[2026.3][Class] Require objects permission for the custom layout editor collection route

src/Class/Controller/CustomLayout/EditorCollectionController.php

@@ -60,7 +60,7 @@ public function __construct(
         requirements: ['id' => '\d+'],
         methods: ['GET']
     )]
-    #[IsGranted(UserPermissions::CLASS_DEFINITION->value)]
+    #[IsGranted(UserPermissions::DATA_OBJECTS->value)]
     #[Get(
         path: self::PREFIX . '/class/custom-layout/editor/collection/{objectId}',
         operationId: 'class_custom_layout_editor_collection',

tests/Unit/Class/Controller/CustomLayout/CustomLayoutControllerPermissionTest.php

@@ -39,6 +39,10 @@
  * ('classes') permission, matching ClassDefinitionType::CustomLayout->permission(),
  * not DATA_OBJECTS ('objects') as they did before the fix.
  *
+ * The editor collection route is the exception: the data object editor calls it whenever an
+ * object is opened. It is read-only, and the service enforces view permission on the object,
+ * so it requires DATA_OBJECTS ('objects') (pimcore/platform-version#597).
+ *
  * @internal
  */
 final class CustomLayoutControllerPermissionTest extends Unit
@@ -55,7 +59,6 @@ public static function controllerProvider(): iterable
         yield ExportController::class => [ExportController::class];
         yield GetController::class => [GetController::class];
         yield GetIdentifierController::class => [GetIdentifierController::class];
-        yield EditorCollectionController::class => [EditorCollectionController::class];
         yield ClassCollectionController::class => [ClassCollectionController::class];
     }
 
@@ -92,6 +95,22 @@ public function testInvokeRequiresClassDefinitionPermission(string $controllerCl
         );
     }
 
+    /**
+     * @throws ReflectionException
+     */
+    public function testEditorCollectionRequiresDataObjectsPermission(): void
+    {
+        $reflection = new ReflectionClass(EditorCollectionController::class);
+        $attributes = $this->resolveActionMethod($reflection)->getAttributes(IsGranted::class);
+
+        $this->assertNotEmpty($attributes, 'EditorCollectionController is missing an #[IsGranted] attribute.');
+        $this->assertSame(
+            UserPermissions::DATA_OBJECTS->value,
+            $attributes[0]->newInstance()->attribute,
+            'The editor collection route must be available to every user who can open data objects.'
+        );
+    }
+
     /**
      * @param ReflectionClass<object> $reflection
      */

tests/Unit/Class/Service/CustomLayoutServiceEditorCollectionTest.php

@@ -0,0 +1,191 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * This source file is available under the terms of the
+ * Pimcore Open Core License (POCL)
+ * Full copyright and license information is available in
+ * LICENSE.md which is distributed with this source code.
+ *
+ *  @copyright  Copyright (c) Pimcore GmbH (https://www.pimcore.com)
+ *  @license    Pimcore Open Core License (POCL)
+ */
+
+namespace Pimcore\Bundle\StudioBackendBundle\Tests\Unit\Class\Service;
+
+use Codeception\Test\Unit;
+use Exception;
+use Pimcore\Bundle\StudioBackendBundle\Class\Hydrator\CustomLayout\CustomLayoutHydratorInterface;
+use Pimcore\Bundle\StudioBackendBundle\Class\Repository\CustomLayoutRepositoryInterface;
+use Pimcore\Bundle\StudioBackendBundle\Class\Schema\CustomLayout\CustomLayoutCompact;
+use Pimcore\Bundle\StudioBackendBundle\Class\Service\CustomLayoutService;
+use Pimcore\Bundle\StudioBackendBundle\DataObject\Service\DataObjectServiceInterface;
+use Pimcore\Bundle\StudioBackendBundle\Exception\Api\ForbiddenException;
+use Pimcore\Bundle\StudioBackendBundle\Export\Service\DownloadServiceInterface;
+use Pimcore\Bundle\StudioBackendBundle\Security\Service\LayoutServiceInterface;
+use Pimcore\Model\DataObject;
+use Pimcore\Model\DataObject\ClassDefinition\CustomLayout as CoreLayout;
+use Pimcore\Model\UserInterface;
+use Symfony\Component\EventDispatcher\EventDispatcherInterface;
+
+/**
+ * The editor collection route only requires the 'objects' permission
+ * (pimcore/platform-version#597), so the service has to enforce access on its own.
+ *
+ * @internal
+ */
+final class CustomLayoutServiceEditorCollectionTest extends Unit
+{
+    private const OBJECT_ID = 42;
+
+    private const CLASS_ID = 'CAR';
+
+    /**
+     * @throws Exception
+     */
+    public function testUserWithoutViewPermissionOnObjectIsRejected(): void
+    {
+        $user = $this->createUser(false);
+
+        $dataObjectService = $this->createMock(DataObjectServiceInterface::class);
+        $dataObjectService->method('getDataObjectElement')
+            ->with($user, self::OBJECT_ID)
+            ->willThrowException(new ForbiddenException('You dont have view permission'));
+
+        $repository = $this->createMock(CustomLayoutRepositoryInterface::class);
+        $repository->expects($this->never())->method('getCustomLayoutsByClass');
+
+        $service = $this->createService($dataObjectService, $repository);
+
+        $this->expectException(ForbiddenException::class);
+
+        $service->getCustomLayoutEditorCollection(self::OBJECT_ID, $user);
+    }
+
+    /**
+     * @throws Exception
+     */
+    public function testNonAdminOnlyGetsAllowedLayouts(): void
+    {
+        $user = $this->createUser(false);
+        $service = $this->createServiceForObject(
+            $user,
+            ['layout_a', 'layout_b', 'layout_c'],
+            allowedLayouts: ['layout_b']
+        );
+
+        $result = $service->getCustomLayoutEditorCollection(self::OBJECT_ID, $user);
+
+        // The main layout ('0') is not part of the allowed layouts, so it must not be added either.
+        $this->assertSame(['layout_b'], $this->getIds($result));
+    }
+
+    /**
+     * @throws Exception
+     */
+    public function testNonAdminWithoutRestrictionGetsMainAndClassLayouts(): void
+    {
+        $user = $this->createUser(false);
+        $service = $this->createServiceForObject($user, ['layout_a', 'layout_b']);
+
+        $result = $service->getCustomLayoutEditorCollection(self::OBJECT_ID, $user);
+
+        // Sorted by name: layout_a, layout_b, main ('0').
+        $this->assertSame(['layout_a', 'layout_b', '0'], $this->getIds($result));
+    }
+
+    /**
+     * @throws Exception
+     */
+    public function testAdminAdditionallyGetsAdminMainLayout(): void
+    {
+        $user = $this->createUser(true);
+        $service = $this->createServiceForObject($user, ['layout_a']);
+
+        $result = $service->getCustomLayoutEditorCollection(self::OBJECT_ID, $user);
+
+        // Sorted by name: layout_a, main ('0'), main_admin ('-1').
+        $this->assertSame(['layout_a', '0', '-1'], $this->getIds($result));
+    }
+
+    /**
+     * @param string[] $layoutIds
+     * @param string[] $allowedLayouts
+     *
+     * @throws Exception
+     */
+    private function createServiceForObject(
+        UserInterface $user,
+        array $layoutIds,
+        array $allowedLayouts = []
+    ): CustomLayoutService {
+        $dataObject = $this->createMock(DataObject::class);
+        $dataObject->method('getClassId')->willReturn(self::CLASS_ID);
+
+        $dataObjectService = $this->createMock(DataObjectServiceInterface::class);
+        $dataObjectService->method('getDataObjectElement')
+            ->with($user, self::OBJECT_ID)
+            ->willReturn($dataObject);
+
+        $repository = $this->createMock(CustomLayoutRepositoryInterface::class);
+        $repository->method('getCustomLayoutsByClass')
+            ->with([self::CLASS_ID])
+            ->willReturn(array_map(
+                static fn (string $id): CoreLayout => (new CoreLayout())->setId($id)->setName($id),
+                $layoutIds
+            ));
+
+        $layoutService = $this->createMock(LayoutServiceInterface::class);
+        $layoutService->method('getUserAllowedLayoutsByClass')->willReturn($allowedLayouts);
+
+        return $this->createService($dataObjectService, $repository, $layoutService);
+    }
+
+    /**
+     * @throws Exception
+     */
+    private function createService(
+        DataObjectServiceInterface $dataObjectService,
+        CustomLayoutRepositoryInterface $repository,
+        ?LayoutServiceInterface $layoutService = null
+    ): CustomLayoutService {
+        $hydrator = $this->createMock(CustomLayoutHydratorInterface::class);
+        $hydrator->method('hydrateCompactLayout')->willReturnCallback(
+            static fn (CoreLayout $layout): CustomLayoutCompact => new CustomLayoutCompact(
+                $layout->getId(),
+                $layout->getName(),
+                $layout->getDefault()
+            )
+        );
+
+        return new CustomLayoutService(
+            $repository,
+            $hydrator,
+            $dataObjectService,
+            $this->createMock(DownloadServiceInterface::class),
+            $this->createMock(EventDispatcherInterface::class),
+            $layoutService ?? $this->createMock(LayoutServiceInterface::class)
+        );
+    }
+
+    /**
+     * @throws Exception
+     */
+    private function createUser(bool $isAdmin): UserInterface
+    {
+        $user = $this->createMock(UserInterface::class);
+        $user->method('isAdmin')->willReturn($isAdmin);
+
+        return $user;
+    }
+
+    /**
+     * @param CustomLayoutCompact[] $layouts
+     *
+     * @return string[]
+     */
+    private function getIds(array $layouts): array
+    {
+        return array_map(static fn (CustomLayoutCompact $layout): string => $layout->getId(), $layouts);
+    }
+}