Disable non-owner editing. #4518
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- `handleStrategies` now short circuits if the project is not owned by the current user. - `processAction` now only permits certain actions to run depending on the ownership of the current project.
seanparsons
requested review from
gbalint,
Rheeseyb,
ruggi,
balazsbajorics,
enidemi,
liady and
bkrmendy
Job #9255: Bundle Size — 65.59MiB (~+0.01%).
Warning Bundle contains 67 duplicate packages – View duplicate packages Bundle metrics
 
Bundle size by type
View job #9255 report View feature/disable-non-owner-editin... branch activity |
|
Performance test results: |
ruggi
approved these changes
Nov 20, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Problem:
When using the editor collaboratively, it doesn't make a lot of sense for non-owners to be able to change the project.
Fix:
In two places this prevents changes to the project model from being applied:
processAction: The main hub of where changes are applied we protect against non-owners from applying non-transient editor actions.handleStrategies: Canvas interactions are disabled by having the entire strategies logic be disabled if the current user is not the owner of the project.Additionally in
processActionwe prevent changes coming from non-owners via yjs/Liveblocks from being applied to the project model, as it appears initialisation of it in certain circumstances can cause those to be triggered.Commit Details:
handleStrategiesnow short circuits if the project is not owned by the current user.processActionnow only permits certain actions to run depending on the ownership of the current project.