[5.x] Ability to opt into v6 asset folder permissions (#12060)

simonerd · jasonvarga · web-flow · commit 66c3dc7a3135 · 2025-09-03T11:27:20.000-04:00
Co-authored-by: Jason Varga &lt;jason@pixelfear.com&gt;
diff --git a/config/assets.php b/config/assets.php
@@ -223,4 +223,16 @@
 
     'svg_sanitization_on_upload' => true,
 
+    /*
+    |--------------------------------------------------------------------------
+    | Use V6 Permissions
+    |--------------------------------------------------------------------------
+    |
+    | This allows you to opt in to the asset permissions that will become the
+    | default behavior in Statamic 6. This will be removed in Statamic 6.
+    |
+    */
+
+    'v6_permissions' => false,
+
 ];
diff --git a/resources/js/components/assets/Browser/Browser.vue b/resources/js/components/assets/Browser/Browser.vue
@@ -376,11 +376,11 @@ export default {
         },
 
         canUpload() {
-            return this.folder && this.container.allow_uploads && (this.can('upload '+ this.container.id +' assets') || this.can('configure asset containers'));
+            return this.folder && this.container.allow_uploads;
         },
 
         canCreateFolders() {
-            return this.folder && this.container.create_folders && ! this.restrictFolderNavigation && (this.can('upload '+ this.container.id +' assets') || this.can('configure asset containers'));
+            return this.folder && this.container.create_folders && ! this.restrictFolderNavigation;
         },
 
         parameters() {
diff --git a/resources/lang/de/permissions.php b/resources/lang/de/permissions.php
@@ -57,6 +57,11 @@
     'move_{container}_assets' => 'Dateien verschieben',
     'rename_{container}_assets' => 'Dateien umbenennen',
     'delete_{container}_assets' => 'Dateien löschen',
+    'edit_{container}_folders' => 'Ordner bearbeiten',
+    'create_{container}_folders' => 'Ordner erstellen',
+    'move_{container}_folders' => 'Ordner verschieben',
+    'rename_{container}_folders' => 'Ordner umbenennen',
+    'delete_{container}_folders' => 'Ordner löschen',
     'group_forms' => 'Formulare',
     'configure_forms' => 'Formulare konfigurieren',
     'configure_forms_desc' => 'Gewährt Zugriff auf alle Berechtigungen im Zusammenhang mit Formularen.',
diff --git a/resources/lang/de_CH/permissions.php b/resources/lang/de_CH/permissions.php
@@ -57,6 +57,11 @@
     'move_{container}_assets' => 'Dateien verschieben',
     'rename_{container}_assets' => 'Dateien umbenennen',
     'delete_{container}_assets' => 'Dateien löschen',
+    'edit_{container}_folders' => 'Ordner bearbeiten',
+    'create_{container}_folders' => 'Ordner erstellen',
+    'move_{container}_folders' => 'Ordner verschieben',
+    'rename_{container}_folders' => 'Ordner umbenennen',
+    'delete_{container}_folders' => 'Ordner löschen',
     'group_forms' => 'Formulare',
     'configure_forms' => 'Formulare konfigurieren',
     'configure_forms_desc' => 'Gewährt Zugriff auf alle Berechtigungen im Zusammenhang mit Formularen.',
diff --git a/resources/lang/en/permissions.php b/resources/lang/en/permissions.php
@@ -65,6 +65,11 @@
     'move_{container}_assets' => 'Move assets',
     'rename_{container}_assets' => 'Rename assets',
     'delete_{container}_assets' => 'Delete assets',
+    'edit_{container}_folders' => 'Edit folders',
+    'create_{container}_folders' => 'Create folders',
+    'move_{container}_folders' => 'Move folders',
+    'rename_{container}_folders' => 'Rename folders',
+    'delete_{container}_folders' => 'Delete folders',
 
     'group_forms' => 'Forms',
     'configure_forms' => 'Configure forms',
diff --git a/resources/lang/es/permissions.php b/resources/lang/es/permissions.php
@@ -57,6 +57,11 @@
     'move_{container}_assets' => 'Mover medios',
     'rename_{container}_assets' => 'Renombrar medios',
     'delete_{container}_assets' => 'Eliminar medios',
+    'edit_{container}_folders' => 'Editar carpetas',
+    'create_{container}_folders' => 'Crear carpetas',
+    'move_{container}_folders' => 'Mover carpetas',
+    'rename_{container}_folders' => 'Renombrar carpetas',
+    'delete_{container}_folders' => 'Eliminar carpetas',
     'group_forms' => 'Formularios',
     'configure_forms' => 'Configurar formularios',
     'configure_forms_desc' => 'Otorga acceso a todos los permisos relacionados con formularios',
diff --git a/resources/lang/fr/permissions.php b/resources/lang/fr/permissions.php
@@ -57,6 +57,11 @@
     'move_{container}_assets' => 'Déplacer des ressources',
     'rename_{container}_assets' => 'Renommer des ressources',
     'delete_{container}_assets' => 'Supprimer des ressources',
+    'edit_{container}_folders' => 'Modifier des dossiers',
+    'create_{container}_folders' => 'Créer des dossiers',
+    'move_{container}_folders' => 'Déplacer des dossiers',
+    'rename_{container}_folders' => 'Renommer des dossiers',
+    'delete_{container}_folders' => 'Supprimer des dossiers',
     'group_forms' => 'Formulaires',
     'configure_forms' => 'Configurer les formulaires',
     'configure_forms_desc' => 'Permet d’accéder à toutes les autorisations liées aux formulaires.',
diff --git a/resources/lang/it/permissions.php b/resources/lang/it/permissions.php
@@ -57,6 +57,11 @@
     'move_{container}_assets' => 'Sposta media',
     'rename_{container}_assets' => 'Rinomina media',
     'delete_{container}_assets' => 'Elimina media',
+    'edit_{container}_folders' => 'Modifica cartelle',
+    'create_{container}_folders' => 'Crea cartelle',
+    'move_{container}_folders' => 'Sposta cartelle',
+    'rename_{container}_folders' => 'Rinomina cartelle',
+    'delete_{container}_folders' => 'Elimina cartelle',
     'group_forms' => 'Form',
     'configure_forms' => 'Configura form',
     'configure_forms_desc' => 'Consente l\'accesso a tutti i permessi relativi ai form',
diff --git a/resources/lang/nl/permissions.php b/resources/lang/nl/permissions.php
@@ -57,6 +57,11 @@
     'move_{container}_assets' => 'Verplaats assets',
     'rename_{container}_assets' => 'Hernoem assets',
     'delete_{container}_assets' => 'Verwijder assets',
+    'edit_{container}_folders' => 'Wijzig mappen',
+    'create_{container}_folders' => 'Maak mappen aan',
+    'move_{container}_folders' => 'Verplaats mappen',
+    'rename_{container}_folders' => 'Hernoem mappen',
+    'delete_{container}_folders' => 'Verwijder mappen',
     'group_forms' => 'Formulieren',
     'configure_forms' => 'Beheer formulieren',
     'configure_forms_desc' => 'Geeft toegang tot alle rechten behorende bij formulieren',
diff --git a/src/Actions/RenameAssetFolder.php b/src/Actions/RenameAssetFolder.php
@@ -9,7 +9,7 @@ class RenameAssetFolder extends Action
 {
     public static function title()
     {
-        return __('Rename Folder');
+        return __('Rename');
     }
 
     public function visibleTo($item)
diff --git a/src/Assets/AssetContainer.php b/src/Assets/AssetContainer.php
@@ -507,6 +507,8 @@ public function private()
      *
      * @param  bool|null  $allowDownloading
      * @return bool|$this
+     *
+     * @deprecated
      */
     public function allowDownloading($allowDownloading = null)
     {
@@ -523,6 +525,8 @@ public function allowDownloading($allowDownloading = null)
      *
      * @param  bool|null  $allowMoving
      * @return bool|$this
+     *
+     * @deprecated
      */
     public function allowMoving($allowMoving = null)
     {
@@ -539,6 +543,8 @@ public function allowMoving($allowMoving = null)
      *
      * @param  bool|null  $allowRenaming
      * @return bool|$this
+     *
+     * @deprecated
      */
     public function allowRenaming($allowRenaming = null)
     {
@@ -555,6 +561,8 @@ public function allowRenaming($allowRenaming = null)
      *
      * @param  bool|null  $allowUploads
      * @return bool|$this
+     *
+     * @deprecated
      */
     public function allowUploads($allowUploads = null)
     {
@@ -571,6 +579,8 @@ public function allowUploads($allowUploads = null)
      *
      * @param  bool|null  $createFolders
      * @return bool|$this
+     *
+     * @deprecated
      */
     public function createFolders($createFolders = null)
     {
diff --git a/src/Auth/CorePermissions.php b/src/Auth/CorePermissions.php
@@ -161,14 +161,20 @@ protected function registerAssets()
         $this->register('configure asset containers');
 
         $this->register('view {container} assets', function ($permission) {
-            $this->permission($permission)->children([
+            $childPermissions = [
                 $this->permission('upload {container} assets'),
                 $this->permission('edit {container} assets')->children([
                     $this->permission('move {container} assets'),
                     $this->permission('rename {container} assets'),
                     $this->permission('delete {container} assets'),
                 ]),
-            ])->replacements('container', function () {
+            ];
+
+            if (config('statamic.assets.v6_permissions')) {
+                $childPermissions[] = $this->permission('edit {container} folders');
+            }
+
+            $this->permission($permission)->children($childPermissions)->replacements('container', function () {
                 return AssetContainer::all()->map(function ($container) {
                     return ['value' => $container->handle(), 'label' => __($container->title())];
                 });
diff --git a/src/Http/Controllers/CP/Assets/AssetContainersController.php b/src/Http/Controllers/CP/Assets/AssetContainersController.php
@@ -3,7 +3,9 @@
 namespace Statamic\Http\Controllers\CP\Assets;
 
 use Illuminate\Http\Request;
+use Statamic\Contracts\Assets\Asset;
 use Statamic\Contracts\Assets\AssetContainer as AssetContainerContract;
+use Statamic\Contracts\Assets\AssetFolder;
 use Statamic\Facades\AssetContainer;
 use Statamic\Facades\Blueprint;
 use Statamic\Facades\User;
@@ -25,11 +27,8 @@ public function index(Request $request)
             return [
                 'id' => $container->handle(),
                 'title' => $container->title(),
-                'allow_downloading' => $container->allowDownloading(),
-                'allow_moving' => $container->allowMoving(),
-                'allow_renaming' => $container->allowRenaming(),
-                'allow_uploads' => $container->allowUploads(),
-                'create_folders' => $container->createFolders(),
+                'allow_uploads' => User::current()->can('store', [Asset::class, $container]),
+                'create_folders' => User::current()->can('create', [AssetFolder::class, $container]),
                 'edit_url' => $container->editUrl(),
                 'delete_url' => $container->deleteUrl(),
                 'blueprint_url' => cp_route('asset-containers.blueprint.edit', $container->handle()),
diff --git a/src/Http/Controllers/CP/Assets/FoldersController.php b/src/Http/Controllers/CP/Assets/FoldersController.php
@@ -5,6 +5,7 @@
 use Illuminate\Http\Request;
 use Illuminate\Validation\ValidationException;
 use Statamic\Assets\AssetUploader;
+use Statamic\Contracts\Assets\AssetFolder;
 use Statamic\Facades\Path;
 use Statamic\Http\Controllers\CP\CpController;
 use Statamic\Rules\AlphaDashSpace;
@@ -13,7 +14,7 @@ class FoldersController extends CpController
 {
     public function store(Request $request, $container)
     {
-        abort_unless($container->createFolders(), 403);
+        $this->authorize('create', [AssetFolder::class, $container]);
 
         $request->validate([
             'path' => 'required',
diff --git a/src/Http/Resources/CP/Assets/Asset.php b/src/Http/Resources/CP/Assets/Asset.php
@@ -60,7 +60,7 @@ public function toArray($request)
 
             $this->merge($this->publishFormData()),
 
-            'allowDownloading' => $this->container()->allowDownloading(),
+            'allowDownloading' => config('statamic.assets.v6_permissions') ? true : $this->container()->allowDownloading(),
             'actionUrl' => cp_route('assets.actions.run'),
             'actions' => Action::for($this->resource, [
                 'container' => $this->container()->handle(),
diff --git a/src/Policies/AssetFolderPolicy.php b/src/Policies/AssetFolderPolicy.php
@@ -8,11 +8,24 @@
 
 class AssetFolderPolicy
 {
+    public function before($user)
+    {
+        $user = User::fromUser($user);
+
+        if ($user->hasPermission('configure asset containers')) {
+            return true;
+        }
+    }
+
     public function create($user, $assetContainer)
     {
         $user = User::fromUser($user);
 
-        if (! $user->hasPermission("upload {$assetContainer->handle()} assets")) {
+        $permission = config('statamic.assets.v6_permissions')
+            ? "edit {$assetContainer->handle()} folders"
+            : "upload {$assetContainer->handle()} assets";
+
+        if (! $user->hasPermission($permission)) {
             return false;
         }
 
@@ -23,7 +36,12 @@ public function move($user, $assetFolder)
     {
         $user = User::fromUser($user);
 
-        if (! $user->hasPermission("move {$assetFolder->container()->handle()} assets")) {
+        $hasPermission = config('statamic.assets.v6_permissions')
+            ? ($user->hasPermission("edit {$assetFolder->container()->handle()} folders")
+                && $user->hasPermission("move {$assetFolder->container()->handle()} assets"))
+            : $user->hasPermission("move {$assetFolder->container()->handle()} assets");
+
+        if (! $hasPermission) {
             return false;
         }
 
@@ -41,7 +59,12 @@ public function rename($user, $assetFolder)
     {
         $user = User::fromUser($user);
 
-        if (! $user->hasPermission("rename {$assetFolder->container()->handle()} assets")) {
+        $hasPermission = config('statamic.assets.v6_permissions')
+            ? ($user->hasPermission("edit {$assetFolder->container()->handle()} folders")
+                && $user->hasPermission("rename {$assetFolder->container()->handle()} assets"))
+            : $user->hasPermission("rename {$assetFolder->container()->handle()} assets");
+
+        if (! $hasPermission) {
             return false;
         }
 
@@ -59,7 +82,12 @@ public function delete($user, $assetFolder)
     {
         $user = User::fromUser($user);
 
-        if (! $user->hasPermission("delete {$assetFolder->container()->handle()} assets")) {
+        $hasPermission = config('statamic.assets.v6_permissions')
+            ? ($user->hasPermission("edit {$assetFolder->container()->handle()} folders")
+                && $user->hasPermission("delete {$assetFolder->container()->handle()} assets"))
+            : $user->hasPermission("delete {$assetFolder->container()->handle()} assets");
+
+        if (! $hasPermission) {
             return false;
         }
 
diff --git a/tests/Feature/AssetContainers/ListAssetContainersTest.php b/tests/Feature/AssetContainers/ListAssetContainersTest.php
@@ -53,11 +53,8 @@ public function containerArray()
             [
                 'id' => 'three',
                 'title' => 'Three',
-                'allow_downloading' => true,
-                'allow_moving' => true,
-                'allow_renaming' => true,
-                'allow_uploads' => true,
-                'create_folders' => true,
+                'allow_uploads' => false,
+                'create_folders' => false,
                 'edit_url' => 'http://localhost/cp/asset-containers/three/edit',
                 'delete_url' => 'http://localhost/cp/asset-containers/three',
                 'blueprint_url' => 'http://localhost/cp/asset-containers/three/blueprint',
@@ -67,11 +64,8 @@ public function containerArray()
             [
                 'id' => 'two',
                 'title' => 'Two',
-                'allow_downloading' => true,
-                'allow_moving' => true,
-                'allow_renaming' => true,
-                'allow_uploads' => true,
-                'create_folders' => true,
+                'allow_uploads' => false,
+                'create_folders' => false,
                 'edit_url' => 'http://localhost/cp/asset-containers/two/edit',
                 'delete_url' => 'http://localhost/cp/asset-containers/two',
                 'blueprint_url' => 'http://localhost/cp/asset-containers/two/blueprint',
diff --git a/tests/Policies/AssetContainerPolicyTest.php b/tests/Policies/AssetContainerPolicyTest.php
diff --git a/tests/Policies/AssetFolderPolicyTest.php b/tests/Policies/AssetFolderPolicyTest.php
diff --git a/tests/Policies/AssetPolicyTest.php b/tests/Policies/AssetPolicyTest.php

Original file line number	Diff line number	Diff line change
`@@ -9,7 +9,7 @@ class RenameAssetFolder extends Action`
`9`	`9`	`{`
`10`	`10`	`public static function title()`
`11`	`11`	`{`
`12`		`- return __('Rename Folder');`
	`12`	`+ return __('Rename');`
`13`	`13`	`}`
`14`	`14`
`15`	`15`	`public function visibleTo($item)`