A member restricted to specific collections saw every system collection
(Conventions, Playbooks) whether it was listed for them or not, and an
editor among them could write it, because requireEditPermission passes
any editor before it looks at collections. Eight sites each unioned the
system collections in. They now follow member_collection_access and
grants like any other collection, for reads and writes.
- Store: VisibleCollectionIDsQ, GetUserWorkspaces' freshness MAX and
ResolveBacklinksVisibility drop the union; ListSystemCollectionIDs(Q)
had no caller left and is removed.
- Server: the item-visibility rule, /me's full-access set, watch access,
search and the SSE full set drop it.
- Migrations 108 / 082 list every live system collection for every
member already restricted, so the upgrade changes nobody's access. A
system collection created later is not added for them.
- Settings: Conventions and Playbooks are real checkboxes in the member
access picker, checked by default when an owner moves a member from
All to Specific, with a line saying what unchecking them does.
Also (PR #1756 codex round 2 P1): an editor or owner ROLE applies only
inside the collections a member's access reaches ('all', or listed in
member_collection_access). Before, requireEditPermission let any editor
through before it looked at the collection, so a restricted editor who
could see an item only through a VIEW grant could edit it, comment on it,
create beside it and bulk-mutate it. That was true on main for ordinary
collections too. Outside the member's reach the grant decides, and only
'edit' writes. The same rule now governs the collab socket's write
decision, the bulk per-item and move-target gates, and the cross-workspace
edit authorizer, and ResolveUserPermission's membership step checks the
member's listed collections instead of the navigation set (which lists a
collection because one item in it is granted).
The collection check binds the EDITOR role only (codex round 3, lead
ruling): an owner can set any member's collection access, their own
included, so the owner role keeps its full edit bypass, and the server
agrees with the web client's canEditItem / canEditCollection.
xarmian
3bcef0e04d