Manipulate Component.ApplicableActions through event system to allow editing

Question

If you have a folder containing components that a user has only Read permission on, is it possible to roll your own authorisation logic in the event system so that you could allow a user to actually edit a component when they opened it?

So if you subscribe to LoadEventArgs and SaveEventArgs in the Initiated phase for a Component, do your custom authorisation and then update a Components ApplicableActions to include the Edit action, would that work?

comp.ApplicableActions.SetAction("Edit", true) 

UPDATE

I installed a small piece of event system code and set up a folder to give only the Read permission to a user:

private void ComponentLoad(Component subject, LoadEventArgs e, EventPhases phase)
{
    Logger.Write("ComponentLoad", subject.Id.ToString(), LoggingCategory.General);

    using (var elavated = new ElevatedPrivilegesScope(subject.Session, Privileges.SysAdmin))
    {
        Logger.Write("ComponentLoad ElevatedPrivilegesScope", subject.Id.ToString(), LoggingCategory.General);
        subject.ApplicableActions.SetAction("Edit", true);
    }
}

I can see that ComponentLoad gets hit quite a few times (which I've read before is to be expected) - but when the component is loaded, the GUI still shows a read-only interface, not en editable one.

Cheers

Answer 1

Rather than changing the Permissions on the Component/Folder, you could consider using the ElevatePrivileges and RestorePrivileges Core Service methods to elevate the user to a System Administrator during that session.

Answer 2

The Applicable Actions are not used to drive the authorization logic in the CM Kernel, but only to drive which actions are allowed/disallowed/disabled in the GUI.

So, an approach can be to use standard CM Security to restrict access in the most lax manner and then use a Load event handler to modify ApplicableActions so that the GUI can disallow actions even though CM Security would allow them.

UPDATE

I now see where your problem lies: indeed, to set whether the built-in Edit actions is allowed or disallowed, you would have to set the "tcm:Edit" Applicable Action, but the TOM.NET does not allow you to do this.

What will probably work is to change the Applicable Actions in a UI Data Extender.

On your comment: if you try to reverse it (allow actions in the GUI that CM Security will not allow), I think you are only complicating matters. You will still need a way to drive the allowed actions in the GUI, and you also need a way to bypass CM Security (e.g. using privilege elevation)

UPDATE 2

The restriction that so-called "system actions" cannot be changed in a TOM.NET event handler will be removed in SDL Tridion Sites 9.1