The Delete node association(s) API
, which shows on the API explore *https://api-explorer.alfresco.com/api-explorer/#/nodes* requires either Admin or Site Manager role. We get the error “Access Denied. You do not have the appropriate permissions to perform this operation.”, when we try to delete it by all the other roles.
We supposed to be able to delete a peer association when the user has the delete access to the source node.
Steps to reproduce
1. Create a user with the collaborator role. *Note: You can set the other roles except for the site-manager role or admin.
2. Create and deploy a model with a folder type, which has a peer association like follows,
3. Create two folders for both the source and target in the document library, and change the folder type to the one created at step 2.
4. Make sure the user created at step 2 has the collaborator privileges on the folders you created at step 3.
5. Create an association on a target node by running the API with the user created at step 1.
6. Delete an association on a target node by running the API with the user created at step 1.
The delete request fails with the following response. Please refer the attached screenshot for further assistance.
The delete request should be succeeded by the user who has the delete privileges of the folders. We supposed to be able to delete a peer association when the user has the delete access to the source node.
public-services-security-context.xml shows as follows, which seems there are privileges to the removeAssociation
I tried to replace the above with this, but I got the same result.