From 740f8bfaa67e356406d9e67cce162a4169aed07b Mon Sep 17 00:00:00 2001
From: Yurii <yurikuzn@users.noreply.github.com>
Date: Fri, 13 Dec 2024 11:40:40 +0200
Subject: [PATCH] source email access check

---
 .../Meeting/BeforeCreateSourceEmailCheck.php  | 42 +++++++++++++++++++
 .../metadata/recordDefs/Meeting.json          |  3 ++
 2 files changed, 45 insertions(+)
 create mode 100644 application/Espo/Modules/Crm/Classes/RecordHooks/Meeting/BeforeCreateSourceEmailCheck.php

diff --git a/application/Espo/Modules/Crm/Classes/RecordHooks/Meeting/BeforeCreateSourceEmailCheck.php b/application/Espo/Modules/Crm/Classes/RecordHooks/Meeting/BeforeCreateSourceEmailCheck.php
new file mode 100644
index 0000000000..f3d66e5d24
--- /dev/null
+++ b/application/Espo/Modules/Crm/Classes/RecordHooks/Meeting/BeforeCreateSourceEmailCheck.php
@@ -0,0 +1,42 @@
+<?php
+
+namespace Espo\Modules\Crm\Classes\RecordHooks\Meeting;
+
+use Espo\Core\Acl;
+use Espo\Core\Exceptions\Forbidden;
+use Espo\Core\Record\CreateParams;
+use Espo\Core\Record\Hook\CreateHook;
+use Espo\Entities\Email;
+use Espo\Modules\Crm\Entities\Meeting;
+use Espo\ORM\Entity;
+use Espo\ORM\EntityManager;
+
+/**
+ * @implements CreateHook<Meeting>
+ */
+class BeforeCreateSourceEmailCheck implements CreateHook
+{
+    public function __construct(
+        private EntityManager $entityManager,
+        private Acl $acl,
+    ) {}
+
+    public function process(Entity $entity, CreateParams $params): void
+    {
+        $emailId = $entity->get('sourceEmailId');
+
+        if (!$emailId) {
+            return;
+        }
+
+        $email = $this->entityManager->getRDBRepositoryByClass(Email::class)->getById($emailId);
+
+        if (!$email) {
+            return;
+        }
+
+        if (!$this->acl->checkEntityRead($email)) {
+            throw new Forbidden("No access to source email.");
+        }
+    }
+}
diff --git a/application/Espo/Modules/Crm/Resources/metadata/recordDefs/Meeting.json b/application/Espo/Modules/Crm/Resources/metadata/recordDefs/Meeting.json
index 7cc96b12df..d4e578f029 100644
--- a/application/Espo/Modules/Crm/Resources/metadata/recordDefs/Meeting.json
+++ b/application/Espo/Modules/Crm/Resources/metadata/recordDefs/Meeting.json
@@ -9,6 +9,9 @@
         "Espo\\Core\\FieldProcessing\\Reminder\\Saver",
         "Espo\\Modules\\Crm\\Classes\\FieldProcessing\\Meeting\\SourceEmailSaver"
     ],
+    "beforeCreateHookClassNameList": [
+        "Espo\\Modules\\Crm\\Classes\\RecordHooks\\Meeting\\BeforeCreateSourceEmailCheck"
+    ],
     "beforeUpdateHookClassNameList": [
         "__APPEND__",
         "Espo\\Classes\\RecordHooks\\Event\\BeforeUpdatePreserveDuration"