagar objetos no espaço",
+    "ForbidCreateObjectDescription": "Proíbe aos utilizadores a capacidade de criar objetos no espaço",
+    "ForbidUpdateObjectDescription": "Proíbe aos utilizadores a capacidade de editar objetos no espaço",
     "UpdateSpaceDescription": "Concede aos usuários a capacidade de atualizar o espaço",
     "ArchiveSpaceDescription": "Concede aos usuários a capacidade de arquivar o espaço",
     "AutoJoin": "Auto adesão",

foundations/core/packages/core/lang/ru.json

@@ -51,12 +51,16 @@
     "UpdateObject": "Обновлять объект",
     "DeleteObject": "Удалять объект",
     "ForbidDeleteObject": "Запретить удалять объект",
+    "ForbidCreateObject": "Запретить создавать объект",
+    "ForbidUpdateObject": "Запретить редактировать объект",
     "UpdateSpace": "Обновлять пространство",
     "ArchiveSpace": "Архивировать пространство",
     "CreateObjectDescription": "Дает пользователям разрешение создавать объекты в пространстве",
     "UpdateObjectDescription": "Дает пользователям разрешение обновлять объекты в пространстве",
     "DeleteObjectDescription": "Дает пользователям разрешение удалять объекты в пространстве",
     "ForbidDeleteObjectDescription": "Запрещает пользователям удалять объекты в пространстве",
+    "ForbidCreateObjectDescription": "Запрещает пользователям создавать объекты в пространстве",
+    "ForbidUpdateObjectDescription": "Запрещает пользователям редактировать объекты в пространстве",
     "UpdateSpaceDescription": "Дает пользователям разрешение обновлять пространство",
     "ArchiveSpaceDescription": "Дает пользователям разрешение архивировать пространство",
     "AutoJoin": "Автоприсоединение",

foundations/core/packages/core/lang/tr.json

@@ -51,12 +51,16 @@
     "UpdateObject": "Nesneyi güncelle",
     "DeleteObject": "Nesneyi sil",
     "ForbidDeleteObject": "Nesne silmeyi yasakla",
+    "ForbidCreateObject": "Nesne oluşturmayı yasakla",
+    "ForbidUpdateObject": "Nesne düzenlemeyi yasakla",
     "UpdateSpace": "Alanı güncelle",
     "ArchiveSpace": "Alanı arşivle",
     "CreateObjectDescription": "Kullanıcılara alanda nesne oluşturma yetkisi verir",
     "UpdateObjectDescription": "Kullanıcılara alandaki nesneleri güncelleme yetkisi verir",
     "DeleteObjectDescription": "Kullanıcılara alandaki nesneleri silme yetkisi verir",
     "ForbidDeleteObjectDescription": "Kullanıcıların alandaki nesneleri silmesini yasaklar",
+    "ForbidCreateObjectDescription": "Kullanıcıların alanda nesne oluşturmasını yasaklar",
+    "ForbidUpdateObjectDescription": "Kullanıcıların alandaki nesneleri düzenlemesini yasaklar",
     "UpdateSpaceDescription": "Kullanıcılara alanı güncelleme yetkisi verir",
     "ArchiveSpaceDescription": "Kullanıcılara alanı arşivleme yetkisi verir",
     "AutoJoin": "Otomatik katıl",

foundations/core/packages/core/lang/zh.json

@@ -51,12 +51,16 @@
     "UpdateObject": "更新对象",
     "DeleteObject": "删除对象",
     "ForbidDeleteObject": "禁止删除对象",
+    "ForbidCreateObject": "禁止创建对象",
+    "ForbidUpdateObject": "禁止编辑对象",
     "UpdateSpace": "更新空间",
     "ArchiveSpace": "归档空间",
     "CreateObjectDescription": "授予用户在空间中创建对象的权限",
     "UpdateObjectDescription": "授予用户在空间中更新对象的权限",
     "DeleteObjectDescription": "授予用户在空间中删除对象的权限",
     "ForbidDeleteObjectDescription": "禁止用户在空间中删除对象",
+    "ForbidCreateObjectDescription": "禁止用户在空间中创建对象",
+    "ForbidUpdateObjectDescription": "禁止用户在空间中编辑对象",
     "UpdateSpaceDescription": "授予用户更新空间的权限",
     "ArchiveSpaceDescription": "授予用户归档空间的权限",
     "AutoJoin": "自动加入",

foundations/core/packages/core/src/component.ts

@@ -289,12 +289,16 @@ export default plugin(coreId, {
     UpdateObject: '' as IntlString,
     DeleteObject: '' as IntlString,
     ForbidDeleteObject: '' as IntlString,
+    ForbidCreateObject: '' as IntlString,
+    ForbidUpdateObject: '' as IntlString,
     UpdateSpace: '' as IntlString,
     ArchiveSpace: '' as IntlString,
     CreateObjectDescription: '' as IntlString,
     UpdateObjectDescription: '' as IntlString,
     DeleteObjectDescription: '' as IntlString,
     ForbidDeleteObjectDescription: '' as IntlString,
+    ForbidCreateObjectDescription: '' as IntlString,
+    ForbidUpdateObjectDescription: '' as IntlString,
     UpdateSpaceDescription: '' as IntlString,
     ArchiveSpaceDescription: '' as IntlString,
     AutoJoin: '' as IntlString,
@@ -316,6 +320,8 @@ export default plugin(coreId, {
     UpdateObject: '' as Ref<Permission>,
     DeleteObject: '' as Ref<Permission>,
     ForbidDeleteObject: '' as Ref<Permission>,
+    ForbidCreateObject: '' as Ref<Permission>,
+    ForbidUpdateObject: '' as Ref<Permission>,
     UpdateSpace: '' as Ref<Permission>,
     ArchiveSpace: '' as Ref<Permission>
   },

foundations/server/packages/middleware/src/spacePermissions.ts

@@ -182,8 +182,12 @@ export class SpacePermissionsMiddleware extends BaseMiddleware implements Middle
       ) {
         continue
       }
+      if (isSpace && isObjectOnlyPermission(permission)) continue
       if (permission.txMatch === undefined) {
-        withoutMatch = permission
+        // A forbidding permission wins over an allowing one, independent of the role/permission order
+        if (withoutMatch === undefined || permission.forbid === true) {
+          withoutMatch = permission
+        }
         continue
       } else {
         const checkMatch = matchQuery([tx], permission.txMatch, tx._class, this.context.hierarchy, true)
@@ -490,6 +494,19 @@ function isTxClassMatched (tx: Tx, permission: Permission): boolean {
   return false
 }
 
+/**
+ * Generic (no objectClass) forbid create/update permissions restrict objects inside a space,
+ * but not the space document itself: otherwise the role holders could not manage the space
+ * (members, roles assignment, archiving) anymore.
+ */
+function isObjectOnlyPermission (permission: Permission): boolean {
+  return (
+    permission.forbid === true &&
+    permission.objectClass === undefined &&
+    (permission.txClass === core.class.TxCreateDoc || permission.txClass === core.class.TxUpdateDoc)
+  )
+}
+
 function getTxObjectClass (tx: TxCUD<Doc>): Ref<Class<Doc>> {
   return tx._class === core.class.TxMixin ? (tx as TxMixin<Doc, Doc>).mixin : tx.objectClass
 }