Merge pull request #12027 from nocodb/nc-fix/api-v3-base

fix: define proper scope

packages/nocodb/src/controllers/v3/bases-v3.controller.ts

@@ -18,14 +18,19 @@ import { MetaApiLimiterGuard } from '~/guards/meta-api-limiter.guard';
 import { TenantContext } from '~/decorators/tenant-context.decorator';
 import { NcContext, NcRequest } from '~/interface/config';
 import { BasesV3Service } from '~/services/v3/bases-v3.service';
+import { isEE } from '~/utils';
+
+// decide scope based on whether it's EE or CE
+const BASE_SCOPE = isEE ? 'workspace' : 'org';
 
 @UseGuards(MetaApiLimiterGuard, GlobalGuard)
 @Controller()
 export class BasesV3Controller {
   constructor(protected readonly baseV3Service: BasesV3Service) {}
 
-  @Acl('baseList', {
-    scope: 'org',
+  // decide permission name based on whether it's EE or CE
+  @Acl(isEE ? 'workspaceBaseList' : 'baseList', {
+    scope: BASE_SCOPE,
   })
   @Get('/api/v3/meta/workspaces/:workspaceId/bases')
   async list(
@@ -91,7 +96,7 @@ export class BasesV3Controller {
   }
 
   @Acl('baseCreate', {
-    scope: 'org',
+    scope: BASE_SCOPE,
   })
   @HttpCode(200)
   @Post('/api/v3/meta/workspaces/:workspaceId/bases')

packages/nocodb/tests/unit/rest/tests/metaApiV3/error-handling/base.test.ts

@@ -62,9 +62,7 @@ export default function () {
         if (isEE) {
           expect(result.body.error).to.eq('FORBIDDEN');
           expect(
-            result.body.message.startsWith(
-              'Forbidden - You do not have permission to perform the action "baseCreate" ',
-            ),
+            result.body.message.startsWith('Forbidden - Unauthorized access'),
           ).to.eq(true);
         } else {
           expect(result.body.error).to.eq('PERMISSION_DENIED');