How to make any dynamic child item to inherit the permissions from its parent item rather than the parent type via code?

In order to make child items inherit permissions from their parent item, this requires customization via the API. A code sample which can be used for a start can be found at Sitefinity Documentation, Modify permissions of dynamic content items using the Fluent API https://www.progress.com/documentation/sitefinity-cms/for-developers-modify-permissions-of-dynamic-content-items-using-the-fluent-api

It shows how to modify permissions of a dynamic content item upon creating it (the last sample in the page). Each child item inherits permissions from its parent item, i.e its permission inheritance is broken and modified to inherit from the parent item.

1. Paste following code in the "Global.asax.cs" file located in the root of the project. A couple of samples are available using either Native or Fluent API:

• Native API:

• using System;
  using Telerik.Sitefinity.Abstractions;
  using Telerik.Sitefinity.Data;
  using Telerik.Sitefinity.Data.Events;
  using Telerik.Sitefinity.DynamicModules.Model;
  using Telerik.Sitefinity.Security;
  using Telerik.Sitefinity.Security.Model;
  using Telerik.Sitefinity.Services;
  
  namespace SitefinityWebApp
  {
      public class Global : System.Web.HttpApplication
      {
          protected void Application_Start(object sender, EventArgs e)
          {
              Bootstrapper.Initialized += Bootstrapper_Initialized;
          }
  
          private void Bootstrapper_Initialized(object sender, ExecutedEventArgs e)
          {
              if (e.CommandName == "Bootstrapped")
              {
                  EventHub.Subscribe<IDataEvent>(evt => DataEventHandler(evt));
              }
          }
  
          public void DataEventHandler(IDataEvent eventInfo)
          {
              var action = eventInfo.Action;
              var contentType = eventInfo.ItemType;
              var itemId = eventInfo.ItemId;
              var providerName = eventInfo.ProviderName;
  
              if (contentType.FullName.Contains("Telerik.Sitefinity.DynamicTypes"))
              {
                  var manager = ManagerBase.GetMappedManager(contentType, providerName);
                  using (new ElevatedModeRegion(manager))
                  {
                      var item = manager.GetItemOrDefault(contentType, itemId);
                      if (action == "New" && item != null)
                      {
                          var childItem = item as DynamicContent;
                          var parentItem = childItem.SystemParentItem;
                          if (parentItem != null && childItem.InheritsPermissions == true)
                          {
                              childItem.InheritsPermissions = false;
                              manager.SaveChanges();
  
                              // clear child item's permissions
                              var ownPermissions = childItem.GetOwnPermissions();
                              foreach (var ownPermission in ownPermissions)
                              {
                                  childItem.Permissions.Remove(ownPermission);
                              }
                              var inheritedPermissions = childItem.GetActivePermissions();
                              foreach (var inheritedPermission in inheritedPermissions)
                              {
                                  childItem.Permissions.Remove(inheritedPermission);
                              }
  
                              // get parent item's permissions and assign them to the child item
                              var parentPermissions = parentItem.GetOwnPermissions();
                              if (parentPermissions != null)
                              {
                                  foreach (var parentPermission in parentPermissions)
                                  {
                                      var tempPermission = new Permission();
  
                                      tempPermission.Id = Guid.NewGuid();
                                      tempPermission.ObjectId = childItem.Id;
                                      tempPermission.Grant = parentPermission.Grant;
                                      tempPermission.Deny = parentPermission.Deny;
                                      tempPermission.ApplicationName = parentPermission.ApplicationName;
                                      tempPermission.PrincipalId = parentPermission.PrincipalId;
                                      tempPermission.SetName = parentPermission.SetName;
  
  
                                      childItem.Permissions.Add(tempPermission);
                                  }
                                  manager.SaveChanges();
                              }
                          }
                      }
                  }
              }
          }
      }
  }

• Fluent API

• using System;
  using System.Linq;
  using Telerik.Sitefinity.Abstractions;
  using Telerik.Sitefinity.Configuration;
  using Telerik.Sitefinity.Data;
  using Telerik.Sitefinity.DynamicModules;
  using Telerik.Sitefinity.DynamicModules.Events;
  using Telerik.Sitefinity.DynamicModules.Model;
  using Telerik.Sitefinity.Model;
  using Telerik.Sitefinity.Security;
  using Telerik.Sitefinity.Security.Claims;
  using Telerik.Sitefinity.Security.Configuration;
  using Telerik.Sitefinity.Security.Model;
  using Telerik.Sitefinity.Services;
  
  namespace SitefinityWebApp
  {
      public class Global : System.Web.HttpApplication
      {
  
          protected void Application_Start(object sender, EventArgs e)
          {
              Bootstrapper.Initialized += Bootstrapper_Initialized;
          }
  
          private void Bootstrapper_Initialized(object sender, ExecutedEventArgs e)
          {
              if (e.CommandName == "Bootstrapped")
              {
                  EventHub.Subscribe<IDynamicContentCreatingEvent>(DynamicContentCreatingEventHandler);
              }
          }
  
          private void DynamicContentCreatingEventHandler(IDynamicContentCreatingEvent eventInfo)
          {
              DynamicContent contentItem = eventInfo.Item;
              var parentItem = contentItem.SystemParentItem;
  
              Guid currentuserId = ClaimsManager.GetCurrentUserId();
  
              if (parentItem != null)
              {
                  foreach (var permission in parentItem.Permissions)
                  {
                      if (permission.IsGranted(SecurityConstants.Sets.General.Modify))
                      {
                          contentItem
                              .ManagePermissions()
                              .ForRole(permission.PrincipalId)
                              .Grant().View()
                              .Grant().Modify()
                              .Grant().Delete()
                              .Grant().ChangeOwner()
                              .Grant().ChangePermissions();
                      }
                  }
              }
          }
      }
  }

   
  • In the highlighted code above, reduce the permissions defined on the item as it best fits the needs (currently, it grants full permissions).
  • Note that the sample works for Built-in roles. For custom roles use RoleManager roleManager = RoleManager.GetManager();

2. Build the solution.

If permissions are needed to be given to the current user identity based on its permissions over the parent item use the following approach in the Global.asax.cs:

private void DynamicContentCreatingEventHandler(IDynamicContentCreatingEvent eventInfo)
{
    DynamicContent contentItem = eventInfo.Item;
    var parentItem = contentItem.SystemParentItem;

    Guid currentuserId = ClaimsManager.GetCurrentUserId();

    if (parentItem != null)
    {
        bool isGranted = this.CheckUserPermissionsForDynamicType(parentItem.GetType(), parentItem.Id, currentuserId);
        if (isGranted)
        {
            contentItem
                .ManagePermissions()
                .ForUser(currentuserId)
                .Grant().View()
                .Grant().Modify()
                .Grant().Delete();
        }
    }
}

private bool CheckUserPermissionsForDynamicType(Type parentType, Guid parentItemId, Guid currentuserId)
{
    DynamicModuleManager dynamicModuleManager = DynamicModuleManager.GetManager();
    var item = dynamicModuleManager.GetDataItem(parentType, parentItemId) as ISecuredObject;

    string permissionsSetName = "General";

    SecurityConfig secConfig = Config.Get<SecurityConfig>();

    // Get the permissions set
    Telerik.Sitefinity.Security.Configuration.Permission generalPermSet = secConfig.Permissions[permissionsSetName];

    // Get modify permission action mask
    int actionsMask = generalPermSet.Actions[SecurityConstants.Sets.General.Modify].Value;
    
    if (currentuserId == Guid.Empty)
    {
        throw new ArgumentException("User cannot be found.");
    }

    //Get manager for Built-in roles provider
    RoleManager roleManager = RoleManager.GetManager(SecurityConstants.ApplicationRolesProviderName);
    UserManager userManager = UserManager.GetManager();
    var user = userManager.GetUser(currentuserId);
    var rolesIds = roleManager.GetRolesForUser(user.Id).Select(r => r.Id).ToArray();
    
    bool isGranted = item.IsGranted(permissionsSetName, rolesIds, actionsMask);

    return isGranted;
}

References to Other Documentation:
Sitefinity Documentation, Modify permissions of dynamic content items using the Fluent API https://www.progress.com/documentation/sitefinity-cms/for-developers-modify-permissions-of-dynamic-content-items-using-the-fluent-api