From 028a63e17efd3e168684b9a6521c96465d7985b4 Mon Sep 17 00:00:00 2001
From: Sebastian Kurfuerst <sebastian.kurfuerst@sandstorm.de>
Date: Tue, 21 Oct 2025 08:39:09 +0200
Subject: [PATCH] FEATURE: add NodePermissions::remove; introduce
 ContentRepositoryAuthorizationInterface

---
 Classes/Controller/BackendServiceController.php            | 7 ++++---
 Classes/Fusion/Helper/WorkspaceHelper.php                  | 4 ++--
 .../Infrastructure/Configuration/ConfigurationProvider.php | 4 ++--
 3 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/Classes/Controller/BackendServiceController.php b/Classes/Controller/BackendServiceController.php
index e75085121c..7cf6d4dc72 100644
--- a/Classes/Controller/BackendServiceController.php
+++ b/Classes/Controller/BackendServiceController.php
@@ -33,7 +33,7 @@
 use Neos\Neos\Domain\Service\WorkspacePublishingService;
 use Neos\Neos\Domain\Service\WorkspaceService;
 use Neos\Neos\FrontendRouting\SiteDetection\SiteDetectionResult;
-use Neos\Neos\Security\Authorization\ContentRepositoryAuthorizationService;
+use Neos\Neos\Security\Authorization\ContentRepositoryAuthorizationInterface;
 use Neos\Neos\Service\UserService;
 use Neos\Neos\Ui\Application\ChangeTargetWorkspace;
 use Neos\Neos\Ui\Application\DiscardAllChanges;
@@ -178,7 +178,7 @@ class BackendServiceController extends ActionController
 
     /**
      * @Flow\Inject
-     * @var ContentRepositoryAuthorizationService
+     * @var ContentRepositoryAuthorizationInterface
      */
     protected $contentRepositoryAuthorizationService;
 
@@ -597,8 +597,9 @@ public function getAdditionalNodeMetadataAction(array $nodes): void
                 $nodePrivileges = $this->contentRepositoryAuthorizationService->getNodePermissions($node, $this->securityContext->getRoles());
                 $result[$nodeAddress->toJson()] = [
                     'policy' => [
+                        // TODO: support für "create" -> CreateNodeDialog vorfiltern
                         'disallowedNodeTypes' => [], // not implemented for Neos 9.0
-                        'canRemove' => $nodePrivileges->edit,
+                        'canRemove' => $nodePrivileges->remove,
                         'canEdit' => $nodePrivileges->edit,
                         'disallowedProperties' => [] // not implemented for Neos 9.0
                     ]
diff --git a/Classes/Fusion/Helper/WorkspaceHelper.php b/Classes/Fusion/Helper/WorkspaceHelper.php
index 63ad825d21..6749c91ea3 100644
--- a/Classes/Fusion/Helper/WorkspaceHelper.php
+++ b/Classes/Fusion/Helper/WorkspaceHelper.php
@@ -18,7 +18,7 @@
 use Neos\Flow\Security\Context;
 use Neos\Neos\Domain\Service\UserService;
 use Neos\Neos\Domain\Service\WorkspaceService;
-use Neos\Neos\Security\Authorization\ContentRepositoryAuthorizationService;
+use Neos\Neos\Security\Authorization\ContentRepositoryAuthorizationInterface;
 use Neos\Neos\Ui\ContentRepository\Service\WorkspaceService as UiWorkspaceService;
 
 /**
@@ -58,7 +58,7 @@ class WorkspaceHelper implements ProtectedContextAwareInterface
 
     /**
      * @Flow\Inject
-     * @var ContentRepositoryAuthorizationService
+     * @var ContentRepositoryAuthorizationInterface
      */
     protected $contentRepositoryAuthorizationService;
 
diff --git a/Classes/Infrastructure/Configuration/ConfigurationProvider.php b/Classes/Infrastructure/Configuration/ConfigurationProvider.php
index 68ccdb3af2..d5a2d5a280 100644
--- a/Classes/Infrastructure/Configuration/ConfigurationProvider.php
+++ b/Classes/Infrastructure/Configuration/ConfigurationProvider.php
@@ -21,7 +21,7 @@
 use Neos\Flow\Security\Context as SecurityContext;
 use Neos\Neos\Domain\Model\WorkspaceClassification;
 use Neos\Neos\Domain\Service\WorkspaceService;
-use Neos\Neos\Security\Authorization\ContentRepositoryAuthorizationService;
+use Neos\Neos\Security\Authorization\ContentRepositoryAuthorizationInterface;
 use Neos\Neos\Service\UserService;
 use Neos\Neos\Ui\Domain\InitialData\CacheConfigurationVersionProviderInterface;
 use Neos\Neos\Ui\Domain\InitialData\ConfigurationProviderInterface;
@@ -45,7 +45,7 @@ final class ConfigurationProvider implements ConfigurationProviderInterface
     protected WorkspaceService $workspaceService;
 
     #[Flow\Inject]
-    protected ContentRepositoryAuthorizationService $contentRepositoryAuthorizationService;
+    protected ContentRepositoryAuthorizationInterface $contentRepositoryAuthorizationService;
 
     #[Flow\Inject]
     protected CacheConfigurationVersionProviderInterface $cacheConfigurationVersionProvider;