diff --git a/apiserver/plane/ee/urls/app/page.py b/apiserver/plane/ee/urls/app/page.py index 1fc18c7a08..7d1eeab786 100644 --- a/apiserver/plane/ee/urls/app/page.py +++ b/apiserver/plane/ee/urls/app/page.py @@ -48,6 +48,16 @@ urlpatterns = [ ), name="workspace-page-archive-unarchive", ), + # private and public page + path( + "workspaces//pages//access/", + WorkspacePageViewSet.as_view( + { + "post": "access", + } + ), + name="project-pages-access", + ), # lock and unlock path( "workspaces//pages//lock/", diff --git a/apiserver/plane/ee/views/app/page/workspace.py b/apiserver/plane/ee/views/app/page/workspace.py index 3593d4c5f6..dff30869c2 100644 --- a/apiserver/plane/ee/views/app/page/workspace.py +++ b/apiserver/plane/ee/views/app/page/workspace.py @@ -216,6 +216,29 @@ class WorkspacePageViewSet(BaseViewSet): return Response(status=status.HTTP_204_NO_CONTENT) + @check_feature_flag(FeatureFlag.WORKSPACE_PAGES) + def access(self, request, slug, pk): + access = request.data.get("access", 0) + page = Page.objects.filter( + pk=pk, workspace__slug=slug + ).first() + + # Only update access if the page owner is the requesting user + if ( + page.access != request.data.get("access", page.access) + and page.owned_by_id != request.user.id + ): + return Response( + { + "error": "Access cannot be updated since this page is owned by someone else" + }, + status=status.HTTP_400_BAD_REQUEST, + ) + + page.access = access + page.save() + return Response(status=status.HTTP_204_NO_CONTENT) + @check_feature_flag(FeatureFlag.WORKSPACE_PAGES) def list(self, request, slug): queryset = self.get_queryset() diff --git a/web/ee/services/page/workspace-page.service.ts b/web/ee/services/page/workspace-page.service.ts index b256a5d11e..de2ef39f3b 100644 --- a/web/ee/services/page/workspace-page.service.ts +++ b/web/ee/services/page/workspace-page.service.ts @@ -42,6 +42,14 @@ export class WorkspacePageService extends APIService { }); } + async updateAccess(workspaceSlug: string, pageId: string, data: Partial): Promise { + return this.post(`/api/workspaces/${workspaceSlug}/pages/${pageId}/access/`, data) + .then((response) => response?.data) + .catch((error) => { + throw error?.response?.data; + }); + } + async remove(workspaceSlug: string, pageId: string): Promise { return this.delete(`/api/workspaces/${workspaceSlug}/pages/${pageId}/`) .then((response) => response?.data) diff --git a/web/ee/store/pages/page.ts b/web/ee/store/pages/page.ts index 53b3038a70..cf8b1791f4 100644 --- a/web/ee/store/pages/page.ts +++ b/web/ee/store/pages/page.ts @@ -369,7 +369,7 @@ export class WorkspacePageDetails implements IWorkspacePageDetails { runInAction(() => (this.access = EPageAccess.PUBLIC)); try { - await this.pageService.update(workspaceSlug, this.id, { + await this.pageService.updateAccess(workspaceSlug, this.id, { access: EPageAccess.PUBLIC, }); } catch (error) { @@ -391,7 +391,7 @@ export class WorkspacePageDetails implements IWorkspacePageDetails { runInAction(() => (this.access = EPageAccess.PRIVATE)); try { - await this.pageService.update(workspaceSlug, this.id, { + await this.pageService.updateAccess(workspaceSlug, this.id, { access: EPageAccess.PRIVATE, }); } catch (error) {