https://sonarly.com/issue/32509?type=bug
Navigation items nested inside folders in the sidebar bypass the `canReadObjectRecords` permission check, making restricted objects and views visible inside folders even when their role forbids reading them.
Fix: The fix addresses the missing `canReadObjectRecords` permission check for navigation items nested inside folders.
**What changed** in `WorkspaceSectionContainer.tsx`:
1. **Extracted `isObjectBackedItemAccessible` helper** — a reusable function that checks whether a navigation menu item should be visible based on object read permissions. It returns `true` for LINK and PAGE_LAYOUT items (always visible), checks `canReadObjectRecords` for OBJECT/VIEW/RECORD items, and returns `false` for unknown types. This eliminates duplication between root-level and folder-level filtering.
2. **Added `filteredFolderChildrenById`** — a new Map derived from `folderChildrenById` where each folder's children are filtered through `isObjectBackedItemAccessible`. This ensures folder children respect the same permission rules as root-level items.
3. **Updated folder visibility in `filteredItems`** — FOLDER items are now only included if they have at least one visible child in `filteredFolderChildrenById`. This hides empty folders that would otherwise appear when all their children are restricted.
4. **Read-only path uses filtered data** — The `WorkspaceSectionListReadOnly` component now receives `filteredFolderChildrenById` instead of `folderChildrenById`, so restricted users only see permitted items.
5. **Edit mode preserved** — The `LazyWorkspaceSectionListDndKit` and `WorkspaceSectionListEditModeFallback` components still receive the unfiltered `folderChildrenById`, so admins in layout customization mode can see and manage all items (with lock icons for restricted ones, as already implemented).
Sonarly Claude Code
1879110d78