Typo3 Neos: show different Menu items to loggedin users of different access levels

Question

I have created menus in Neos backend. Each menu node corresponds to a plugin of a controlleraction. These controller actions are defined in policy.yaml as resources with their flow access policy roles. The template for menu is defined in root.ts2 which i took a copy from Typo3.NeosDemoTypo3Org package.

mainMenu part of root.ts2 is

mainMenu = Menu {
entryLevel = 1
templatePath = 'resource://ABC.Demo/Private/Templates/TypoScriptObjects/MainMenu.html'
maximumLevels = 3
site = ${site}
}

MainMenu.html is:

<div class="collapse navbar-collapse navbar-main-collapse">
<ul class="nav nav-pills nav-justified">
<f:for each="{items}" as="item" iteration="menuItemIterator">
                    <f:then>
                            <li class="active">
                                <neos:link.node node="{item.node}">{item.label}</neos:link.node>
                            </li>
                        </f:then>
                        <f:else>
                            <li>
                                <neos:link.node node="{item.node}">{item.label}</neos:link.node>
                            </li>
                        </f:else>
                    </f:if>
                </f:for>
        </ul>
     </div>

If I use {parts.mainMenu -> f:format.raw()} in Default.html, it prints all the menu items defined at root of Neos site.

How can i show only those menu items in main menu of webpage for which the user has access to the corresponding resource defined in policy.yaml.

Can anybody give an idea, the way to achieve it.

Answer 1

You should set the access protection on the page node. Currently there no interface for this yet, but you can define access roles for the nodes in the database. See table: typo3_typo3cr_domain_model_nodedata field accessroles. It should be a serialized array of role names. This will then correctly reflect in the menu. And don't forget to set the TYPO3.Neos:Editor role as well otherwise editors won't be able to modify those pages.

It would be quite complicated to fetch the plugins from each page and do access checks against them but that could of course be another option. I cannot directly give you any hints for that thou, because the node type would be different for each page, depending on the plugin.