Change permission for bulk endpoints.

backend/src/Squidex.Domain.Apps.Entities/Assets/DomainObject/AssetsBulkUpdateCommandMiddleware.cs

@@ -169,7 +169,7 @@ namespace Squidex.Domain.Apps.Entities.Assets.DomainObject
                     {
                         var command = new AnnotateAsset();
 
-                        Enrich(task, command, Permissions.AppAssetsUpdate);
+                        EnrichAndCheckPermission(task, command, Permissions.AppAssetsUpdate);
                         return command;
                     }
 
@@ -177,7 +177,7 @@ namespace Squidex.Domain.Apps.Entities.Assets.DomainObject
                     {
                         var command = new MoveAsset();
 
-                        Enrich(task, command, Permissions.AppAssetsUpdate);
+                        EnrichAndCheckPermission(task, command, Permissions.AppAssetsUpdate);
                         return command;
                     }
 
@@ -185,7 +185,7 @@ namespace Squidex.Domain.Apps.Entities.Assets.DomainObject
                     {
                         var command = new DeleteAsset();
 
-                        Enrich(task, command, Permissions.AppAssetsDelete);
+                        EnrichAndCheckPermission(task, command, Permissions.AppAssetsDelete);
                         return command;
                     }
 
@@ -194,7 +194,7 @@ namespace Squidex.Domain.Apps.Entities.Assets.DomainObject
             }
         }
 
-        private void Enrich<T>(BulkTask task, T command, string permissionId) where T : AssetCommand
+        private void EnrichAndCheckPermission<T>(BulkTask task, T command, string permissionId) where T : AssetCommand
         {
             SimpleMapper.Map(task.Command, command);
             SimpleMapper.Map(task.Job, command);

backend/src/Squidex.Domain.Apps.Entities/Contents/DomainObject/ContentsBulkUpdateCommandMiddleware.cs

@@ -198,7 +198,7 @@ namespace Squidex.Domain.Apps.Entities.Contents.DomainObject
                     {
                         var command = new CreateContent();
 
-                        await EnrichAsync(task, command, Permissions.AppContentsCreate);
+                        await EnrichAndCheckPermissionAsync(task, command, Permissions.AppContentsCreate);
                         return command;
                     }
 
@@ -206,7 +206,7 @@ namespace Squidex.Domain.Apps.Entities.Contents.DomainObject
                     {
                         var command = new UpdateContent();
 
-                        await EnrichAsync(task, command, Permissions.AppContentsUpdateOwn);
+                        await EnrichAndCheckPermissionAsync(task, command, Permissions.AppContentsUpdateOwn);
                         return command;
                     }
 
@@ -214,7 +214,7 @@ namespace Squidex.Domain.Apps.Entities.Contents.DomainObject
                     {
                         var command = new UpsertContent();
 
-                        await EnrichAsync(task, command, Permissions.AppContentsUpsert);
+                        await EnrichAndCheckPermissionAsync(task, command, Permissions.AppContentsUpsert);
                         return command;
                     }
 
@@ -222,7 +222,7 @@ namespace Squidex.Domain.Apps.Entities.Contents.DomainObject
                     {
                         var command = new PatchContent();
 
-                        await EnrichAsync(task, command, Permissions.AppContentsUpdateOwn);
+                        await EnrichAndCheckPermissionAsync(task, command, Permissions.AppContentsUpdateOwn);
                         return command;
                     }
 
@@ -230,7 +230,7 @@ namespace Squidex.Domain.Apps.Entities.Contents.DomainObject
                     {
                         var command = new ValidateContent();
 
-                        await EnrichAsync(task, command, Permissions.AppContentsReadOwn);
+                        await EnrichAndCheckPermissionAsync(task, command, Permissions.AppContentsReadOwn);
                         return command;
                     }
 
@@ -238,7 +238,7 @@ namespace Squidex.Domain.Apps.Entities.Contents.DomainObject
                     {
                         var command = new ChangeContentStatus { Status = job.Status ?? Status.Draft };
 
-                        await EnrichAsync(task, command, Permissions.AppContentsChangeStatusOwn);
+                        await EnrichAndCheckPermissionAsync(task, command, Permissions.AppContentsChangeStatusOwn);
                         return command;
                     }
 
@@ -246,7 +246,7 @@ namespace Squidex.Domain.Apps.Entities.Contents.DomainObject
                     {
                         var command = new DeleteContent();
 
-                        await EnrichAsync(task, command, Permissions.AppContentsDeleteOwn);
+                        await EnrichAndCheckPermissionAsync(task, command, Permissions.AppContentsDeleteOwn);
                         return command;
                     }
 
@@ -255,7 +255,7 @@ namespace Squidex.Domain.Apps.Entities.Contents.DomainObject
             }
         }
 
-        private async Task EnrichAsync<T>(BulkTask task, T command, string permissionId) where T : ContentCommand
+        private async Task EnrichAndCheckPermissionAsync<T>(BulkTask task, T command, string permissionId) where T : ContentCommand
         {
             SimpleMapper.Map(task.Command, command);
             SimpleMapper.Map(task.Job, command);

backend/src/Squidex/Areas/Api/Controllers/Assets/AssetsController.cs

@@ -220,7 +220,7 @@ namespace Squidex.Areas.Api.Controllers.Assets
         [HttpPost]
         [Route("apps/{app}/assets/bulk")]
         [ProducesResponseType(typeof(BulkResultDto[]), StatusCodes.Status200OK)]
-        [ApiPermissionOrAnonymous(Permissions.AppAssets)]
+        [ApiPermissionOrAnonymous(Permissions.AppAssetsRead)]
         [ApiCosts(5)]
         public async Task<IActionResult> BulkUpdateAssets(string app, [FromBody] BulkUpdateAssetsDto request)
         {

backend/src/Squidex/Areas/Api/Controllers/Contents/ContentsController.cs

@@ -416,7 +416,7 @@ namespace Squidex.Areas.Api.Controllers.Contents
         [HttpPost]
         [Route("content/{app}/{name}/bulk")]
         [ProducesResponseType(typeof(BulkResultDto[]), StatusCodes.Status200OK)]
-        [ApiPermissionOrAnonymous(Permissions.AppContents)]
+        [ApiPermissionOrAnonymous(Permissions.AppContentsReadOwn)]
         [ApiCosts(5)]
         public async Task<IActionResult> BulkUpdateContents(string app, string name, [FromBody] BulkUpdateContentsDto request)
         {