Loosen-IT/WP-LIT-MCP
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 7 Wiki Activity

fix: lit/divi-node-copy from a library entry needs the insert rights (I-1, L5)

Browse Source 
A library entry as source now requires LibraryAccess::canInsert() (add_library,
writable library group) and follows lit-library-insert's Tools-tab state
(disabled -> unsupported). DiviPageLoader::library() gets its caller.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
janniclas.loosen
2026-09-27 04:06:56 +02:00
co-authored by Claude Opus 5.5
parent 186f7af7ca
commit 1b42f9b640
5 changed files with 97 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Integrations/Divi/Pages/DiviNodeCopyAbility.php
+32 -5
View File
@@ -19,15 +19,22 @@ defined('ABSPATH') || exit;
* hiding) and its own source_tree_rev, because path IDs are only valid for the state they were read
* in; the source is only read, so it needs no lock. Target: like lit-divi-insert (tree_rev lock,
* StructureRules, all or nothing, DiviWriter::commit with GlobalEdits – a global target entry never
* gets a nested instance). Follows lit/divi-insert's Tools-tab state (ruling P9/E9).
* gets a nested instance). Follows lit/divi-insert's Tools-tab state (ruling P9/E9). A library entry
* as source is an insert from the library (E3, audit L5): it needs LibraryAccess::canInsert()
* (add_library, writable group "Divi-Bibliothek") and follows lit-library-insert's Tools-tab state.
*/
final class DiviNodeCopyAbility extends DiviWriteAbility
{
/** @param (Closure(): bool)|null $diviWritable Whether lit/divi-insert is enabled; null = always. */
/**
* @param (Closure(): bool)|null $diviWritable Whether lit/divi-insert is enabled; null = always.
* @param (Closure(): bool)|null $libraryInsertable Whether lit/library-insert is enabled (gates
* library entries as source); null = always.
*/
public function __construct(
DiviWriter $writer,
private DiviPageLoader $loader,
private ?Closure $diviWritable = null
private ?Closure $diviWritable = null,
private ?Closure $libraryInsertable = null
) {
parent::__construct($writer);
}
@@ -74,7 +81,10 @@ final class DiviNodeCopyAbility extends DiviWriteAbility
return false;
}
/** lit/divi-insert's Tools-tab state, then the source's own rights – in permission() and execute(). */
/**
* lit/divi-insert's Tools-tab state, then the source's own rights and, for a library entry as
* source, the rights of an insert from the library – in permission() and execute().
*/
protected function precheck(array $input): ?WP_Error
{
if ($this->diviWritable !== null && ! ($this->diviWritable)()) {
@@ -86,8 +96,25 @@ final class DiviNodeCopyAbility extends DiviWriteAbility
}
$source = $this->loader->load($input['source_post_id'] ?? null, false);
if ($source instanceof WP_Error) {
return $source;
}
return $source instanceof WP_Error ? $source : null;
return $source->isLibraryItem() ? $this->libraryInsertRefusal() : null;
}
/** E3/audit L5: copying out of a library entry is inserting from the library (lit-library-insert). */
private function libraryInsertRefusal(): ?WP_Error
{
if ($this->libraryInsertable !== null && ! ($this->libraryInsertable)()) {
return Errors::unsupported(
'Einfügen aus der Divi-Bibliothek ist für diese Verbindung abgeschaltet (lit-library-insert '
. 'deaktiviert oder Gruppe „Divi-Bibliothek“ auf „nur lesen“).',
'Einen Administrator fragen: Einstellungen → LIT MCP → Tools.'
);
}
return $this->loader->library()?->canInsert();
}
protected function change(DiviPage $page, array $input, DiviComposition $composition): DiviChange|WP_Error