A custom privilege matcher to match asset collections whose title starts with a given string. This can be used to conditionally show/hide asset collections in the Media module. Please keep in mind that this does not prevent anyone from knowing the location of a certain file to download it. There are other solutions to ensuring files are only ser…

AssetCollectionConditionGenerator.php

<?php

namespace Visol\FoobarCom\Security\Authorization\Privilege\Doctrine;

/*
 * This file is part of the Neos.Media package.
 *
 * (c) Contributors of the Neos Project - www.neos.io
 *
 * This package is Open Source Software. For the full copyright and license
 * information, please view the LICENSE file which was distributed with this
 * source code.
 */

use Neos\Flow\Security\Authorization\Privilege\Entity\Doctrine\ConditionGenerator as EntityConditionGenerator;
use Neos\Flow\Security\Authorization\Privilege\Entity\Doctrine\PropertyConditionGenerator;
use Neos\Flow\Security\Exception\InvalidPrivilegeException;
use Neos\Media\Domain\Model\AssetCollection;

/**
 * A SQL condition generator, supporting special SQL constraints for asset collections
 */
class AssetCollectionConditionGenerator extends \Neos\Media\Security\Authorization\Privilege\Doctrine\AssetCollectionConditionGenerator
{
    /**
     * @param string $collectionTitleStart
     * @return PropertyConditionGenerator
     */
    public function titleStartsWith($collectionTitleStart)
    {
        $propertyConditionGenerator = new PropertyConditionGenerator('title');

        return $propertyConditionGenerator->like($collectionTitleStart . '%');
    }
}

Policy.yaml

privilegeTargets:

  # Protected BoardMember documents
  'Visol\FoobarCom\Security\Authorization\Privilege\ReadAssetCollectionPrivilege':
    'Visol.FoobarCom:BoardArea->boardDocuments':
      matcher: 'titleStartsWith("Board_")'

ReadAssetCollectionPrivilege.php

<?php

namespace Visol\FoobarCom\Security\Authorization\Privilege;

/*
 * This file is part of the Neos.Media package.
 *
 * (c) Contributors of the Neos Project - www.neos.io
 *
 * This package is Open Source Software. For the full copyright and license
 * information, please view the LICENSE file which was distributed with this
 * source code.
 */

use Visol\FoobarCom\Security\Authorization\Privilege\Doctrine\AssetCollectionConditionGenerator;

/**
 * Privilege for restricting reading of AssetCollections
 *
 * Extended by a titleStartsWith condition
 */
class ReadAssetCollectionPrivilege extends \Neos\Media\Security\Authorization\Privilege\ReadAssetCollectionPrivilege
{
    /**
     * @return AssetCollectionConditionGenerator
     */
    protected function getConditionGenerator()
    {
        return new AssetCollectionConditionGenerator();
    }
}