From f471335549d303b7d4f3a5e1c70be33d6b560070 Mon Sep 17 00:00:00 2001 From: Philipinho <16838612+Philipinho@users.noreply.github.com> Date: Sat, 8 Aug 2026 23:13:58 +0100 Subject: [PATCH] feat(page): add validateCanCreate space permission check --- .../core/page/page-access/page-access.service.ts | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/apps/server/src/core/page/page-access/page-access.service.ts b/apps/server/src/core/page/page-access/page-access.service.ts index 6d6db03fa..0dded2f00 100644 --- a/apps/server/src/core/page/page-access/page-access.service.ts +++ b/apps/server/src/core/page/page-access/page-access.service.ts @@ -102,6 +102,19 @@ export class PageAccessService { return { hasRestriction: hasAnyRestriction }; } + /** + * Validate user can create a root page in the space, throws if not. + * Mirrors the space-level check the HTTP create endpoint enforces so + * non-HTTP callers (Slack, integrations) cannot bypass it. A non-member + * (including a space in another workspace) throws from createForUser. + */ + async validateCanCreate(spaceId: string, user: User): Promise { + const ability = await this.spaceAbility.createForUser(user, spaceId); + if (ability.cannot(SpaceCaslAction.Create, SpaceCaslSubject.Page)) { + throw new ForbiddenException(); + } + } + async validateCanComment( page: Page, user: User,