Issue CollaboraOnline#27: Require Collabora access for entity operati…

…on links, in addition to media access.

In this commit, no existing constraints are removed.

collabora_online.module

@@ -9,10 +9,9 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/.
  */
 
-use Drupal\Core\Entity\EntityInterface;
+use Drupal\collabora_online\Access\CollaboraAccessCheck;
 use Drupal\collabora_online\Cool\CoolUtils;
-use Drupal\file\Entity\File;
-use Drupal\media\Entity\Media;
+use Drupal\Core\Entity\EntityInterface;
 
 /**
  * Implements hook_theme().
@@ -82,13 +81,20 @@ function collabora_online_entity_operation(EntityInterface $entity) {
         return [];
     }
 
+    /** @var \Drupal\media\MediaInterface $media */
     $media = $entity;
 
     $account = \Drupal::currentUser()->getAccount();
     if (!$entity->access("view", $account)) {
         return [];
     }
 
+    /** @var \Drupal\collabora_online\Access\CollaboraAccessCheck $access_checker */
+    $access_checker = \Drupal::service(CollaboraAccessCheck::class);
+    if (!$access_checker->mediaAccess($media, 'preview', $account)->isAllowed()) {
+        return [];
+    }
+
     $file = CoolUtils::getFile($media);
     $type = CoolUtils::getDocumentType($file);
 
@@ -104,7 +110,10 @@ function collabora_online_entity_operation(EntityInterface $entity) {
         ]
     ];
 
-    if (CoolUtils::canEdit($file) && $media->access("update", $account)) {
+    if (CoolUtils::canEdit($file)
+        && $media->access("update", $account)
+        && $access_checker->mediaAccess($media, 'edit', $account)
+    ) {
         $entries['collabora_online_edit'] = [
             'title' => t("Edit in Collabora Online"),
             'weight' => 50,