Merge branch '2026.1' into 2026.x

Author: lukmzig

src/Class/Service/SelectOptions/SelectOptionService.php

@@ -72,7 +72,7 @@ public function createSelectOption(CreateSelectOptionParameters $parameters): Se
     public function updateSelectOption(string $id, UpdateSelectOptionParameters $parameters): SelectOptionDetail
     {
         $config = $this->selectOptionRepository->getById($id);
-        $this->checkAdminAccess($config);
+        $this->validateAdminAccess($config);
 
         $this->validateSelectOptions($parameters->getSelectOptions());
 
@@ -100,7 +100,7 @@ public function updateSelectOption(string $id, UpdateSelectOptionParameters $par
     public function deleteSelectOption(string $id): void
     {
         $config = $this->selectOptionRepository->getById($id);
-        $this->checkAdminAccess($config);
+        $this->validateAdminAccess($config);
         $this->selectOptionRepository->delete($config);
     }
 
@@ -130,6 +130,9 @@ public function getSelectOptionUsages(string $id): array
     private function hydrateDetail(Config $config): SelectOptionDetail
     {
         $isWriteable = $this->selectOptionRepository->isWriteable($config);
+        if (!$this->hasAccess($config)) {
+            $isWriteable = false;
+        }
         $detail = $this->detailHydrator->hydrate($config, $isWriteable);
         $this->eventDispatcher->dispatch(new DetailEvent($detail), DetailEvent::EVENT_NAME);
 
@@ -160,10 +163,15 @@ private function validateSelectOptions(?array $selectOptions): void
     /**
      * @throws ForbiddenException
      */
-    private function checkAdminAccess(Config $config): void
+    private function validateAdminAccess(Config $config): void
     {
-        if ($config->getAdminOnly() && !$this->securityService->getCurrentUser()->isAdmin()) {
+        if ($this->hasAccess($config) === false) {
             throw new ForbiddenException('Restricted to admin users');
         }
     }
+
+    private function hasAccess(Config $config): bool
+    {
+        return !($config->getAdminOnly() && !$this->securityService->getCurrentUser()->isAdmin());
+    }
 }