Skip to content

Allow users with view permissions to preview unpublished content - #10337

Merged
ruibaby merged 1 commit into
halo-dev:mainfrom
ruibaby:fix/preview-content-view-permission
Sep 24, 2026
Merged

ruibaby merged 1 commit into
halo-dev:mainfrom
ruibaby:fix/preview-content-view-permission

Conversation

@ruibaby

@ruibaby ruibaby commented Sep 22, 2026

Copy link
Copy Markdown
Member

What type of PR is this?

  • Feature
  • Bug fix
  • Improvement
  • Cleanup
  • Documentation

What this PR does / why we need it:

Users with post or single-page view permissions currently receive a 404 when previewing unpublished content created by another user. The preview routes only allow contributors and do not consider the user's RBAC permissions.

This change preserves contributor access and also allows users with the corresponding post or single-page view permission to access preview links.

Reproduction:

  1. Sign in as a user with the post or single-page view permission who is not a contributor to the content.
  2. Open /preview/posts/{name} or /preview/singlepages/{name} for unpublished content created by another user.
  3. The preview request returns 404 before this change.

After this change, the same request returns 200 while unauthenticated and anonymous requests remain inaccessible.

Which issue(s) this PR fixes:

N/A

Special notes for your reviewer:

  • Added regression coverage for both post and single-page preview routes.
  • Verified the focused test suite and Java formatting with Corretto 21.
  • This change was implemented with Codex assistance and reviewed through the regression tests below.

Does this PR introduce a user-facing change?

修复拥有文章或页面查看权限的用户无法预览其他用户创建的未发布内容的问题。

@ruibaby ruibaby added this to the 2.27.0 milestone Sep 22, 2026
@sonarqubecloud

Copy link
Copy Markdown

@codecov

codecov Bot commented Sep 22, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 90.90909% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 66.43%. Comparing base (42c374d) to head (427c2cd).
⚠️ Report is 795 commits behind head on main.

Files with missing lines Patch % Lines
...n/halo/app/theme/router/PreviewRouterFunction.java 90.90% 0 Missing and 1 partial ⚠️
Additional details and impacted files
@@             Coverage Diff              @@
##               main   #10337      +/-   ##
============================================
+ Coverage     59.55%   66.43%   +6.88%     
- Complexity     3812     5264    +1452     
============================================
  Files           677      758      +81     
  Lines         23248    26986    +3738     
  Branches       1500     1904     +404     
============================================
+ Hits          13846    17929    +4083     
+ Misses         8764     8167     -597     
- Partials        638      890     +252     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@ruibaby
ruibaby merged commit a88cf41 into halo-dev:main Sep 24, 2026
9 checks passed
@ruibaby
ruibaby deleted the fix/preview-content-view-permission branch September 24, 2026 02:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant