Skip to content

Conversation

@simonerd
Copy link
Contributor

@simonerd simonerd commented Aug 21, 2025

Edit by Jason:

This PR adds an option to opt into the v6 asset folder permissions.

// config/statamic/assets.php

return [
  'v6_permissions' => true,
];

This setting will be removed in v6 and will become the standard behavior.

This adds a new edit {container} folders permission that will be paired with the corresponding asset permissions.

e.g.

  • If you want to create a folder, you'll just need edit {container} folders
  • If you want to move a folder, you'll need edit {container} folders and move {container} assets.
  • If you want to delete a folder, you'll need edit {container} folders and delete {container} assets.

There's just one folder permission which acts as both edit/delete. This is because if you were to move a folder from here to there, you are technically creating there and deleting here.

Also in v6, the container level permission options will be removed in favor of these actual permissions. They are staying for v5 though.


Original PR description:

This PR adds dedicated permissions for creating, move, renaming and deleting asset folders. So far they are simply tied to the asset permissions themselves, but we need to be more specific in our current project.

As this would change the current behaviour of these permissions, I moved the changes behind a config toggle (with default false). I feel like this could be sensible to enable by default in v6. I'm happy to create a PR for this as well, either with the default set to true or without any config toggle at all. Let me know what you think 😃

On a side note, I aligned the label of the RenameAssetFolder action with the other respective action labels. All other ones simply had "Delete" or "Move", just this one had "Rename folder", which looked a bit out of place. With this PR it's aligned to also just show "Rename".

simonerd and others added 9 commits August 21, 2025 16:29
- Removed unused allow_downloading, allow_moving, allow_renaming
- Removed unused folder_permissions_enabled
- allow_uploads and create_folders use the respective policies
- Adjusted the test to exclude the removed items
- Adjusted the test so that allow_uploads and create_folders are false. This is because it'll now actually read from the permission.
- Browser component doesn't need to check the permissions explicitly since it'll now be passed down from the server.
@jasonvarga
Copy link
Member

We agree this is a good move for v6.

The existing container level "permissions" (like allow moving, allow uploading, etc) should've always been actual permissions.

I've updated this PR so that it's a more generic "Do it the v6 way" that you can opt into.

In a separate PR I'll remove the setting, deprecated methods, and make things the new default behavior.

@jasonvarga jasonvarga changed the title [5.x] Add dedicated folder permissions (with opt-in) [5.x] Ability to opt into v6 asset folder permissions Sep 3, 2025
@jasonvarga jasonvarga merged commit 66c3dc7 into statamic:5.x Sep 3, 2025
26 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants