K3 plugin: not allowed to update page

I’m making a cart type plugin for Kirby 3. The plugin needs to periodically save/update some data based on user action. The directories used for this are unique per user session and are created under 'content/3_shop/orders/session_id' using a blueprint. I’m using the Kirby Page object to handle data in the file.

The problem is that only the first create operation succeeds and subsequent update operations all return a maddening 'You are not allowed to update "directory_name"'.

Adding update: true to the order blueprint makes no difference.

options:
  update: true

Here is the code the plugin is using

     if(empty($this->session->get('txn')){
 $this->txnId = $this->session->startTime() . $this->session->expiryTime();
  $timestamp = time();
    
    $page = new \Page([
        'dirname' => "3_shop/orders/$this->txnId",
        'slug' => $this->txnId,
        'template' => 'order',
        'content' => [
          'txn-id' => $this->txnId,
          'txn-date'  => date('m/d/Y H:i:s', $timestamp),
          'status' => 'pending',
          'session-start' => $timestamp,
          'session-end' => $timestamp,
          'products' => \Yaml::encode($items)
        ]
      ]);
    $page->save();
    $this->session->set('txn', "shop/orders/$this->txnId");

  }else{
    $this->site->page($this->session->get('txn'))->update(['products' => \Yaml::encode($items)]);
  }

Dumping the page permissions for inspection reveals Kirby seems to be ignoring the update: true option I set in the blueprint. Or my blueprint syntax is incorrect.

object(Kirby\Cms\PagePermissions)#367 (11) {
  ["changeSlug"]=>
  bool(false)
  ["changeStatus"]=>
  bool(false)
  ["changeTemplate"]=>
  bool(false)
  ["changeTitle"]=>
  bool(false)
  ["create"]=>
  bool(false)
  ["delete"]=>
  bool(false)
  ["duplicate"]=>
  bool(false)
  ["read"]=>
  bool(false)
  ["preview"]=>
  bool(false)
  ["sort"]=>
  bool(false)
  ["update"]=>
  bool(false)
}

I think that is because $page->save() as a low level action works without being authenticated, while $page->createChild() or $page->update() etc. need authentication or $kirby->impersonate().

https://getkirby.com/docs/guide/users/permissions#authenticate-or-impersonate

1 Like

thank you ! I was going crazy