Add asset folder permissions.

backend/src/Squidex.Shared/PermissionIds.cs

@@ -156,6 +156,12 @@ namespace Squidex.Shared
         public const string AppAssetsUpdate = "squidex.apps.{app}.assets.update";
         public const string AppAssetsDelete = "squidex.apps.{app}.assets.delete";
 
+        // App Asset Folders
+        public const string AppAssetFolders = "squidex.apps.{app}.assets.folders";
+        public const string AppAssetFoldersCreate = "squidex.apps.{app}.assets.folders.create";
+        public const string AppAssetFoldersUpdate = "squidex.apps.{app}.assets.folders.update";
+        public const string AppAssetFoldersDelete = "squidex.apps.{app}.assets.folders.delete";
+
         // App Asset Scripts
         public const string AppAssetScripts = "squidex.apps.{app}.asset-scripts";
         public const string AppAssetSScriptsRead = "squidex.apps.{app}.asset-scripts.read";

backend/src/Squidex/Areas/Api/Controllers/Assets/AssetFoldersController.cs

@@ -77,7 +77,7 @@ public sealed class AssetFoldersController : ApiController
     [Route("apps/{app}/assets/folders", Order = -1)]
     [ProducesResponseType(typeof(AssetFolderDto), StatusCodes.Status201Created)]
     [AssetRequestSizeLimit]
-    [ApiPermissionOrAnonymous(PermissionIds.AppAssetsUpdate)]
+    [ApiPermissionOrAnonymous(PermissionIds.AppAssetFoldersCreate)]
     [ApiCosts(1)]
     public async Task<IActionResult> PostAssetFolder(string app, [FromBody] CreateAssetFolderDto request)
     {
@@ -101,7 +101,7 @@ public sealed class AssetFoldersController : ApiController
     [Route("apps/{app}/assets/folders/{id}/", Order = -1)]
     [ProducesResponseType(typeof(AssetFolderDto), StatusCodes.Status200OK)]
     [AssetRequestSizeLimit]
-    [ApiPermissionOrAnonymous(PermissionIds.AppAssetsUpdate)]
+    [ApiPermissionOrAnonymous(PermissionIds.AppAssetFoldersUpdate)]
     [ApiCosts(1)]
     public async Task<IActionResult> PutAssetFolder(string app, DomainId id, [FromBody] RenameAssetFolderDto request)
     {
@@ -125,7 +125,7 @@ public sealed class AssetFoldersController : ApiController
     [Route("apps/{app}/assets/folders/{id}/parent", Order = -1)]
     [ProducesResponseType(typeof(AssetFolderDto), StatusCodes.Status200OK)]
     [AssetRequestSizeLimit]
-    [ApiPermissionOrAnonymous(PermissionIds.AppAssetsUpdate)]
+    [ApiPermissionOrAnonymous(PermissionIds.AppAssetFoldersUpdate)]
     [ApiCosts(1)]
     public async Task<IActionResult> PutAssetFolderParent(string app, DomainId id, [FromBody] MoveAssetFolderDto request)
     {
@@ -146,7 +146,7 @@ public sealed class AssetFoldersController : ApiController
     [HttpDelete]
     [Route("apps/{app}/assets/folders/{id}/", Order = -1)]
     [ProducesResponseType(StatusCodes.Status204NoContent)]
-    [ApiPermissionOrAnonymous(PermissionIds.AppAssetsUpdate)]
+    [ApiPermissionOrAnonymous(PermissionIds.AppAssetFoldersDelete)]
     [ApiCosts(1)]
     public async Task<IActionResult> DeleteAssetFolder(string app, DomainId id)
     {