Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 08:51:31 +08:00
Code Packages Activity Actions
discourse/spec/serializers
History
Exact
Martin Brennan e590d2a2d5
 DEV: Add banned_acl concept to AccessControlList (#41254) 
Introduces a server-side definition of banned_acl,
similar to mandatory_acl from 5823e4e3b2

This allows AclTarget implementing classes to define
which ACLs cannot be used for certain types. For example:

```
def self.banned_acl
  [{ type: :group, id: Group::AUTO_GROUPS[:anonymous_users], permission: "edit" }]
end
```

This prevents anonymous users group from being able to have the Edit
permission on the target, which is practical because the anonymous
user is not logged in and generally cannot create/edit anything.

This restriction is passed to the DAccessControl component via the Site
serializer, same as mandatory_acl, and is used to prevent the user from
selecting the banned ACLs in the UI.

Then, server-side this rule is enforced in `AccessControlListManager`
service as a policy.

**Before**

<img width="971" height="287" alt="image"
src="https://github.com/user-attachments/assets/af4ace0f-7b11-4005-8344-774d554693f0"
/>


**After**

<img width="914" height="194" alt="image"
src="https://github.com/user-attachments/assets/b756b976-f6e6-4331-b27d-c9a2d13997aa"
/>
2026-06-29 16:22:30 +10:00
..
concerns FEATURE: Prevent silenced users from liking and using reactions (#37040) 2026-01-13 13:59:57 +01:00
about_serializer_spec.rb FEATURE: Localizable /about page fields via its settings page (#41123) 2026-06-26 20:41:08 +08:00
admin_detailed_user_serializer_spec.rb SECURITY: AdminDetailedUserSerializer#latest_export leaking user exports 2026-01-28 17:11:14 +00:00
admin_plugin_serializer_spec.rb DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
admin_user_action_serializer_spec.rb
admin_user_list_serializer_spec.rb FIX: Staged user emails bypass moderator email visibility setting (#40411) 2026-05-29 19:26:17 -03:00
auth_provider_serializer_spec.rb DEV: Add capability to pass an icon setting into auth provider registration (#34584) 2025-08-28 09:14:36 -05:00
basic_group_serializer_spec.rb
basic_group_user_serializer_spec.rb
basic_post_serializer_spec.rb FEATURE: Serve localized content in the site's default locale when user's language is unsupported (#36160) 2025-11-21 17:19:04 +08:00
basic_reviewable_flagged_post_serializer_spec.rb
basic_reviewable_queued_post_serializer_spec.rb
basic_reviewable_serializer_spec.rb
basic_reviewable_user_serializer_spec.rb
basic_topic_serializer_spec.rb FEATURE: Serve localized content in the site's default locale when user's language is unsupported (#36160) 2025-11-21 17:19:04 +08:00
basic_user_serializer_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
category_detailed_serializer_spec.rb
category_serializer_spec.rb DEV: Remove enable_simplified_category_creation old code (#40108) 2026-05-27 10:04:46 +10:00
category_upload_serializer_spec.rb
color_scheme_serializer_spec.rb FIX: Allow creating new color palettes based on custom palettes (#34351) 2025-08-20 11:58:40 +08:00
component_index_serializer_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
current_user_serializer_spec.rb FEATURE: Allow topic_timers_allowed_groups to manage topic timers (#41126) 2026-06-23 12:46:56 -05:00
detailed_user_badge_serializer_spec.rb
directory_item_serializer_spec.rb
emoji_serializer_spec.rb
flag_serializer_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
flagged_user_serializer_spec.rb SECURITY: Hide IP from flagged regular users 2026-03-19 15:21:28 +00:00
found_user_serializer_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
group_show_serializer_spec.rb FIX: Ensure moderators do not clear group email domain (#39631) 2026-04-29 14:32:38 +08:00
group_user_serializer_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
group_user_with_custom_fields_serializer_spec.rb
incoming_email_details_serializer_spec.rb FIX: Remove error section when viewing details for received emails (#35228) 2025-10-07 16:25:11 +08:00
incoming_email_serializer_spec.rb FIX: Remove error section when viewing details for received emails (#35228) 2025-10-07 16:25:11 +08:00
invite_serializer_spec.rb SECURITY: Prevent expired invite details from leaking (#41184) 2026-06-25 22:01:51 +08:00
listable_topic_serializer_spec.rb
nested_replies_basic_category_serializer_spec.rb FEATURE: First iteration of nested replies (#38888) 2026-04-16 08:06:44 -05:00
new_post_result_serializer_spec.rb
notification_serializer_spec.rb FIX: Notifications may not have topics (#36143) 2025-11-21 01:50:31 +08:00
pending_post_serializer_spec.rb
post_action_type_serializer_spec.rb
post_item_excerpt_spec.rb FIX: Handle Nokogiri HTML parser limits in PrettyText.excerpt (#37610) 2026-02-06 22:00:54 +01:00
post_localization_serializer_spec.rb
post_revision_serializer_spec.rb FEATURE: Allow editing a post's reply target from the composer (#39471) 2026-04-29 12:23:26 -03:00
post_serializer_spec.rb FIX: Post serialization exposes hidden-profile user status messages (#40885) 2026-06-15 09:25:47 -05:00
poster_serializer_spec.rb
remote_theme_serializer_spec.rb
reviewable_claimed_topic_serializer_spec.rb
reviewable_flagged_post_serializer_spec.rb FIX: Show translated post in review queue when present (#40378) 2026-05-29 14:32:11 -04:00
reviewable_note_serializer_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
reviewable_queued_post_serializer_spec.rb SECURITY: Restrict raw email in queued post payloads 2026-05-19 00:26:04 +01:00
reviewable_score_serializer_spec.rb FIX: escape HTML characters in watched word reason (#39378) 2026-04-20 14:15:38 -05:00
reviewable_serializer_spec.rb DEV: Expand top_tags, topic.tags, etc, to return an array of tag objects instead of tag names (#36678) 2026-02-02 10:03:02 +08:00
reviewable_user_serializer_spec.rb DEV: Remove reviewable_ui_refresh feature flag and legacy code (#36752) 2026-02-23 10:45:36 +08:00
single_sign_on_record_serializer_spec.rb
site_serializer_spec.rb DEV: Add banned_acl concept to AccessControlList (#41254) 2026-06-29 16:22:30 +10:00
suggested_topic_serializer_spec.rb FIX: Suggested topic links to nested replies topics (#40302) 2026-05-26 08:40:38 -05:00
tag_group_serializer_spec.rb DEV: Move canonical tag routes to /tag/slug/id keeping /tag/name support (#37055) 2026-02-11 10:21:19 +08:00
tag_serializer_spec.rb FEATURE: Show localized tags (#37044) 2026-02-12 18:06:14 +08:00
theme_index_serializer_spec.rb FEATURE: enhance screenshot support for themes with dark/light modes (#36422) 2025-12-10 11:23:21 +10:00
theme_objects_setting_metadata_serializer_spec.rb DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
theme_serializer_spec.rb FEATURE: enhance screenshot support for themes with dark/light modes (#36422) 2025-12-10 11:23:21 +10:00
theme_settings_serializer_spec.rb DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
topic_link_serializer_spec.rb FIX: Filter orphaned TopicLinks and normalize http URLs to https (#37098) 2026-01-15 12:12:34 +08:00
topic_list_item_serializer_spec.rb FEATURE: Notification/tracking changes for nested replies (#39750) 2026-05-07 12:33:56 -05:00
topic_list_serializer_spec.rb FEATURE: Show localized tags (#37044) 2026-02-12 18:06:14 +08:00
topic_tracking_state_item_serializer_spec.rb FIX: Don't emit tag names/slugs in topic tracking state (#40117) 2026-05-19 05:07:17 +08:00
topic_tracking_state_serializer_spec.rb
topic_view_details_serializer_spec.rb FIX: DeleteReplies should use the guardian instead of checking for staff (#35443) 2025-10-16 18:26:41 +02:00
topic_view_posts_serializer_spec.rb
topic_view_serializer_spec.rb DEV: Remove per topic toggle (#40869) 2026-06-15 18:43:36 +08:00
upload_serializer_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
user_auth_token_serializer_spec.rb DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
user_badge_serializer_spec.rb
user_bookmark_list_serializer_spec.rb
user_card_serializer_spec.rb DEV: Tighten featured topic serialization data (#40549) 2026-06-03 16:32:52 -05:00
user_export_serializer_spec.rb
user_notification_total_serializer_spec.rb
user_post_bookmark_serializer_spec.rb
user_serializer_spec.rb SECURITY: Subscription contributors expose full user profile fields to anonymous viewers (#40891) 2026-06-15 10:24:06 -05:00
user_status_serializer_spec.rb
user_summary_serializer_spec.rb
user_with_custom_fields_serializer_spec.rb
web_hook_post_serializer_spec.rb
web_hook_topic_view_serializer_spec.rb
web_hook_user_serializer_spec.rb DEV: Tighten featured topic serialization data (#40549) 2026-06-03 16:32:52 -05:00
wizard_serializer_spec.rb UX: One step wizard (#36082) 2025-11-25 13:35:32 -05:00