acl always do checkScope

application/Espo/Core/AclManager.php

@@ -193,11 +193,13 @@ class AclManager
 
     /**
      * Get an access level for a specific scope and action.
-     *
-     * @todo Use LevelProvider?
      */
     public function getLevel(User $user, string $scope, string $action): string
     {
+        if (!$this->checkScope($user, $scope)) {
+            return Table::LEVEL_NO;
+        }
+
         $data = $this->getTable($user)->getScopeData($scope);
 
         return $data->get($action);
@@ -281,6 +283,10 @@ class AclManager
     {
         $scope = $entity->getEntityType();
 
+        if (!$this->checkScope($user, $scope)) {
+            return false;
+        }
+
         $data = $this->getTable($user)->getScopeData($scope);
 
         $checker = $this->getAccessChecker($scope);
@@ -395,6 +401,10 @@ class AclManager
      */
     public function checkScope(User $user, string $scope, ?string $action = null): bool
     {
+        if ($action && !$this->checkScope($user, $scope)) {
+            return false;
+        }
+
         $data = $this->getTable($user)->getScopeData($scope);
 
         $checker = $this->getAccessChecker($scope);