Fix the template override Access rules.

Author: dadish

src/Config.php

@@ -43,12 +43,8 @@ public function get($key)
         return $this->getLegalCreateTemplates();
       case 'legalEditTemplates':
         return $this->getLegalTemplatesForPermission('page-edit');
-      case 'legalViewFields':
-        return $this->getLegalFieldsForPermission('view');
-        case 'legalCreateFields':
-          return $this->getLegalFields();
-      case 'legalEditFields':
-        return $this->getLegalFieldsForPermission('edit');
+      case 'legalFields':
+        return $this->getLegalFields();
       default:
         return parent::get($key);
     }
@@ -126,38 +122,4 @@ protected function getLegalFields()
     return Utils::fields()->getAll()->find("name=" . implode('|', $legalFields));
   }
 
-  protected function getLegalFieldsForPermission($permission = 'view')
-  {
-    $fields = $this->getLegalFields();
-    $roles = $permission . "Roles";
-    // if superuser give access to everything
-    if (Utils::user()->isSuperuser()) return $fields;
-
-    if (Utils::moduleConfig()->grantFieldsAccess) {
-      foreach ($fields as $field) {
-        if ($field->useRoles && !$this->userHasRoleIn($field->$roles)) {
-          $fields->remove($field);
-        }
-      }
-    } else {
-      $fields->find("useRoles=1");
-      foreach ($fields as $field) {
-        if (!$this->userHasRoleIn($field->$roles)) {
-          $fields->remove($field);
-        }
-      }
-    }
-
-    return $fields;
-  }
-
-  protected function userHasRoleIn($rolesID)
-  {
-    $userRolesID = Utils::user()->roles->explode('id');
-    foreach ($userRolesID as $userRoleID) {
-      if (in_array($userRoleID, $rolesID)) return true;
-    }
-    return false;
-  }
-
 }

src/Type/Input/TemplatedPageInputType.php

@@ -52,7 +52,7 @@ public function build($config)
       'FieldtypeImage',
     ];
 
-    $legalFieldsName = Utils::moduleConfig()->legalCreateFields->implode('|', 'name');
+    $legalFieldsName = Utils::moduleConfig()->legalFields->implode('|', 'name');
     // the template fields
     foreach ($this->template->fields->find("name=$legalFieldsName") as $field) {
       $className = $field->type->className();

src/Type/InterfaceType/PageInterfaceType.php

@@ -29,16 +29,6 @@ public function build($config)
       $className = "ProcessWire\\GraphQL\\Field\\Page\\$fieldClassName";
       $config->addField(new $className());
     }
-
-    // add global fields too
-    $legalFields = Utils::moduleConfig()->legalViewFields;
-    foreach ($legalFields as $field) {
-      if ($field->flags & Field::flagGlobal) {
-        $className = "\\ProcessWire\\GraphQL\\Field\\Page\\Fieldtype\\" . $field->type->className();
-        if (!class_exists($className)) continue;
-        $config->addField(new $className($field));
-      }
-    }
   }
 
   public function resolveType($page)

src/Type/Object/TemplatedPageType.php

@@ -37,11 +37,14 @@ public function getDescription()
 
   public function build($config)
   {
-    $legalFields = Utils::moduleConfig()->legalViewFields;
+    $legalFields = Utils::moduleConfig()->legalFields;
     $config->applyInterface(new PageInterfaceType());
     foreach ($this->template->fields as $field) {
+      // skip illigal fields
       if (!$legalFields->has($field)) continue;
-      if ($field->flags & Field::flagGlobal) continue; // global fields are already added via PageInterfaceType
+      // check if user has permission to view this field
+      if (!Utils::hasFieldPermission('view', $field, $this->template)) continue;
+      // skip if the field type is not supported
       $className = "\\ProcessWire\\GraphQL\\Field\\Page\\Fieldtype\\" . $field->type->className();
       if (!class_exists($className)) continue;
       $config->addField(new $className($field));

src/Utils.php

@@ -9,6 +9,8 @@
 namespace ProcessWire\GraphQL;
 
 use ProcessWire\Languages;
+use ProcessWire\Field;
+use ProcessWire\Template;
 use ProcessWire\GraphQL\Config;
 
 class Utils {
@@ -189,4 +191,28 @@ public static function getReservedWords()
     ];
   }
 
+  /**
+   * Determines whether the current user has given permission on $field within
+   * $template's context.
+   * @param  string   $permission The permission type. Either 'view' or 'edit'
+   * @param  Field    $field      The field against the check is performed
+   * @param  Template $template   The context of the field.
+   * @return boolean              Returns true if user has rights and false otherwise
+   */
+  public static function hasFieldPermission($permission = 'view', Field $field, Template $template)
+  {
+    $field = $template->fields->getFieldContext($field);
+    if ($field->useRoles) {
+      $roles = $permission . 'Roles';
+      foreach (Utils::user()->roles as $role) {
+        if (in_array($role->id, $field->$roles)) return true;
+      }
+      return false;
+    } else if (Utils::moduleConfig()->grantFieldsAccess) {
+      return true;
+    } else {
+      return false;
+    }
+  }
+
 }