ACL in Universl Editor

[josephambrose]

My sandbox is enabled with the Universal Editor, and I attempted to apply ACLs for certain users. When I set deny for rep write, it worked as expected—the user was unable to make content updates. Next, I tried allowing rep write but denying crx replicate. This blocked the publish action for AEM Sites, but not for the Universal Editor. The user could still see the publish button in the Universal Editor and was able to publish pages.

I referred to this Adobe Document : https://experienceleague.adobe.com/en/docs/experience-manager-cloud-service/content/implementing/dev... which mentions using <meta name="urn adobe aue config disable" content="publish"/> to disable the publish button. However, the document doesn't specify where to add this meta tag.

I created the project using GitHub's Xwalk project template, which doesn’t include an index.js or index.html. Instead, it has a head.html file. I tried adding the meta tag to head.html, but the publish button is still not disabled.

Could you advise in which file this meta tag should be added? Is it possible to configure this through the helix-config.yaml file? If so, could you provide the configuration details?

[c-piosecny · Accepted solution]

Hi,

you can add the logic for appending the meta tag to the document in the scripts/editor-support.js file:

// added to scripts/editor-support.js
function disablePublish() {
  const meta = document.createElement('meta');
  meta.setAttribute('name', 'urn:adobe:aue:config:disable');
  meta.setAttribute('content', 'publish');
  document.getElementsByTagName('head')[0].appendChild(meta);
}

disablePublish();
attachEventListners(document.querySelector('main'));

Resulting rendering of UE:

[josephambrose]

Thanks for the information; it's working well. However, the issue is that the publish button is being hidden for all users. It should only be visible to members of the publish user group. How can we access user roles within this JS?

[c-piosecny]

Hey,

you will want to use the pageinfo servlet in your editor-support.js and parse the response for the permissions object for replicate true/false to then set (or just not add) the meta tag.

Path like this:

https://<aem author domain>/libs/wcm/core/content/pageinfo.json?path=/content/your-edge-delivery-site/your-edge-delivery-page

[josephambrose]

Is there no out-of-the-box solution for denying replication in the Universal Editor? Do we need to customize the code in this manner to implement the author-publisher model?