@dotcms/uve 26.9.3-1 → 26.9.3-1-next.2649

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dotcms/uve",
-  "version": "26.09.03-01",
+  "version": "26.9.3-1-next.2649",
   "description": "Official JavaScript library for interacting with Universal Visual Editor (UVE)",
   "repository": {
     "type": "git",

package/public.cjs.js

@@ -46,6 +46,24 @@ function getDotCMSPageBounds(containers) {
     };
   });
 }
+/**
+ * Whether the current user may edit the contentlet described by `dataset`.
+ *
+ * Reads `data-dot-can-edit`, which the Velocity container renderer stamps on
+ * every contentlet in EDIT mode from a WRITE-level permission check against the
+ * contentlet instance.
+ *
+ * **Fails open** — only the literal `"false"` denies. Headless and SDK-rendered
+ * pages build their own wrappers and never emit the attribute, so treating a
+ * missing value as denied would disable every edit affordance on all of them.
+ *
+ * Shared by the hover/click payload and the bounds payload so both carry the
+ * same answer; the bounds payload re-anchors the current selection on every
+ * layout change, and omitting the permission there silently reopens the gates.
+ */
+function readCanEditFromDataset(dataset) {
+  return dataset?.['dotCanEdit'] !== 'false';
+}
 /**
  * Calculates the bounding information for each contentlet inside a container.
  *
@@ -75,7 +93,8 @@ function getDotCMSContentletsBound(containerRect, contentlets) {
           identifier: contentlet.dataset?.['dotIdentifier'],
           title: contentlet.dataset?.['dotTitle'],
           inode: contentlet.dataset?.['dotInode'],
-          contentType: contentlet.dataset?.['dotType']
+          contentType: contentlet.dataset?.['dotType'],
+          canEdit: readCanEditFromDataset(contentlet.dataset)
         }
       })
     };
@@ -252,6 +271,11 @@ function getDotContentletAttributes(contentlet, container) {
     'data-dot-type': contentlet?.contentType,
     'data-dot-container': container,
     'data-dot-on-number-of-pages': contentlet?.['onNumberOfPages'] || '1',
+    // Mirrors `data-dot-can-edit` from the Velocity renderer so the editor
+    // reads one attribute on both surfaces. Fails open: an older dotCMS
+    // release does not return `canEdit`, and the editor must behave as it
+    // does today rather than lock the user out.
+    'data-dot-can-edit': String(contentlet?.canEdit !== false),
     ...(contentlet?.dotStyleProperties && {
       'data-dot-style-properties': JSON.stringify(contentlet.dotStyleProperties)
     })
@@ -393,6 +417,13 @@ function getDotContainerAttributes({
  * normalized contentlet object. Mirrors the shape consumed by the editor's
  * SET_BOUNDS and CONTENTLET_CLICKED events. Optionally parses the
  * `dotStyleProperties` JSON when present.
+ *
+ * `canEdit` reflects `data-dot-can-edit`, which the Velocity container renderer
+ * stamps on every contentlet in EDIT mode from a WRITE-level permission check
+ * against the contentlet instance. It **fails open**: only the literal `"false"`
+ * denies. Headless and SDK-rendered pages build their own wrappers and never
+ * emit the attribute, so treating a missing value as denied would disable every
+ * edit affordance on all of them.
  */
 function readContentletDataset(element) {
   const dataset = element.dataset ?? {};
@@ -404,6 +435,7 @@ function readContentletDataset(element) {
     baseType: dataset['dotBasetype'],
     widgetTitle: dataset['dotWidgetTitle'],
     onNumberOfPages: dataset['dotOnNumberOfPages'],
+    canEdit: readCanEditFromDataset(dataset),
     ...(dataset['dotStyleProperties'] && {
       dotStyleProperties: JSON.parse(dataset['dotStyleProperties'])
     })

package/public.esm.js

@@ -44,6 +44,24 @@ function getDotCMSPageBounds(containers) {
     };
   });
 }
+/**
+ * Whether the current user may edit the contentlet described by `dataset`.
+ *
+ * Reads `data-dot-can-edit`, which the Velocity container renderer stamps on
+ * every contentlet in EDIT mode from a WRITE-level permission check against the
+ * contentlet instance.
+ *
+ * **Fails open** — only the literal `"false"` denies. Headless and SDK-rendered
+ * pages build their own wrappers and never emit the attribute, so treating a
+ * missing value as denied would disable every edit affordance on all of them.
+ *
+ * Shared by the hover/click payload and the bounds payload so both carry the
+ * same answer; the bounds payload re-anchors the current selection on every
+ * layout change, and omitting the permission there silently reopens the gates.
+ */
+function readCanEditFromDataset(dataset) {
+  return dataset?.['dotCanEdit'] !== 'false';
+}
 /**
  * Calculates the bounding information for each contentlet inside a container.
  *
@@ -73,7 +91,8 @@ function getDotCMSContentletsBound(containerRect, contentlets) {
           identifier: contentlet.dataset?.['dotIdentifier'],
           title: contentlet.dataset?.['dotTitle'],
           inode: contentlet.dataset?.['dotInode'],
-          contentType: contentlet.dataset?.['dotType']
+          contentType: contentlet.dataset?.['dotType'],
+          canEdit: readCanEditFromDataset(contentlet.dataset)
         }
       })
     };
@@ -250,6 +269,11 @@ function getDotContentletAttributes(contentlet, container) {
     'data-dot-type': contentlet?.contentType,
     'data-dot-container': container,
     'data-dot-on-number-of-pages': contentlet?.['onNumberOfPages'] || '1',
+    // Mirrors `data-dot-can-edit` from the Velocity renderer so the editor
+    // reads one attribute on both surfaces. Fails open: an older dotCMS
+    // release does not return `canEdit`, and the editor must behave as it
+    // does today rather than lock the user out.
+    'data-dot-can-edit': String(contentlet?.canEdit !== false),
     ...(contentlet?.dotStyleProperties && {
       'data-dot-style-properties': JSON.stringify(contentlet.dotStyleProperties)
     })
@@ -391,6 +415,13 @@ function getDotContainerAttributes({
  * normalized contentlet object. Mirrors the shape consumed by the editor's
  * SET_BOUNDS and CONTENTLET_CLICKED events. Optionally parses the
  * `dotStyleProperties` JSON when present.
+ *
+ * `canEdit` reflects `data-dot-can-edit`, which the Velocity container renderer
+ * stamps on every contentlet in EDIT mode from a WRITE-level permission check
+ * against the contentlet instance. It **fails open**: only the literal `"false"`
+ * denies. Headless and SDK-rendered pages build their own wrappers and never
+ * emit the attribute, so treating a missing value as denied would disable every
+ * edit affordance on all of them.
  */
 function readContentletDataset(element) {
   const dataset = element.dataset ?? {};
@@ -402,6 +433,7 @@ function readContentletDataset(element) {
     baseType: dataset['dotBasetype'],
     widgetTitle: dataset['dotWidgetTitle'],
     onNumberOfPages: dataset['dotOnNumberOfPages'],
+    canEdit: readCanEditFromDataset(dataset),
     ...(dataset['dotStyleProperties'] && {
       dotStyleProperties: JSON.parse(dataset['dotStyleProperties'])
     })

package/src/lib/dom/dom.utils.d.ts

@@ -230,6 +230,13 @@ export declare function getDotContainerAttributes({ uuid, identifier, acceptType
  * normalized contentlet object. Mirrors the shape consumed by the editor's
  * SET_BOUNDS and CONTENTLET_CLICKED events. Optionally parses the
  * `dotStyleProperties` JSON when present.
+ *
+ * `canEdit` reflects `data-dot-can-edit`, which the Velocity container renderer
+ * stamps on every contentlet in EDIT mode from a WRITE-level permission check
+ * against the contentlet instance. It **fails open**: only the literal `"false"`
+ * denies. Headless and SDK-rendered pages build their own wrappers and never
+ * emit the attribute, so treating a missing value as denied would disable every
+ * edit affordance on all of them.
  */
 export declare function readContentletDataset(element: HTMLElement): {
     dotStyleProperties?: any;
@@ -240,6 +247,7 @@ export declare function readContentletDataset(element: HTMLElement): {
     baseType: string | undefined;
     widgetTitle: string | undefined;
     onNumberOfPages: string | undefined;
+    canEdit: boolean;
 };
 /**
  * Returns Zone.js's *unpatched* native `addEventListener` / `removeEventListener`