- Improved the Attribute Editor so that you can set a default value for newly added attributes whose field type contributes security grant rules (such as Asset, or Defined Value with the "Allow Adding New Values" option enabled).

Author: maxwelleley

Rock.JavaScript.Obsidian/Framework/Controls/fieldTypeEditor.obs

@@ -85,6 +85,15 @@
     const configurationValues = ref<Record<string, string>>(props.modelValue?.configurationValues ?? {});
     const editConfigurationValues = ref<Record<string, string>>({});
 
+    /**
+     * Security grant token minted by the server for the currently selected
+     * field type. Field types that implement ISecurityGrantFieldType (e.g.
+     * AssetFieldType) need their rules in the grant before the default value
+     * editor can talk to the corresponding API endpoints. Plumbed onto
+     * defaultValueAttribute so RockField provides it to its children.
+     */
+    const securityGrantToken = ref<string | null>(null);
+
     const fieldType = computed((): IFieldType | null => {
         if (!fieldTypeValueGuidOrEmptyString.value) {
             return null;
@@ -165,7 +174,8 @@
             description: "",
             isRequired: false,
             order: 0,
-            categories: []
+            categories: [],
+            securityGrantToken: securityGrantToken.value
         };
     });
 
@@ -210,6 +220,7 @@
         configurationProperties.value = {};
         configurationValues.value = {};
         defaultValue.value = "";
+        securityGrantToken.value = null;
         isInternalUpdate = false;
 
         updateModelValue();
@@ -245,6 +256,7 @@
                     editConfigurationValues.value = result.data.editConfigurationValues;
                     valueFormat.value = result.data.valueFormat ?? "";
                     defaultValue.value = result.data.defaultValue ?? "";
+                    securityGrantToken.value = result.data.securityGrantToken ?? null;
                     isInternalUpdate = false;
 
                     updateModelValue();

Rock.JavaScript.Obsidian/Framework/ViewModels/Controls/fieldTypeEditorUpdateAttributeConfigurationResultBag.d.ts

@@ -50,6 +50,17 @@ export type FieldTypeEditorUpdateAttributeConfigurationResultBag = {
      */
     editConfigurationValues?: Record<string, string> | null;
 
+    /**
+     * Gets or sets the security grant token that should be used by the
+     * default value editor for the selected field type. Field types that
+     * implement Rock.Field.ISecurityGrantFieldType contribute their rules
+     * into this token so that controls bound to the default value
+     * preview (e.g. the asset/file manager picker for an Asset field
+     * type) have the access they need before the attribute has been
+     * saved.
+     */
+    securityGrantToken?: string | null;
+
     /**
      * A string that describes the format of the raw value stored in the
      * database.

Rock.Rest/v2/ControlsController.cs

@@ -5777,13 +5777,36 @@ public IActionResult FieldTypeEditorUpdateAttributeConfiguration( [FromBody] Fie
                 valueFormat = hintFieldType.GetFieldHints( configurationValues )?.ValueFormat;
             }
 
+            // If the field type contributes security grant rules (e.g. an
+            // Asset field that needs the asset/file manager picker to work),
+            // mint an attribute-specific token here so the default value
+            // editor has the access it needs before the attribute has been
+            // saved. Mirrors the per-attribute grant generated in
+            // PublicAttributeHelper.GetPublicAttributeForEdit and lets
+            // RockField.obs pick it up via the attribute's securityGrantToken.
+            string securityGrantToken = null;
+
+            if ( fieldType is ISecurityGrantFieldType securityGrantFieldType )
+            {
+                var securityGrant = new SecurityGrant();
+
+                securityGrantFieldType.AddRulesToSecurityGrant( securityGrant, configurationValues );
+
+                if ( securityGrant.Rules.Count > 0 )
+                {
+                    securityGrant.SetLifetime( TimeSpan.FromDays( 1 ) );
+                    securityGrantToken = securityGrant.ToToken();
+                }
+            }
+
             return Ok( new FieldTypeEditorUpdateAttributeConfigurationResultBag
             {
                 ConfigurationProperties = configurationProperties,
                 AdminConfigurationValues = publicAdminConfigurationValues,
                 EditConfigurationValues = publicEditConfigurationValues,
                 ValueFormat = valueFormat,
-                DefaultValue = fieldType.GetPublicEditValue( privateDefaultValue, configurationValues )
+                DefaultValue = fieldType.GetPublicEditValue( privateDefaultValue, configurationValues ),
+                SecurityGrantToken = securityGrantToken
             } );
         }
 

Rock.ViewModels/Controls/FieldTypeEditorUpdateAttributeConfigurationResultBag.cs

@@ -67,5 +67,16 @@ public class FieldTypeEditorUpdateAttributeConfigurationResultBag
         /// </summary>
         /// <value>The default value information.</value>
         public string DefaultValue { get; set; }
+
+        /// <summary>
+        /// Gets or sets the security grant token that should be used by the
+        /// default value editor for the selected field type. Field types that
+        /// implement Rock.Field.ISecurityGrantFieldType contribute their rules
+        /// into this token so that controls bound to the default value
+        /// preview (e.g. the asset/file manager picker for an Asset field
+        /// type) have the access they need before the attribute has been
+        /// saved.
+        /// </summary>
+        public string SecurityGrantToken { get; set; }
     }
 }