Adds support for custom granular permissions when aggregating across user groups

[AndyButland]

Prerequisites

• I have added steps to test this contribution in the description below

Addresses: #19653

Description

In #18721 we added some steps for aggregating the granular permissions for users (see that PR for details of why). In doing so though, we were explicitly handling the known granular permission types we use in core, and hence it wasn't extensible for someone looking to create custom granular permissions. As the linked issue notes, it had the effect of filtering out the custom ones completely.

This PR addresses that by moving the responsibility for the aggregation to the IPermissionPresentationMapper that each registered granular permission has. It's then up to the implementor of the granular permission to provide the necessary logic. This will differ based on the entity for the permission (e.g. for the core ones, we have one based on documents and one based on document type/property type). And in the logic - in core for example, for the document permissions, we need to take account of permissions set on ancestor documents.

Testing

I've extended and ensured the existing integration tests still pass. It's also possible use the code provided in the linked issue to setup granular permissions on one or more user groups and verify the output when logged in via the following management API endpoint:

GET /umbraco/management/api/v1/user/current

[Copilot]

Pull Request Overview

This PR refactors permission aggregation to be extensible via IPermissionPresentationMapper, implements aggregation in core mappers, updates the user factory to use these mappers, and adds an integration test for custom granular permissions.

• Introduces AggregatePresentationModels on IPermissionPresentationMapper with default impl and XML docs.
• Implements aggregation in DocumentPermissionMapper and DocumentPropertyValuePermissionMapper and refactors UserPresentationFactory to use mappers.
• Adds a new test in UserPresentationFactoryTests for verifying custom permission support.

Reviewed Changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/Umbraco.Tests.Integration/.../UserPresentationFactoryTests.cs	Adds test, mapper and model classes to cover custom permissions
src/Umbraco.Cms.Api.Management/Mapping/Permissions/IPermissionPresentationMapper.cs	Defines new AggregatePresentationModels method and docs
src/Umbraco.Cms.Api.Management/Mapping/Permissions/DocumentPropertyValuePermissionMapper.cs	Implements aggregation for property-value permissions
src/Umbraco.Cms.Api.Management/Mapping/Permissions/DocumentPermissionMapper.cs	Implements aggregation for document permissions
src/Umbraco.Cms.Api.Management/Factories/UserPresentationFactory.cs	Refactors permission aggregation to use mappers
src/Umbraco.Cms.Api.Management/Factories/IUserPresentationFactory.cs	Adds XML docs to factory interface

Comments suppressed due to low confidence (3)

src/Umbraco.Cms.Api.Management/Mapping/Permissions/IPermissionPresentationMapper.cs:23

• The XML comment on MapManyAsync refers to 'DTO' and 'model', but the method actually maps from IGranularPermission to IPermissionPresentationModel. Please update the summary to clearly describe its mapping to presentation view models.

    /// Maps a granular permission DTO to a granular permission model.

src/Umbraco.Cms.Api.Management/Mapping/Permissions/IPermissionPresentationMapper.cs:35

• Using '=> []' as an empty collection literal is invalid C# syntax. Consider returning Enumerable.Empty() or Array.Empty() instead.

    IEnumerable<IPermissionPresentationModel> AggregatePresentationModels(IUser user, IEnumerable<IPermissionPresentationModel> models) => [];

src/Umbraco.Cms.Api.Management/Factories/UserPresentationFactory.cs:352

• Reference to 'UnknownTypePermissionPresentationModel' isn't defined or imported here, causing a compilation error. Ensure this fallback model class exists and is brought into scope or adjust the fallback strategy.

                    .Where(x => x is UnknownTypePermissionPresentationModel)

[PeterKvayt]

@AndyButland
Awesome! Thank you a lot for the fast response!
I hope this fix will be included in 16.1.0.
I have not looked deep it yet, but it seems that this is the right approach.

[PeterKvayt]

@AndyButland
I have tested this solution and it works for me.
All seems good to me except the comment above.

[PeterKvayt]

@AndyButland
I think it is ready to merge

[nikolajlauridsen]

Looks good, I only have one minor performance consideration, but I'll let you decide if it's relevant 😄