BUG: Publishing a new document node from 3rd-level workspace throws security exception, when user is not allowed to publish to live

[gradinarufelix]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

The following workspace constellation applies:

• Workspace A → Workspace B → Live
• The user has no rights to publish to Live
• The user has created a new page with sub-nodes in A and wants to publish to B
• The user goes to the workspace module and only wants to publish individual nodes (selection via checkboxes) from A to B and selects the new page.
• A security excaption is thrown, because the user does not have authorization to publish to Live (does not make sense at first glance)
• In the background: Neos goes through all selected nodes (using paths) and publishes them individually.
• The “target workspace” is always the “parent workspace” of the node. Initially, this is therefore workspace B as the parent of A.
• However, when a page is published, all child nodes are also automatically published! (inner loop)
• So when the actual publishing process (outer loop) arrives at the first child element, this has already been published from A to B.
• Neos still tries to publish the node. As the current workspace of the node is already B, the new parent workspace is “Live”.
• However, the user cannot publish to this workspace and an error occurs.

Expected Behavior

Generally, nodes should not be published twice.

One solution could be that the target workspace is defined explicitly to avoid the described constellation.

Steps To Reproduce

See above.

Environment

- Flow: 8.3.9
- Neos: 8.3.15
- PHP: 8.3

Anything else?

No response