Document Recycle Bin: Checks user permission for Document "Read"

[leekelleher]

Description

ref: #22274 (comment)

Discovered during the development of Elements (for v18.0), if a user does not have Document "Read" permission, they can still view items in the Recycle Bin. To note, they can not access the trashed document directly, only the see the tree/collection.

This PR adds conditions to manifests of the Document Recycle Bin menu and root workspace to check the user's "Read" permission. We do not have the equivalent user permissions for Media, so it does not have the same condition.

There is an extra change in this PR, I have in-lined constructor for the "Allow Media Recycle Bin Current User Condition" manifest, as this will reduce the extra fetch request on initial app start up. This mirrors how the equivalent Document condition is loaded.

How to test?

• Make sure you have trashed documents in the Recycle Bin
• Configure a backoffice user account with heavily restricted permissions, e.g. Document Read = false
• Log in to the backoffice with that user, can you see the recycle bin? (Hopefully not! 😅)

[claude]

Claude finished @leekelleher's task in 4m 53s —— View job

---

PR Review

Target: origin/v17/dev · Based on commit: 14523b5c

Adds a UMB_DOCUMENT_USER_PERMISSION_CONDITION_ALIAS (Read) guard to the Document Recycle Bin menu item and workspace collection view so users lacking Read permission no longer see the bin in the tree or collection. Also switches the Media Recycle Bin condition from a lazy import to a direct (eager) class reference, matching the pattern already used by the document equivalent.

• Other changes: Users without Document Read permission will no longer see the Document Recycle Bin menu item or its collection content. Media Recycle Bin condition class is now eagerly loaded (eliminates one extra fetch on startup).

---

Suggestions

• recycle-bin/root/workspace/manifests.ts:37: The permission condition gates the workspaceView (collection) but not the workspace definition itself (lines 11–20). Navigating to the Recycle Bin URL directly still loads the workspace, just with no visible content. Since the menu item is also hidden by the new condition in menu/manifests.ts, normal user flows are covered — but a direct URL would land on an empty workspace rather than being blocked outright. If that matters, the same condition could be added to the workspace entry too. Fix this →

---

Approved with Suggestions for improvement

Good to go, but please carefully consider the importance of the suggestions.

---

• Gather context and understand the request
• Read the review skill procedure
• Read the changed files
• Analyze changes for correctness, security, and quality
• Post inline comment for suggestion
• Post overall review summary
• Apply labels (area/frontend, category/ux)

[Copilot]

Pull request overview

This PR tightens backoffice UI access to the Document Recycle Bin in v17 by ensuring users without Document “Read” permission can’t see the recycle bin entry points (tree menu item and root collection workspace view). It also aligns the Media recycle bin “allow” condition manifest with the Document equivalent by inlining the condition class to avoid an extra dynamic import request at startup.

Changes:

• Add a document user-permission condition (Umb.Document.Read) to the Document Recycle Bin menu item manifest so it’s hidden when the user lacks read permission.
• Add the same permission condition to the Document Recycle Bin root collection workspace view manifest to prevent viewing the recycle bin collection via direct navigation.
• Inline the Media recycle bin current-user allow-condition class in its manifest (replacing the lazy import) to reduce initial fetches.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
src/Umbraco.Web.UI.Client/src/packages/media/media/recycle-bin/manifests.ts	Switches the Media recycle bin allow-condition manifest from dynamic import to a statically imported condition class.
src/Umbraco.Web.UI.Client/src/packages/documents/documents/recycle-bin/root/workspace/manifests.ts	Adds a Umb.Document.Read user-permission condition to the recycle bin root collection workspace view.
src/Umbraco.Web.UI.Client/src/packages/documents/documents/recycle-bin/menu/manifests.ts	Adds a Umb.Document.Read user-permission condition to the recycle bin menu item to hide it when read is denied.