From 114ab93a6a5ea3244c2afc3bd3ac7572f92b115f Mon Sep 17 00:00:00 2001
From: Bjarke Berg <mail@bergmania.dk>
Date: Wed, 6 Oct 2021 10:20:50 +0200
Subject: [PATCH] Moved endpoint to new controller to avoid issue with too hard
 access requirements (#11264)

* Fixed https://github.com/umbraco/Umbraco-CMS/issues/11258

Moved endpoint and obsoleted the old one to avoid breaking changes..
The issue is the auth policies cannot be overridden.. You need all of them, and the controller requires you to have access to member types

* Update src/Umbraco.Web.BackOffice/Controllers/MemberTypeQueryController.cs

Co-authored-by: Nikolaj Geisle <70372949+Zeegaan@users.noreply.github.com>

Co-authored-by: Nikolaj Geisle <70372949+Zeegaan@users.noreply.github.com>
---
 .../Controllers/BackOfficeServerVariables.cs  |  4 ++
 .../Controllers/MemberTypeController.cs       |  1 +
 .../Controllers/MemberTypeQueryController.cs  | 42 +++++++++++++++++++
 .../common/resources/membertype.resource.js   |  4 +-
 4 files changed, 49 insertions(+), 2 deletions(-)
 create mode 100644 src/Umbraco.Web.BackOffice/Controllers/MemberTypeQueryController.cs

diff --git a/src/Umbraco.Web.BackOffice/Controllers/BackOfficeServerVariables.cs b/src/Umbraco.Web.BackOffice/Controllers/BackOfficeServerVariables.cs
index a982ed1744..58f3622e67 100644
--- a/src/Umbraco.Web.BackOffice/Controllers/BackOfficeServerVariables.cs
+++ b/src/Umbraco.Web.BackOffice/Controllers/BackOfficeServerVariables.cs
@@ -279,6 +279,10 @@ namespace Umbraco.Cms.Web.BackOffice.Controllers
                             "memberTypeApiBaseUrl", _linkGenerator.GetUmbracoApiServiceBaseUrl<MemberTypeController>(
                                 controller => controller.GetAllTypes())
                         },
+                        {
+                            "memberTypeQueryApiBaseUrl", _linkGenerator.GetUmbracoApiServiceBaseUrl<MemberTypeQueryController>(
+                                controller => controller.GetAllTypes())
+                        },
                         {
                             "memberGroupApiBaseUrl", _linkGenerator.GetUmbracoApiServiceBaseUrl<MemberGroupController>(
                                 controller => controller.GetAllGroups())
diff --git a/src/Umbraco.Web.BackOffice/Controllers/MemberTypeController.cs b/src/Umbraco.Web.BackOffice/Controllers/MemberTypeController.cs
index 4af907bdfc..7c1f6f4187 100644
--- a/src/Umbraco.Web.BackOffice/Controllers/MemberTypeController.cs
+++ b/src/Umbraco.Web.BackOffice/Controllers/MemberTypeController.cs
@@ -182,6 +182,7 @@ namespace Umbraco.Cms.Web.BackOffice.Controllers
         /// <summary>
         /// Returns all member types
         /// </summary>
+        [Obsolete("Use MemberTypeQueryController.GetAllTypes instead as it only requires AuthorizationPolicies.TreeAccessMembersOrMemberTypes and not both this and AuthorizationPolicies.TreeAccessMemberTypes")]
         [Authorize(Policy = AuthorizationPolicies.TreeAccessMembersOrMemberTypes)]
         public IEnumerable<ContentTypeBasic> GetAllTypes()
         {
diff --git a/src/Umbraco.Web.BackOffice/Controllers/MemberTypeQueryController.cs b/src/Umbraco.Web.BackOffice/Controllers/MemberTypeQueryController.cs
new file mode 100644
index 0000000000..1d15a6448a
--- /dev/null
+++ b/src/Umbraco.Web.BackOffice/Controllers/MemberTypeQueryController.cs
@@ -0,0 +1,42 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using Microsoft.AspNetCore.Authorization;
+using Umbraco.Cms.Core.Mapping;
+using Umbraco.Cms.Core.Models;
+using Umbraco.Cms.Core.Models.ContentEditing;
+using Umbraco.Cms.Core.Services;
+using Umbraco.Cms.Web.Common.Attributes;
+using Umbraco.Cms.Web.Common.Authorization;
+using Constants = Umbraco.Cms.Core.Constants;
+
+namespace Umbraco.Cms.Web.BackOffice.Controllers
+{
+    /// <summary>
+    /// An API controller used for dealing with member types
+    /// </summary>
+    [PluginController(Constants.Web.Mvc.BackOfficeApiArea)]
+    [Authorize(Policy = AuthorizationPolicies.TreeAccessMembersOrMemberTypes)]
+    public class MemberTypeQueryController : BackOfficeNotificationsController
+    {
+        private readonly IMemberTypeService _memberTypeService;
+        private readonly IUmbracoMapper _umbracoMapper;
+
+
+        public MemberTypeQueryController(
+            IMemberTypeService memberTypeService,
+            IUmbracoMapper umbracoMapper)
+        {
+            _memberTypeService = memberTypeService ?? throw new ArgumentNullException(nameof(memberTypeService));
+            _umbracoMapper = umbracoMapper ?? throw new ArgumentNullException(nameof(umbracoMapper));
+        }
+
+        /// <summary>
+        /// Returns all member types
+        /// </summary>
+        public IEnumerable<ContentTypeBasic> GetAllTypes() =>
+            _memberTypeService.GetAll()
+                .Select(_umbracoMapper.Map<IMemberType, ContentTypeBasic>);
+
+    }
+}
diff --git a/src/Umbraco.Web.UI.Client/src/common/resources/membertype.resource.js b/src/Umbraco.Web.UI.Client/src/common/resources/membertype.resource.js
index bf02d9618e..e1d0fbe8ac 100644
--- a/src/Umbraco.Web.UI.Client/src/common/resources/membertype.resource.js
+++ b/src/Umbraco.Web.UI.Client/src/common/resources/membertype.resource.js
@@ -46,10 +46,10 @@ function memberTypeResource($q, $http, umbRequestHelper, umbDataFormatter, local
             return umbRequestHelper.resourcePromise(
                $http.get(
                    umbRequestHelper.getApiUrl(
-                       "memberTypeApiBaseUrl",
+                       "memberTypeQueryApiBaseUrl",
                        "GetAllTypes")),
                'Failed to retrieve data for member types id');
-        },       
+        },
 
         getById: function (id) {