Merge pull request #1691 from weseek/fix/apply-scopes-to-descendants

impl addConditionToFilteringByViewerToEdit

src/server/models/page.js

@@ -214,7 +214,7 @@ class PageQueryBuilder {
     return this;
   }
 
-  addConditionToFilteringByViewer(user, userGroups, showAnyoneKnowsLink, showPagesRestrictedByOwner, showPagesRestrictedByGroup) {
+  addConditionToFilteringByViewer(user, userGroups, showAnyoneKnowsLink = false, showPagesRestrictedByOwner = false, showPagesRestrictedByGroup = false) {
     const grantConditions = [
       { grant: null },
       { grant: GRANT_PUBLIC },
@@ -831,6 +831,27 @@ module.exports = function(crowi) {
     return builder.addConditionToFilteringByViewer(user, userGroups, showAnyoneKnowsLink, !hidePagesRestrictedByOwner, !hidePagesRestrictedByGroup);
   }
 
+  /**
+   * Add condition that filter pages by viewer
+   *  by considering Config
+   *
+   * @param {PageQueryBuilder} builder
+   * @param {User} user
+   * @param {boolean} showAnyoneKnowsLink
+   */
+  async function addConditionToFilteringByViewerToEdit(builder, user) {
+    validateCrowi();
+
+    // determine UserGroup condition
+    let userGroups = null;
+    if (user != null) {
+      const UserGroupRelation = crowi.model('UserGroupRelation');
+      userGroups = await UserGroupRelation.findAllUserGroupIdsRelatedToUser(user);
+    }
+
+    return builder.addConditionToFilteringByViewer(user, userGroups, false, false, false);
+  }
+
   /**
    * export addConditionToFilteringByViewerForList as static method
    */
@@ -1038,7 +1059,7 @@ module.exports = function(crowi) {
     builder.addConditionToExcludeRedirect();
 
     // add grant conditions
-    await addConditionToFilteringByViewerForList(builder, user);
+    await addConditionToFilteringByViewerToEdit(builder, user);
 
     // get all pages that the specified user can update
     const pages = await builder.query.exec();