diff --git a/plugins/plugin-api-permissions/server/src/bootstrap.ts b/plugins/plugin-api-permissions/server/src/bootstrap.ts index 4655cb2..853cb29 100644 --- a/plugins/plugin-api-permissions/server/src/bootstrap.ts +++ b/plugins/plugin-api-permissions/server/src/bootstrap.ts @@ -33,9 +33,10 @@ const RBAC_ACTIONS = [ ]; export default async ({ strapi }: { strapi: Core.Strapi }) => { - await strapi - .service("admin::permission") - .actionProvider.registerMany(RBAC_ACTIONS); + const provider = strapi.service("admin::permission").actionProvider; + + await provider.registerMany(RBAC_ACTIONS); + await manualPermissionOverride(strapi); const roleCount = await strapi.documents(ROLE_UID).count({}); @@ -57,3 +58,53 @@ export default async ({ strapi }: { strapi: Core.Strapi }) => { }); } }; + +/** + * Manually override permissions for API Roles to ensure they are always in sync with Content Manager permissions. + * @param strapi The Strapi instance + */ +const manualPermissionOverride = async (strapi: Core.Strapi) => { + const provider = strapi.service("admin::permission").actionProvider; + + for (const action of ["read", "create", "update", "delete"]) { + const adminString = `plugin::content-manager.explorer.${action}`; + const aliasString = `plugin::api-permissions.roles.${action}`; + + const adminAction = provider.get(adminString); + const aliasAction = provider.get(aliasString); + + if (adminAction) { + if (!adminAction.subjects) adminAction.subjects = []; + + if (!adminAction.subjects.includes(ROLE_UID)) { + adminAction.subjects.push(ROLE_UID); + } + } + + if (aliasAction) { + if (!aliasAction.aliases) aliasAction.aliases = []; + + const exists = aliasAction.aliases.some( + ({ actionId, subjects }: { actionId: string; subjects?: string[] }) => { + return actionId === adminString && subjects?.includes(ROLE_UID); + }, + ); + + if (!exists) { + aliasAction.aliases.push({ + actionId: adminString, + subjects: [ROLE_UID], + }); + } + } + } + + try { + await strapi.service("admin::role")?.resetSuperAdminPermissions?.(); + } catch (err) { + strapi.log.error( + "Failed to sync Super Admin permissions for API Roles:", + err, + ); + } +};