From 86b47700e32dcca4c05ff8aa11b50860bec7295b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miko=C5=82aj=20Adamczyk?= <mikadamczyk@gmail.com>
Date: Fri, 2 Nov 2018 11:26:59 +0100
Subject: [PATCH 1/5] EZP-29742: Implement permissions for Content/Create in
 Content item view

---
 src/bundle/Controller/DashboardController.php |  17 ++-
 src/bundle/Controller/SectionController.php   |   8 +-
 src/bundle/Resources/config/services.yml      |  29 ++++-
 .../Resources/config/services/utils.yml       |   3 +
 src/bundle/Resources/public/scss/_forms.scss  |   1 +
 .../content/widgets/content_create.html.twig  |  14 +-
 .../views/dashboard/dashboard.html.twig       |   7 +-
 .../Provider/ChoiceListProviderInterface.php  |  12 ++
 .../ContentTypeChoiceListProvider.php         |  39 ++++++
 .../Provider/LanguageChoiceListProvider.php   |  56 ++++++++
 ...sionAwareContentTypeChoiceListProvider.php |  80 ++++++++++++
 ...missionAwareLanguageChoiceListProvider.php |  77 +++++++++++
 .../Type/Content/Draft/ContentCreateType.php  |  25 +++-
 .../ContentType/ContentTypeChoiceType.php     |  26 ++--
 .../Form/Type/Language/LanguageChoiceType.php |  39 +-----
 src/lib/Menu/ContentRightSidebarBuilder.php   |  16 ++-
 .../Event/Subscriber/ContentCreate.php        | 121 ++++++++++++++++++
 .../Event/Subscriber/SectionAssign.php        |   8 +-
 src/lib/Util/PermissionUtil.php               | 113 +++++++++++++++-
 src/lib/Util/PermissionUtilInterface.php      |  38 ++++++
 20 files changed, 649 insertions(+), 80 deletions(-)
 create mode 100644 src/lib/Form/Type/ChoiceList/Provider/ChoiceListProviderInterface.php
 create mode 100644 src/lib/Form/Type/ChoiceList/Provider/ContentTypeChoiceListProvider.php
 create mode 100644 src/lib/Form/Type/ChoiceList/Provider/LanguageChoiceListProvider.php
 create mode 100644 src/lib/Form/Type/ChoiceList/Provider/PermissionAwareContentTypeChoiceListProvider.php
 create mode 100644 src/lib/Form/Type/ChoiceList/Provider/PermissionAwareLanguageChoiceListProvider.php
 create mode 100644 src/lib/UniversalDiscovery/Event/Subscriber/ContentCreate.php
 create mode 100644 src/lib/Util/PermissionUtilInterface.php

diff --git a/src/bundle/Controller/DashboardController.php b/src/bundle/Controller/DashboardController.php
index 4e422b14f7..092a7d1a5b 100644
--- a/src/bundle/Controller/DashboardController.php
+++ b/src/bundle/Controller/DashboardController.php
@@ -11,25 +11,34 @@
 use EzSystems\EzPlatformAdminUi\Form\Data\Content\Draft\ContentEditData;
 use EzSystems\EzPlatformAdminUi\Form\Factory\FormFactory;
 use eZ\Publish\API\Repository\PermissionResolver;
+use Symfony\Component\HttpFoundation\Response;
 
 class DashboardController extends Controller
 {
+    /** @var \EzSystems\EzPlatformAdminUi\Form\Factory\FormFactory */
     protected $formFactory;
 
     /** @var \eZ\Publish\API\Repository\PermissionResolver */
     private $permissionResolver;
 
     /**
-     * @param \EzSystems\EzplatformAdminUi\Form\Factory\FormFactory $formFactory
+     * @param \EzSystems\EzPlatformAdminUi\Form\Factory\FormFactory $formFactory
      * @param \eZ\Publish\API\Repository\PermissionResolver $permissionResolver
      */
-    public function __construct(FormFactory $formFactory, PermissionResolver $permissionResolver)
-    {
+    public function __construct(
+        FormFactory $formFactory,
+        PermissionResolver $permissionResolver
+    ) {
         $this->formFactory = $formFactory;
         $this->permissionResolver = $permissionResolver;
     }
 
-    public function dashboardAction()
+    /**
+     * @return \Symfony\Component\HttpFoundation\Response
+     *
+     * @throws \eZ\Publish\API\Repository\Exceptions\InvalidArgumentException
+     */
+    public function dashboardAction(): Response
     {
         $editForm = $this->formFactory->contentEdit(
             new ContentEditData()
diff --git a/src/bundle/Controller/SectionController.php b/src/bundle/Controller/SectionController.php
index 05ce572d7a..7086c685f3 100644
--- a/src/bundle/Controller/SectionController.php
+++ b/src/bundle/Controller/SectionController.php
@@ -31,7 +31,7 @@
 use EzSystems\EzPlatformAdminUi\Form\SubmitHandler;
 use EzSystems\EzPlatformAdminUi\Notification\NotificationHandlerInterface;
 use EzSystems\EzPlatformAdminUi\UI\Service\PathService;
-use EzSystems\EzPlatformAdminUi\Util\PermissionUtil;
+use EzSystems\EzPlatformAdminUi\Util\PermissionUtilInterface;
 use EzSystems\EzPlatformAdminUiBundle\View\EzPagerfantaView;
 use EzSystems\EzPlatformAdminUiBundle\View\Template\EzPagerfantaTemplate;
 use Pagerfanta\Adapter\ArrayAdapter;
@@ -80,7 +80,7 @@ class SectionController extends Controller
     /** @var \eZ\Publish\API\Repository\PermissionResolver */
     private $permissionResolver;
 
-    /** @var \EzSystems\EzPlatformAdminUi\Util\PermissionUtil */
+    /** @var \EzSystems\EzPlatformAdminUi\Util\PermissionUtilInterface */
     private $permissionUtil;
 
     /** @var int */
@@ -99,7 +99,7 @@ class SectionController extends Controller
      * @param \eZ\Publish\API\Repository\LocationService $locationService
      * @param \EzSystems\EzPlatformAdminUi\UI\Service\PathService $pathService
      * @param \eZ\Publish\API\Repository\PermissionResolver $permissionResolver
-     * @param \EzSystems\EzPlatformAdminUi\Util\PermissionUtil $permissionUtil
+     * @param \EzSystems\EzPlatformAdminUi\Util\PermissionUtilInterface $permissionUtil
      * @param int $defaultPaginationLimit
      */
     public function __construct(
@@ -115,7 +115,7 @@ public function __construct(
         LocationService $locationService,
         PathService $pathService,
         PermissionResolver $permissionResolver,
-        PermissionUtil $permissionUtil,
+        PermissionUtilInterface $permissionUtil,
         int $defaultPaginationLimit
     ) {
         $this->notificationHandler = $notificationHandler;
diff --git a/src/bundle/Resources/config/services.yml b/src/bundle/Resources/config/services.yml
index bde429a9ad..e698ed2c5e 100644
--- a/src/bundle/Resources/config/services.yml
+++ b/src/bundle/Resources/config/services.yml
@@ -84,14 +84,15 @@ services:
     EzSystems\EzPlatformAdminUi\Form\DataMapper\:
         resource: '../../../lib/Form/DataMapper'
 
-    EzSystems\EzPlatformAdminUi\Form\Type\Language\LanguageChoiceType:
-        arguments:
-            $siteAccessLanguages: '$languages$'
-
     EzSystems\EzPlatformAdminUi\Form\Type\Policy\PolicyChoiceType:
         arguments:
             $policyMap: "%ezpublish.api.role.policy_map%"
 
+    EzSystems\EzPlatformAdminUi\Form\Type\Content\Draft\ContentCreateType:
+        arguments:
+            $choiceListProvider: '@EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\PermissionAwareContentTypeChoiceListProvider'
+            $languageChoiceListProvider: '@EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\PermissionAwareLanguageChoiceListProvider'
+
     EzSystems\EzPlatformAdminUi\UI\Dataset\DatasetFactory:
         arguments:
             $userContentTypeIdentifier: '$user_content_type_identifier$'
@@ -151,3 +152,23 @@ services:
             - {name: kernel.event_subscriber, priority: -250}
 
     EzSystems\EzPlatformAdminUiBundle\Templating\Twig\UserPreferencesGlobalExtension: ~
+
+    EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\ContentTypeChoiceListProvider: ~
+
+    EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\LanguageChoiceListProvider:
+        arguments:
+            $siteAccessLanguages: '$languages$'
+
+    EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\PermissionAwareContentTypeChoiceListProvider:
+        arguments:
+            $decorated: '@EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\ContentTypeChoiceListProvider'
+            $module: 'content'
+            $function: 'create'
+
+    EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\PermissionAwareLanguageChoiceListProvider:
+        arguments:
+            $decorated: '@EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\LanguageChoiceListProvider'
+            $module: 'content'
+            $function: 'create'
+
+
diff --git a/src/bundle/Resources/config/services/utils.yml b/src/bundle/Resources/config/services/utils.yml
index 0b2accacf1..02bddb8e3a 100644
--- a/src/bundle/Resources/config/services/utils.yml
+++ b/src/bundle/Resources/config/services/utils.yml
@@ -6,3 +6,6 @@ services:
 
     EzSystems\EzPlatformAdminUi\Util\:
         resource: "../../../lib/Util"
+
+    EzSystems\EzPlatformAdminUi\Util\PermissionUtilInterface:
+        alias: EzSystems\EzPlatformAdminUi\Util\PermissionUtil
diff --git a/src/bundle/Resources/public/scss/_forms.scss b/src/bundle/Resources/public/scss/_forms.scss
index 0ceb928a9e..7b5bd9818d 100644
--- a/src/bundle/Resources/public/scss/_forms.scss
+++ b/src/bundle/Resources/public/scss/_forms.scss
@@ -31,6 +31,7 @@ form:not(.form-inline) {
 
     .form-control[readonly] {
         background-color: $ez-white;
+        pointer-events: none;
     }
 
     .form-control:focus {
diff --git a/src/bundle/Resources/views/content/widgets/content_create.html.twig b/src/bundle/Resources/views/content/widgets/content_create.html.twig
index caa1c80f7f..adc1cb1ed8 100644
--- a/src/bundle/Resources/views/content/widgets/content_create.html.twig
+++ b/src/bundle/Resources/views/content/widgets/content_create.html.twig
@@ -4,14 +4,14 @@
     <div class="ez-extra-actions__header">{{ 'content.create.choose_content_type'|trans|desc('Create your content') }}</div>
     <div class="ez-extra-actions__content">
         {{ form_start(form, { 'action': path('ezplatform.content.create'), 'attr': { 'autocomplete': 'off' } }) }}
-            {% if form.language.vars.choices|length == 1 %}
-                {{ form_widget(form.language, {'attr': {'hidden': true}}) }}
-            {% else %}
-                <div class="ez-extra-actions__section-header">{{ 'content.create.select_language'|trans|desc('Select language') }}</div>
-                <div class="ez-extra-actions__section-content">
+            <div class="ez-extra-actions__section-header">{{ 'content.create.select_language'|trans|desc('Select language') }}</div>
+            <div class="ez-extra-actions__section-content">
+                {% if form.language.vars.choices|length == 1 %}
+                    {{ form_widget(form.language, {'attr': {'readonly': true}}) }}
+                {% else %}
                     {{ form_widget(form.language) }}
-                </div>
-            {% endif %}
+                {% endif %}
+            </div>
             <div class="ez-extra-actions__section-header">{{ 'content.create.select_content_type'|trans|desc('Select Content Type') }}</div>
             <div class="ez-extra-actions__section-content ez-extra-actions__section-content--content-type">
                 <div class="ez-instant-filter">
diff --git a/src/bundle/Resources/views/dashboard/dashboard.html.twig b/src/bundle/Resources/views/dashboard/dashboard.html.twig
index e8f6ce0861..210caddf25 100644
--- a/src/bundle/Resources/views/dashboard/dashboard.html.twig
+++ b/src/bundle/Resources/views/dashboard/dashboard.html.twig
@@ -12,8 +12,11 @@
                 <div class="container ez-dashboard__header">
                     <h1 class="py-3">{{ 'my.dashboard'|trans|desc('My dashboard') }}</h1>
                     <div class="ez-dashboard__create">
-                        <button type="button" class="btn btn-primary ez-btn--cotf-create" data-udw-config="{{ ez_udw_config('create', {}) }}" {% if not can_create_content %}disabled{% endif %}>
-                            <svg class="ez-icon ez-icon--medium ez-icon--light">
+                        <button
+                            class="btn btn-primary ez-btn--cotf-create"
+                            data-udw-config="{{ ez_udw_config('create', {'type': 'content_create'}) }}"
+                            {% if not can_create_content %}disabled{% endif %}>
+                            <svg class="ez-icon ez-icon--medium ez-icon--light ez-icon-create">
                                 <use xlink:href="{{ asset('bundles/ezplatformadminui/img/ez-icons.svg') }}#create"></use>
                             </svg>
                             <span>{{ 'dashboard.create'|trans|desc('Create') }}</span>
diff --git a/src/lib/Form/Type/ChoiceList/Provider/ChoiceListProviderInterface.php b/src/lib/Form/Type/ChoiceList/Provider/ChoiceListProviderInterface.php
new file mode 100644
index 0000000000..988074d116
--- /dev/null
+++ b/src/lib/Form/Type/ChoiceList/Provider/ChoiceListProviderInterface.php
@@ -0,0 +1,12 @@
+<?php
+
+/**
+ * @copyright Copyright (C) eZ Systems AS. All rights reserved.
+ * @license For full copyright and license information view LICENSE file distributed with this source code.
+ */
+namespace EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider;
+
+interface ChoiceListProviderInterface
+{
+    public function getChoiceList(): array;
+}
diff --git a/src/lib/Form/Type/ChoiceList/Provider/ContentTypeChoiceListProvider.php b/src/lib/Form/Type/ChoiceList/Provider/ContentTypeChoiceListProvider.php
new file mode 100644
index 0000000000..c2cf3c0446
--- /dev/null
+++ b/src/lib/Form/Type/ChoiceList/Provider/ContentTypeChoiceListProvider.php
@@ -0,0 +1,39 @@
+<?php
+
+/**
+ * @copyright Copyright (C) eZ Systems AS. All rights reserved.
+ * @license For full copyright and license information view LICENSE file distributed with this source code.
+ */
+declare(strict_types=1);
+
+namespace EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider;
+
+use eZ\Publish\API\Repository\ContentTypeService;
+
+class ContentTypeChoiceListProvider implements ChoiceListProviderInterface
+{
+    /** @var \eZ\Publish\API\Repository\ContentTypeService */
+    protected $contentTypeService;
+
+    /**
+     * @param \eZ\Publish\API\Repository\ContentTypeService $contentTypeService
+     */
+    public function __construct(ContentTypeService $contentTypeService)
+    {
+        $this->contentTypeService = $contentTypeService;
+    }
+
+    /**
+     * @return array
+     */
+    public function getChoiceList(): array
+    {
+        $contentTypes = [];
+        $contentTypeGroups = $this->contentTypeService->loadContentTypeGroups();
+        foreach ($contentTypeGroups as $contentTypeGroup) {
+            $contentTypes[$contentTypeGroup->identifier] = $this->contentTypeService->loadContentTypes($contentTypeGroup);
+        }
+
+        return $contentTypes;
+    }
+}
diff --git a/src/lib/Form/Type/ChoiceList/Provider/LanguageChoiceListProvider.php b/src/lib/Form/Type/ChoiceList/Provider/LanguageChoiceListProvider.php
new file mode 100644
index 0000000000..b3a8c44cf3
--- /dev/null
+++ b/src/lib/Form/Type/ChoiceList/Provider/LanguageChoiceListProvider.php
@@ -0,0 +1,56 @@
+<?php
+
+/**
+ * @copyright Copyright (C) eZ Systems AS. All rights reserved.
+ * @license For full copyright and license information view LICENSE file distributed with this source code.
+ */
+declare(strict_types=1);
+
+namespace EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider;
+
+use eZ\Publish\API\Repository\LanguageService;
+
+class LanguageChoiceListProvider implements ChoiceListProviderInterface
+{
+    /** @var \eZ\Publish\API\Repository\LanguageService */
+    protected $languageService;
+
+    /** @var array */
+    protected $siteAccessLanguages;
+
+    /**
+     * @param \eZ\Publish\API\Repository\LanguageService $languageService
+     * @param array $siteAccessLanguages
+     */
+    public function __construct(LanguageService $languageService, array $siteAccessLanguages)
+    {
+        $this->languageService = $languageService;
+        $this->siteAccessLanguages = $siteAccessLanguages;
+    }
+
+    /**
+     * @return array
+     */
+    public function getChoiceList(): array
+    {
+        $saLanguages = [];
+        $languagesByCode = [];
+
+        foreach ($this->languageService->loadLanguages() as $language) {
+            if ($language->enabled) {
+                $languagesByCode[$language->languageCode] = $language;
+            }
+        }
+
+        foreach ($this->siteAccessLanguages as $languageCode) {
+            if (!isset($languagesByCode[$languageCode])) {
+                continue;
+            }
+
+            $saLanguages[] = $languagesByCode[$languageCode];
+            unset($languagesByCode[$languageCode]);
+        }
+
+        return array_merge($saLanguages, array_values($languagesByCode));
+    }
+}
diff --git a/src/lib/Form/Type/ChoiceList/Provider/PermissionAwareContentTypeChoiceListProvider.php b/src/lib/Form/Type/ChoiceList/Provider/PermissionAwareContentTypeChoiceListProvider.php
new file mode 100644
index 0000000000..c285bbacd9
--- /dev/null
+++ b/src/lib/Form/Type/ChoiceList/Provider/PermissionAwareContentTypeChoiceListProvider.php
@@ -0,0 +1,80 @@
+<?php
+
+/**
+ * @copyright Copyright (C) eZ Systems AS. All rights reserved.
+ * @license For full copyright and license information view LICENSE file distributed with this source code.
+ */
+declare(strict_types=1);
+
+namespace EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider;
+
+use eZ\Publish\API\Repository\PermissionResolver;
+use eZ\Publish\API\Repository\Values\User\Limitation\ContentTypeLimitation;
+use EzSystems\EzPlatformAdminUi\Util\PermissionUtilInterface;
+use eZ\Publish\API\Repository\Values\ContentType\ContentType;
+
+class PermissionAwareContentTypeChoiceListProvider implements ChoiceListProviderInterface
+{
+    /** @var \EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\ChoiceListProviderInterface */
+    private $decorated;
+
+    /** @var \eZ\Publish\API\Repository\PermissionResolver */
+    private $permissionResolver;
+
+    /** @var \EzSystems\EzPlatformAdminUi\Util\PermissionUtilInterface */
+    private $permissionUtil;
+
+    /** @var string */
+    private $module;
+
+    /** @var string */
+    private $function;
+
+    /**
+     * @param \eZ\Publish\API\Repository\PermissionResolver $permissionResolver
+     * @param \EzSystems\EzPlatformAdminUi\Util\PermissionUtilInterface $permissionUtil
+     * @param \EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\ContentTypeChoiceListProvider $decorated
+     * @param string $module
+     * @param string $function
+     */
+    public function __construct(
+        PermissionResolver $permissionResolver,
+        PermissionUtilInterface $permissionUtil,
+        ContentTypeChoiceListProvider $decorated,
+        string $module,
+        string $function
+    ) {
+        $this->decorated = $decorated;
+        $this->permissionResolver = $permissionResolver;
+        $this->permissionUtil = $permissionUtil;
+        $this->module = $module;
+        $this->function = $function;
+    }
+
+    /**
+     * @return array
+     *
+     * @throws \eZ\Publish\API\Repository\Exceptions\InvalidArgumentException
+     */
+    public function getChoiceList(): array
+    {
+        $hasAccess = $this->permissionResolver->hasAccess($this->module, $this->function);
+        if (!is_bool($hasAccess)) {
+            $restrictedContentTypesIds = $this->permissionUtil->getRestrictions($hasAccess, ContentTypeLimitation::class);
+        }
+
+        $contentTypesGroups = $this->decorated->getChoiceList();
+
+        if (empty($restrictedContentTypesIds)) {
+            return $contentTypesGroups;
+        }
+
+        foreach ($contentTypesGroups as $group => $contentTypes) {
+            $contentTypesGroups[$group] = array_filter($contentTypes, function (ContentType $contentType) use ($restrictedContentTypesIds) {
+                return in_array($contentType->id, $restrictedContentTypesIds);
+            });
+        }
+
+        return $contentTypesGroups;
+    }
+}
diff --git a/src/lib/Form/Type/ChoiceList/Provider/PermissionAwareLanguageChoiceListProvider.php b/src/lib/Form/Type/ChoiceList/Provider/PermissionAwareLanguageChoiceListProvider.php
new file mode 100644
index 0000000000..4e34ddb810
--- /dev/null
+++ b/src/lib/Form/Type/ChoiceList/Provider/PermissionAwareLanguageChoiceListProvider.php
@@ -0,0 +1,77 @@
+<?php
+
+/**
+ * @copyright Copyright (C) eZ Systems AS. All rights reserved.
+ * @license For full copyright and license information view LICENSE file distributed with this source code.
+ */
+declare(strict_types=1);
+
+namespace EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider;
+
+use eZ\Publish\API\Repository\PermissionResolver;
+use eZ\Publish\API\Repository\Values\User\Limitation\LanguageLimitation;
+use EzSystems\EzPlatformAdminUi\Util\PermissionUtilInterface;
+use eZ\Publish\API\Repository\Values\Content\Language;
+
+class PermissionAwareLanguageChoiceListProvider implements ChoiceListProviderInterface
+{
+    /** @var \EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\ChoiceListProviderInterface */
+    private $decorated;
+
+    /** @var \eZ\Publish\API\Repository\PermissionResolver */
+    private $permissionResolver;
+
+    /** @var \EzSystems\EzPlatformAdminUi\Util\PermissionUtilInterface */
+    private $permissionUtil;
+
+    /** @var string */
+    private $module;
+
+    /** @var string */
+    private $function;
+
+    /**
+     * @param \eZ\Publish\API\Repository\PermissionResolver $permissionResolver
+     * @param \EzSystems\EzPlatformAdminUi\Util\PermissionUtilInterface $permissionUtil
+     * @param \EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\LanguageChoiceListProvider $decorated
+     * @param string $module
+     * @param string $function
+     */
+    public function __construct(
+        PermissionResolver $permissionResolver,
+        PermissionUtilInterface $permissionUtil,
+        LanguageChoiceListProvider $decorated,
+        string $module,
+        string $function
+    ) {
+        $this->decorated = $decorated;
+        $this->permissionResolver = $permissionResolver;
+        $this->permissionUtil = $permissionUtil;
+        $this->module = $module;
+        $this->function = $function;
+    }
+
+    /**
+     * @return array
+     *
+     * @throws \eZ\Publish\API\Repository\Exceptions\InvalidArgumentException
+     */
+    public function getChoiceList(): array
+    {
+        $restrictedLanguagesCodes = [];
+        $hasAccess = $this->permissionResolver->hasAccess($this->module, $this->function);
+        if (!is_bool($hasAccess)) {
+            $restrictedLanguagesCodes = $this->permissionUtil->getRestrictions($hasAccess, LanguageLimitation::class);
+        }
+
+        $languages = $this->decorated->getChoiceList();
+
+        if (empty($restrictedLanguagesCodes)) {
+            return $languages;
+        }
+
+        return array_filter($languages, function (Language $language) use ($restrictedLanguagesCodes) {
+            return in_array($language->languageCode, $restrictedLanguagesCodes, true);
+        });
+    }
+}
diff --git a/src/lib/Form/Type/Content/Draft/ContentCreateType.php b/src/lib/Form/Type/Content/Draft/ContentCreateType.php
index 634414ec7a..721c1b86ff 100644
--- a/src/lib/Form/Type/Content/Draft/ContentCreateType.php
+++ b/src/lib/Form/Type/Content/Draft/ContentCreateType.php
@@ -10,25 +10,40 @@
 
 use eZ\Publish\API\Repository\LanguageService;
 use EzSystems\EzPlatformAdminUi\Form\Data\Content\Draft\ContentCreateData;
+use EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\ChoiceListProviderInterface;
 use EzSystems\EzPlatformAdminUi\Form\Type\Content\LocationType;
 use EzSystems\EzPlatformAdminUi\Form\Type\ContentType\ContentTypeChoiceType;
 use EzSystems\EzPlatformAdminUi\Form\Type\Language\LanguageChoiceType;
 use Symfony\Component\Form\AbstractType;
+use Symfony\Component\Form\ChoiceList\Loader\CallbackChoiceLoader;
 use Symfony\Component\Form\Extension\Core\Type\SubmitType;
 use Symfony\Component\Form\FormBuilderInterface;
 use Symfony\Component\OptionsResolver\OptionsResolver;
 
 class ContentCreateType extends AbstractType
 {
-    /** @var LanguageService */
+    /** @var \eZ\Publish\API\Repository\LanguageService */
     protected $languageService;
 
+    /** @var \EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\ChoiceListProviderInterface */
+    private $choiceListProvider;
+
+    /** @var \EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\ChoiceListProviderInterface */
+    private $languageChoiceListProvider;
+
     /**
-     * @param LanguageService $languageService
+     * @param \eZ\Publish\API\Repository\LanguageService $languageService
+     * @param \EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\ChoiceListProviderInterface $choiceListProvider
+     * @param \EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\ChoiceListProviderInterface $languageChoiceListProvider
      */
-    public function __construct(LanguageService $languageService)
-    {
+    public function __construct(
+        LanguageService $languageService,
+        ChoiceListProviderInterface $choiceListProvider,
+        ChoiceListProviderInterface $languageChoiceListProvider
+    ) {
         $this->languageService = $languageService;
+        $this->choiceListProvider = $choiceListProvider;
+        $this->languageChoiceListProvider = $languageChoiceListProvider;
     }
 
     public function buildForm(FormBuilderInterface $builder, array $options)
@@ -41,6 +56,7 @@ public function buildForm(FormBuilderInterface $builder, array $options)
                     'label' => false,
                     'multiple' => false,
                     'expanded' => true,
+                    'choice_loader' => new CallbackChoiceLoader([$this->choiceListProvider, 'getChoiceList']),
                 ]
             )
             ->add(
@@ -55,6 +71,7 @@ public function buildForm(FormBuilderInterface $builder, array $options)
                     'label' => false,
                     'multiple' => false,
                     'expanded' => false,
+                    'choice_loader' => new CallbackChoiceLoader([$this->languageChoiceListProvider, 'getChoiceList']),
                 ]
             )
             ->add(
diff --git a/src/lib/Form/Type/ContentType/ContentTypeChoiceType.php b/src/lib/Form/Type/ContentType/ContentTypeChoiceType.php
index 610d3bda7a..7703127234 100644
--- a/src/lib/Form/Type/ContentType/ContentTypeChoiceType.php
+++ b/src/lib/Form/Type/ContentType/ContentTypeChoiceType.php
@@ -9,6 +9,7 @@
 namespace EzSystems\EzPlatformAdminUi\Form\Type\ContentType;
 
 use eZ\Publish\API\Repository\ContentTypeService;
+use EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\ContentTypeChoiceListProvider;
 use Symfony\Component\Form\AbstractType;
 use Symfony\Component\Form\ChoiceList\Loader\CallbackChoiceLoader;
 use Symfony\Component\Form\Extension\Core\Type\ChoiceType;
@@ -19,15 +20,22 @@
  */
 class ContentTypeChoiceType extends AbstractType
 {
-    /** @var ContentTypeService */
+    /** @var \eZ\Publish\API\Repository\ContentTypeService */
     protected $contentTypeService;
 
+    /** @var \EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\ContentTypeChoiceListProvider */
+    private $contentTypeChoiceListProvider;
+
     /**
-     * @param ContentTypeService $contentTypeService
+     * @param \eZ\Publish\API\Repository\ContentTypeService $contentTypeService
+     * @param \EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\ContentTypeChoiceListProvider $contentTypeChoiceListProvider
      */
-    public function __construct(ContentTypeService $contentTypeService)
-    {
+    public function __construct(
+        ContentTypeService $contentTypeService,
+        ContentTypeChoiceListProvider $contentTypeChoiceListProvider
+    ) {
         $this->contentTypeService = $contentTypeService;
+        $this->contentTypeChoiceListProvider = $contentTypeChoiceListProvider;
     }
 
     public function getParent()
@@ -39,15 +47,7 @@ public function configureOptions(OptionsResolver $resolver)
     {
         $resolver
             ->setDefaults([
-                'choice_loader' => new CallbackChoiceLoader(function () {
-                    $contentTypes = [];
-                    $contentTypeGroups = $this->contentTypeService->loadContentTypeGroups();
-                    foreach ($contentTypeGroups as $contentTypeGroup) {
-                        $contentTypes[$contentTypeGroup->identifier] = $this->contentTypeService->loadContentTypes($contentTypeGroup);
-                    }
-
-                    return $contentTypes;
-                }),
+                'choice_loader' => new CallbackChoiceLoader([$this->contentTypeChoiceListProvider, 'getChoiceList']),
                 'choice_label' => 'name',
                 'choice_name' => 'identifier',
                 'choice_value' => 'identifier',
diff --git a/src/lib/Form/Type/Language/LanguageChoiceType.php b/src/lib/Form/Type/Language/LanguageChoiceType.php
index d385cc4597..b08c4952d0 100644
--- a/src/lib/Form/Type/Language/LanguageChoiceType.php
+++ b/src/lib/Form/Type/Language/LanguageChoiceType.php
@@ -8,7 +8,7 @@
 
 namespace EzSystems\EzPlatformAdminUi\Form\Type\Language;
 
-use eZ\Publish\API\Repository\LanguageService;
+use EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\LanguageChoiceListProvider;
 use Symfony\Component\Form\AbstractType;
 use Symfony\Component\Form\ChoiceList\Loader\CallbackChoiceLoader;
 use Symfony\Component\Form\Extension\Core\Type\ChoiceType;
@@ -21,20 +21,15 @@
  */
 class LanguageChoiceType extends AbstractType
 {
-    /** @var LanguageService */
-    protected $languageService;
-
-    /** @var array */
-    protected $siteAccessLanguages;
+    /** @var \EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\LanguageChoiceListProvider */
+    private $languageChoiceListProvider;
 
     /**
-     * @param LanguageService $languageService
-     * @param array $siteAccessLanguages
+     * @param \EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\LanguageChoiceListProvider $languageChoiceListProvider
      */
-    public function __construct(LanguageService $languageService, array $siteAccessLanguages)
+    public function __construct(LanguageChoiceListProvider $languageChoiceListProvider)
     {
-        $this->languageService = $languageService;
-        $this->siteAccessLanguages = $siteAccessLanguages;
+        $this->languageChoiceListProvider = $languageChoiceListProvider;
     }
 
     public function getParent()
@@ -46,27 +41,7 @@ public function configureOptions(OptionsResolver $resolver)
     {
         $resolver
             ->setDefaults([
-                'choice_loader' => new CallbackChoiceLoader(function () {
-                    $saLanguages = [];
-                    $languagesByCode = [];
-
-                    foreach ($this->languageService->loadLanguages() as $language) {
-                        if ($language->enabled) {
-                            $languagesByCode[$language->languageCode] = $language;
-                        }
-                    }
-
-                    foreach ($this->siteAccessLanguages as $languageCode) {
-                        if (!isset($languagesByCode[$languageCode])) {
-                            continue;
-                        }
-
-                        $saLanguages[] = $languagesByCode[$languageCode];
-                        unset($languagesByCode[$languageCode]);
-                    }
-
-                    return array_merge($saLanguages, array_values($languagesByCode));
-                }),
+                'choice_loader' => new CallbackChoiceLoader([$this->languageChoiceListProvider, 'getChoiceList']),
                 'choice_label' => 'name',
                 'choice_name' => 'languageCode',
                 'choice_value' => 'languageCode',
diff --git a/src/lib/Menu/ContentRightSidebarBuilder.php b/src/lib/Menu/ContentRightSidebarBuilder.php
index a68e40149e..f6fa029f36 100644
--- a/src/lib/Menu/ContentRightSidebarBuilder.php
+++ b/src/lib/Menu/ContentRightSidebarBuilder.php
@@ -22,6 +22,7 @@
 use EzSystems\EzPlatformAdminUi\Specification\ContentIsUser;
 use EzSystems\EzPlatformAdminUi\Specification\Location\HasChildren;
 use EzSystems\EzPlatformAdminUi\Specification\Location\IsRoot;
+use EzSystems\EzPlatformAdminUi\Util\PermissionUtilInterface;
 use EzSystems\EzPlatformAdminUiBundle\Templating\Twig\UniversalDiscoveryExtension;
 use EzSystems\EzPlatformAdminUi\Specification\Location\IsWithinCopySubtreeLimit;
 use JMS\TranslationBundle\Model\Message;
@@ -70,6 +71,9 @@ class ContentRightSidebarBuilder extends AbstractBuilder implements TranslationC
     /** @var \eZ\Publish\API\Repository\LocationService */
     private $locationService;
 
+    /** @var \EzSystems\EzPlatformAdminUi\Util\PermissionUtilInterface */
+    private $permissionUtil;
+
     /**
      * @param \EzSystems\EzPlatformAdminUi\Menu\MenuItemFactory $factory
      * @param \Symfony\Component\EventDispatcher\EventDispatcherInterface $eventDispatcher
@@ -81,6 +85,7 @@ class ContentRightSidebarBuilder extends AbstractBuilder implements TranslationC
      * @param \EzSystems\EzPlatformAdminUiBundle\Templating\Twig\UniversalDiscoveryExtension $udwExtension
      * @param \eZ\Publish\API\Repository\ContentService $contentService
      * @param \eZ\Publish\API\Repository\LocationService $locationService
+     * @param \EzSystems\EzPlatformAdminUi\Util\PermissionUtilInterface $permissionUtil
      */
     public function __construct(
         MenuItemFactory $factory,
@@ -92,7 +97,8 @@ public function __construct(
         SearchService $searchService,
         UniversalDiscoveryExtension $udwExtension,
         ContentService $contentService,
-        LocationService $locationService
+        LocationService $locationService,
+        PermissionUtilInterface $permissionUtil
     ) {
         parent::__construct($factory, $eventDispatcher);
 
@@ -104,6 +110,7 @@ public function __construct(
         $this->udwExtension = $udwExtension;
         $this->contentService = $contentService;
         $this->locationService = $locationService;
+        $this->permissionUtil = $permissionUtil;
     }
 
     /**
@@ -132,8 +139,11 @@ public function createStructure(array $options): ItemInterface
         $content = $options['content'];
         /** @var ItemInterface|ItemInterface[] $menu */
         $menu = $this->factory->createItem('root');
-        $canCreate = $this->permissionResolver->hasAccess('content', 'create')
-            && $contentType->isContainer;
+
+        $hasAccess = $this->permissionResolver->hasAccess('content', 'create');
+        $canCreateInLocation = $this->permissionUtil->canCreateInLocation($location, $hasAccess);
+
+        $canCreate = $canCreateInLocation && $contentType->isContainer;
         $canEdit = $this->permissionResolver->canUser(
             'content',
             'edit',
diff --git a/src/lib/UniversalDiscovery/Event/Subscriber/ContentCreate.php b/src/lib/UniversalDiscovery/Event/Subscriber/ContentCreate.php
new file mode 100644
index 0000000000..fed5ceb160
--- /dev/null
+++ b/src/lib/UniversalDiscovery/Event/Subscriber/ContentCreate.php
@@ -0,0 +1,121 @@
+<?php
+
+/**
+ * @copyright Copyright (C) eZ Systems AS. All rights reserved.
+ * @license For full copyright and license information view LICENSE file distributed with this source code.
+ */
+declare(strict_types=1);
+
+namespace EzSystems\EzPlatformAdminUi\UniversalDiscovery\Event\Subscriber;
+
+use eZ\Publish\API\Repository\ContentTypeService;
+use eZ\Publish\API\Repository\Exceptions\NotFoundException;
+use eZ\Publish\API\Repository\PermissionResolver;
+use eZ\Publish\API\Repository\Values\User\Limitation\ContentTypeLimitation;
+use EzSystems\EzPlatformAdminUi\UniversalDiscovery\Event\ConfigResolveEvent;
+use EzSystems\EzPlatformAdminUi\Util\PermissionUtilInterface;
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+
+class ContentCreate implements EventSubscriberInterface
+{
+    /** @var array */
+    private $restrictedContentTypesIdentifiers;
+
+    /** @var \EzSystems\EzPlatformAdminUi\Util\PermissionUtilInterface */
+    private $permissionUtil;
+
+    /** @var \eZ\Publish\API\Repository\ContentTypeService */
+    private $contentTypeService;
+
+    /**
+     * @param \eZ\Publish\API\Repository\PermissionResolver $permissionResolver
+     * @param \EzSystems\EzPlatformAdminUi\Util\PermissionUtilInterface $permissionUtil
+     * @param \eZ\Publish\API\Repository\ContentTypeService $contentTypeService
+     *
+     * @throws \eZ\Publish\API\Repository\Exceptions\InvalidArgumentException
+     */
+    public function __construct(
+        PermissionResolver $permissionResolver,
+        PermissionUtilInterface $permissionUtil,
+        ContentTypeService $contentTypeService
+    ) {
+        $this->contentTypeService = $contentTypeService;
+        $this->permissionUtil = $permissionUtil;
+
+        $hasAccess = $permissionResolver->hasAccess('content', 'create');
+        $this->restrictedContentTypesIdentifiers = $this->getRestrictedContentTypesIdentifiers($hasAccess);
+    }
+
+    /**
+     * @return array
+     */
+    public static function getSubscribedEvents(): array
+    {
+        return [
+            ConfigResolveEvent::NAME => ['onUdwConfigResolve'],
+        ];
+    }
+
+    /**
+     * @param \EzSystems\EzPlatformAdminUi\UniversalDiscovery\Event\ConfigResolveEvent $event
+     */
+    public function onUdwConfigResolve(ConfigResolveEvent $event): void
+    {
+        $configName = $event->getConfigName();
+        if ('create' !== $configName) {
+            return;
+        }
+
+        $context = $event->getContext();
+        if (
+            !isset($context['type'])
+            || 'content_create' !== $context['type']
+        ) {
+            return;
+        }
+
+        if ($this->hasContentTypeRestrictions()) {
+            $config = $event->getConfig();
+            $config['content_on_the_fly']['allowed_content_types'] = $this->restrictedContentTypesIdentifiers;
+            $event->setConfig($config);
+        }
+    }
+
+    /**
+     * @param array|bool $hasAccess
+     *
+     * @return array
+     */
+    private function getRestrictedContentTypesIdentifiers($hasAccess): array
+    {
+        if (!is_array($hasAccess)) {
+            return [];
+        }
+
+        $restrictedContentTypesIds = $this->permissionUtil->getRestrictions($hasAccess, ContentTypeLimitation::class);
+
+        if (empty($restrictedContentTypesIds)) {
+            return [];
+        }
+
+        $restrictedContentTypesIdentifiers = [];
+        foreach ($restrictedContentTypesIds as $restrictedContentTypeId) {
+            // TODO: Change to `contentTypeService->loadContentTypeList($restrictedContentTypesIds)` after #2444 will be merged
+            try {
+                $identifier = $this->contentTypeService->loadContentType($restrictedContentTypeId)->identifier;
+                $restrictedContentTypesIdentifiers[] = $identifier;
+            } catch (NotFoundException $e) {
+            }
+        }
+
+        return $restrictedContentTypesIdentifiers;
+    }
+
+    /**
+     * @return bool
+     */
+    private function hasContentTypeRestrictions(): bool
+    {
+        return !empty($this->restrictedContentTypesIdentifiers);
+    }
+}
diff --git a/src/lib/UniversalDiscovery/Event/Subscriber/SectionAssign.php b/src/lib/UniversalDiscovery/Event/Subscriber/SectionAssign.php
index b10b4a68a9..0a7ca39423 100644
--- a/src/lib/UniversalDiscovery/Event/Subscriber/SectionAssign.php
+++ b/src/lib/UniversalDiscovery/Event/Subscriber/SectionAssign.php
@@ -13,7 +13,7 @@
 use eZ\Publish\API\Repository\PermissionResolver;
 use eZ\Publish\API\Repository\Values\User\Limitation\ContentTypeLimitation;
 use EzSystems\EzPlatformAdminUi\UniversalDiscovery\Event\ConfigResolveEvent;
-use EzSystems\EzPlatformAdminUi\Util\PermissionUtil;
+use EzSystems\EzPlatformAdminUi\Util\PermissionUtilInterface;
 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
 
 class SectionAssign implements EventSubscriberInterface
@@ -21,7 +21,7 @@ class SectionAssign implements EventSubscriberInterface
     /** @var array */
     private $restrictedContentTypes;
 
-    /** @var \EzSystems\EzPlatformAdminUi\Util\PermissionUtil */
+    /** @var \EzSystems\EzPlatformAdminUi\Util\PermissionUtilInterface */
     private $permissionUtil;
 
     /** @var \eZ\Publish\API\Repository\ContentTypeService */
@@ -29,14 +29,14 @@ class SectionAssign implements EventSubscriberInterface
 
     /**
      * @param \eZ\Publish\API\Repository\PermissionResolver $permissionResolver
-     * @param \EzSystems\EzPlatformAdminUi\Util\PermissionUtil $permissionUtil
+     * @param \EzSystems\EzPlatformAdminUi\Util\PermissionUtilInterface $permissionUtil
      * @param \eZ\Publish\API\Repository\ContentTypeService $contentTypeService
      *
      * @throws \eZ\Publish\API\Repository\Exceptions\InvalidArgumentException
      */
     public function __construct(
         PermissionResolver $permissionResolver,
-        PermissionUtil $permissionUtil,
+        PermissionUtilInterface $permissionUtil,
         ContentTypeService $contentTypeService
     ) {
         $this->permissionUtil = $permissionUtil;
diff --git a/src/lib/Util/PermissionUtil.php b/src/lib/Util/PermissionUtil.php
index a6eb20680b..ae2ab9225a 100644
--- a/src/lib/Util/PermissionUtil.php
+++ b/src/lib/Util/PermissionUtil.php
@@ -8,8 +8,31 @@
 
 namespace EzSystems\EzPlatformAdminUi\Util;
 
-class PermissionUtil
+use eZ\Publish\API\Repository\PermissionResolver;
+use eZ\Publish\API\Repository\Values\Content\Location;
+use eZ\Publish\API\Repository\Values\User\Limitation\LocationLimitation;
+use eZ\Publish\API\Repository\Values\User\Limitation\ParentContentTypeLimitation;
+use eZ\Publish\API\Repository\Values\User\Limitation\ParentDepthLimitation;
+use eZ\Publish\API\Repository\Values\User\Limitation\ParentOwnerLimitation;
+use eZ\Publish\API\Repository\Values\User\Limitation\SectionLimitation;
+use eZ\Publish\API\Repository\Values\User\Limitation\SubtreeLimitation;
+
+class PermissionUtil implements PermissionUtilInterface
 {
+    /** @var \eZ\Publish\API\Repository\PermissionResolver */
+    private $permissionResolver;
+
+    private $flattenArrayOfLimitations;
+
+    /**
+     * @param \eZ\Publish\API\Repository\PermissionResolver $permissionResolver
+     */
+    public function __construct(
+        PermissionResolver $permissionResolver
+    ) {
+        $this->permissionResolver = $permissionResolver;
+    }
+
     /**
      * This method should only be used for very specific use cases. It should be used in a content cases
      * where assignment limitations are not relevant.
@@ -20,6 +43,9 @@ class PermissionUtil
      */
     public function flattenArrayOfLimitations(array $hasAccess): array
     {
+        if (is_array($this->flattenArrayOfLimitations)) {
+            return $this->flattenArrayOfLimitations;
+        }
         $limitations = [];
         foreach ($hasAccess as $permissionSet) {
             if ($permissionSet['limitation'] !== null) {
@@ -30,12 +56,93 @@ public function flattenArrayOfLimitations(array $hasAccess): array
                 $policyLimitations = $policy->getLimitations();
                 if (!empty($policyLimitations)) {
                     foreach ($policyLimitations as $policyLimitation) {
-                        $limitations[] = $policyLimitation;
+                        $limitations[$policy->id][] = $policyLimitation;
                     }
                 }
             }
         }
 
-        return $limitations;
+        return $this->flattenArrayOfLimitations = $limitations;
+    }
+
+    /**
+     * @param $hasAccess
+     * @param string $class
+     *
+     * @return array
+     */
+    public function getRestrictions($hasAccess, string $class): array
+    {
+        $restrictions = [];
+        $oneOfPoliciesHasNoLimitation = false;
+        foreach ($this->flattenArrayOfLimitations($hasAccess) as $policy => $limitations) {
+            $policyHasLimitation = false;
+            foreach ($limitations as $limitation) {
+                if ($limitation instanceof $class) {
+                    $restrictions[] = $limitation->limitationValues;
+                    $policyHasLimitation = true;
+                }
+            }
+            if (false === $policyHasLimitation) {
+                $oneOfPoliciesHasNoLimitation = true;
+            }
+        }
+
+        if ($oneOfPoliciesHasNoLimitation) {
+            return [];
+        }
+
+        return empty($restrictions) ? $restrictions : array_unique(array_merge(...$restrictions));
+    }
+
+    /**
+     * @param \eZ\Publish\API\Repository\Values\Content\Location $location
+     * @param array|bool $hasAccess
+     *
+     * @return bool
+     */
+    public function canCreateInLocation(Location $location, $hasAccess): bool
+    {
+        if (is_bool($hasAccess)) {
+            return $hasAccess;
+        }
+        $restrictedLocations = $this->getRestrictions($hasAccess, LocationLimitation::class);
+        $canCreateInLocation = empty($restrictedLocations)
+            ? true
+            : in_array($location->id, array_map('intval', $restrictedLocations), true);
+
+        $restrictedParentContentTypes = $this->getRestrictions($hasAccess, ParentContentTypeLimitation::class);
+        $canCreateInParentContentType = empty($restrictedParentContentTypes)
+            ? true
+            : in_array($location->contentInfo->contentTypeId, array_map('intval', $restrictedParentContentTypes), true);
+
+        $restrictedParentDepths = $this->getRestrictions($hasAccess, ParentDepthLimitation::class);
+        $canCreateInParentDepth = empty($restrictedParentDepths)
+            ? true
+            : in_array($location->depth, array_map('intval', $restrictedParentDepths), true);
+
+        $restrictedParentOwner = $this->getRestrictions($hasAccess, ParentOwnerLimitation::class);
+        $canCreateInParentOwner = empty($restrictedParentOwner)
+            ? true
+            : $location->contentInfo->ownerId === $this->permissionResolver->getCurrentUserReference()->getUserId();
+
+        $restrictedSections = $this->getRestrictions($hasAccess, SectionLimitation::class);
+        $canCreateInSection = empty($restrictedSections)
+            ? true
+            : in_array($location->contentInfo->sectionId, array_map('intval', $restrictedSections), true);
+
+        $restrictedSubtrees = $this->getRestrictions($hasAccess, SubtreeLimitation::class);
+        $canCreateInSubtree = empty($restrictedSubtrees)
+            ? true
+            : !empty(array_filter($restrictedSubtrees, function ($restrictedSubtree) use ($location) {
+                return strpos($location->pathString, $restrictedSubtree) === 0;
+            }));
+
+        return $canCreateInParentContentType
+            && $canCreateInLocation
+            && $canCreateInParentDepth
+            && $canCreateInParentOwner
+            && $canCreateInSection
+            && $canCreateInSubtree;
     }
 }
diff --git a/src/lib/Util/PermissionUtilInterface.php b/src/lib/Util/PermissionUtilInterface.php
new file mode 100644
index 0000000000..9876475a26
--- /dev/null
+++ b/src/lib/Util/PermissionUtilInterface.php
@@ -0,0 +1,38 @@
+<?php
+
+/**
+ * @copyright Copyright (C) eZ Systems AS. All rights reserved.
+ * @license For full copyright and license information view LICENSE file distributed with this source code.
+ */
+namespace EzSystems\EzPlatformAdminUi\Util;
+
+use eZ\Publish\API\Repository\Values\Content\Location;
+
+interface PermissionUtilInterface
+{
+    /**
+     * This method should only be used for very specific use cases. It should be used in a content cases
+     * where assignment limitations are not relevant.
+     *
+     * @param array $hasAccess
+     *
+     * @return array
+     */
+    public function flattenArrayOfLimitations(array $hasAccess): array;
+
+    /**
+     * @param $hasAccess
+     * @param string $class
+     *
+     * @return array
+     */
+    public function getRestrictions($hasAccess, string $class): array;
+
+    /**
+     * @param \eZ\Publish\API\Repository\Values\Content\Location $location
+     * @param array|bool $hasAccess
+     *
+     * @return bool
+     */
+    public function canCreateInLocation(Location $location, $hasAccess): bool;
+}

From 99411e66196b67011df0246710fbba7eae571921 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miko=C5=82aj=20Adamczyk?= <mikadamczyk@gmail.com>
Date: Tue, 13 Nov 2018 11:24:07 +0100
Subject: [PATCH 2/5] EZP-29742: Implement permissions for Content/Create in
 Content item view - refactor for assign section

---
 src/bundle/Controller/SectionController.php   | 25 +++----------------
 .../Event/Subscriber/SectionAssign.php        | 13 +---------
 2 files changed, 4 insertions(+), 34 deletions(-)

diff --git a/src/bundle/Controller/SectionController.php b/src/bundle/Controller/SectionController.php
index 7086c685f3..9903e735d0 100644
--- a/src/bundle/Controller/SectionController.php
+++ b/src/bundle/Controller/SectionController.php
@@ -518,31 +518,12 @@ private function canUserAssignSectionToSomeContent(Section $section): bool
             return $hasAccess;
         }
 
-        if (!empty($restrictedNewSections = $this->getRestrictedNewSectionsIds($hasAccess))) {
-            return in_array($section->id, $restrictedNewSections, true);
+        $restrictedNewSections = $this->permissionUtil->getRestrictions($hasAccess, NewSectionLimitation::class);
+        if (!empty($restrictedNewSections)) {
+            return in_array($section->id, array_map('intval', $restrictedNewSections), true);
         }
 
         // If a user has other limitation than NewSectionLimitation, then a decision will be taken later, based on selected Content.
         return true;
     }
-
-    /**
-     * @param array $hasAccess
-     *
-     * @return int[]
-     */
-    private function getRestrictedNewSectionsIds(array $hasAccess): array
-    {
-        $restrictedSectionsIds = [];
-
-        foreach ($this->permissionUtil->flattenArrayOfLimitations($hasAccess) as $limitation) {
-            if ($limitation instanceof NewSectionLimitation) {
-                foreach ($limitation->limitationValues as $sectionsId) {
-                    $restrictedSectionsIds[] = (int)$sectionsId;
-                }
-            }
-        }
-
-        return array_unique($restrictedSectionsIds);
-    }
 }
diff --git a/src/lib/UniversalDiscovery/Event/Subscriber/SectionAssign.php b/src/lib/UniversalDiscovery/Event/Subscriber/SectionAssign.php
index 0a7ca39423..a50a3d4d64 100644
--- a/src/lib/UniversalDiscovery/Event/Subscriber/SectionAssign.php
+++ b/src/lib/UniversalDiscovery/Event/Subscriber/SectionAssign.php
@@ -88,19 +88,8 @@ public function onUdwConfigResolve(ConfigResolveEvent $event): void
     private function getRestrictedContentTypes(array $hasAccess): array
     {
         $restrictedContentTypes = [];
-        $restrictedContentTypesIds = [];
+        $restrictedContentTypesIds = $this->permissionUtil->getRestrictions($hasAccess, ContentTypeLimitation::class);
 
-        foreach ($this->permissionUtil->flattenArrayOfLimitations($hasAccess) as $limitation) {
-            if ($limitation instanceof ContentTypeLimitation) {
-                $restrictedContentTypesIds[] = $limitation->limitationValues;
-            }
-        }
-
-        if (empty($restrictedContentTypesIds)) {
-            return $restrictedContentTypes;
-        }
-
-        $restrictedContentTypesIds = array_unique(array_merge(...$restrictedContentTypesIds));
         foreach ($restrictedContentTypesIds as $restrictedContentTypeId) {
             // TODO: Change to `contentTypeService->loadContentTypeList($restrictedContentTypesIds)` after #2444 will be merged
             try {

From 916f410a1558c4d8b82242c93051dea6d5e24dc3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miko=C5=82aj=20Adamczyk?= <mikadamczyk@gmail.com>
Date: Tue, 13 Nov 2018 14:16:57 +0100
Subject: [PATCH 3/5] EZP-29742: Implement permissions for Content/Create in
 Content item view - part 1

---
 src/bundle/Controller/SectionController.php   |  14 +-
 src/bundle/Resources/config/services.yml      |   1 +
 .../Resources/config/services/permission.yml  |  11 ++
 .../Resources/config/services/utils.yml       |   3 -
 src/bundle/Resources/public/scss/_forms.scss  |   5 +-
 .../content/widgets/content_create.html.twig  |   2 +-
 ...sionAwareContentTypeChoiceListProvider.php |  14 +-
 ...missionAwareLanguageChoiceListProvider.php |  14 +-
 src/lib/Menu/ContentRightSidebarBuilder.php   |  14 +-
 .../PermissionChecker.php}                    | 140 +++++++++++++-----
 .../PermissionCheckerInterface.php}           |  14 +-
 .../Event/Subscriber/ContentCreate.php        |  14 +-
 .../Event/Subscriber/SectionAssign.php        |  14 +-
 13 files changed, 164 insertions(+), 96 deletions(-)
 create mode 100644 src/bundle/Resources/config/services/permission.yml
 rename src/lib/{Util/PermissionUtil.php => Permission/PermissionChecker.php} (63%)
 rename src/lib/{Util/PermissionUtilInterface.php => Permission/PermissionCheckerInterface.php} (62%)

diff --git a/src/bundle/Controller/SectionController.php b/src/bundle/Controller/SectionController.php
index 9903e735d0..bd5e9ec365 100644
--- a/src/bundle/Controller/SectionController.php
+++ b/src/bundle/Controller/SectionController.php
@@ -31,7 +31,7 @@
 use EzSystems\EzPlatformAdminUi\Form\SubmitHandler;
 use EzSystems\EzPlatformAdminUi\Notification\NotificationHandlerInterface;
 use EzSystems\EzPlatformAdminUi\UI\Service\PathService;
-use EzSystems\EzPlatformAdminUi\Util\PermissionUtilInterface;
+use EzSystems\EzPlatformAdminUi\Permission\PermissionCheckerInterface;
 use EzSystems\EzPlatformAdminUiBundle\View\EzPagerfantaView;
 use EzSystems\EzPlatformAdminUiBundle\View\Template\EzPagerfantaTemplate;
 use Pagerfanta\Adapter\ArrayAdapter;
@@ -80,8 +80,8 @@ class SectionController extends Controller
     /** @var \eZ\Publish\API\Repository\PermissionResolver */
     private $permissionResolver;
 
-    /** @var \EzSystems\EzPlatformAdminUi\Util\PermissionUtilInterface */
-    private $permissionUtil;
+    /** @var \EzSystems\EzPlatformAdminUi\Permission\PermissionCheckerInterface */
+    private $permissionChecker;
 
     /** @var int */
     private $defaultPaginationLimit;
@@ -99,7 +99,7 @@ class SectionController extends Controller
      * @param \eZ\Publish\API\Repository\LocationService $locationService
      * @param \EzSystems\EzPlatformAdminUi\UI\Service\PathService $pathService
      * @param \eZ\Publish\API\Repository\PermissionResolver $permissionResolver
-     * @param \EzSystems\EzPlatformAdminUi\Util\PermissionUtilInterface $permissionUtil
+     * @param \EzSystems\EzPlatformAdminUi\Permission\PermissionCheckerInterface $permissionChecker
      * @param int $defaultPaginationLimit
      */
     public function __construct(
@@ -115,7 +115,7 @@ public function __construct(
         LocationService $locationService,
         PathService $pathService,
         PermissionResolver $permissionResolver,
-        PermissionUtilInterface $permissionUtil,
+        PermissionCheckerInterface $permissionChecker,
         int $defaultPaginationLimit
     ) {
         $this->notificationHandler = $notificationHandler;
@@ -131,7 +131,7 @@ public function __construct(
         $this->pathService = $pathService;
         $this->defaultPaginationLimit = $defaultPaginationLimit;
         $this->permissionResolver = $permissionResolver;
-        $this->permissionUtil = $permissionUtil;
+        $this->permissionChecker = $permissionChecker;
     }
 
     public function performAccessCheck(): void
@@ -518,7 +518,7 @@ private function canUserAssignSectionToSomeContent(Section $section): bool
             return $hasAccess;
         }
 
-        $restrictedNewSections = $this->permissionUtil->getRestrictions($hasAccess, NewSectionLimitation::class);
+        $restrictedNewSections = $this->permissionChecker->getRestrictions($hasAccess, NewSectionLimitation::class);
         if (!empty($restrictedNewSections)) {
             return in_array($section->id, array_map('intval', $restrictedNewSections), true);
         }
diff --git a/src/bundle/Resources/config/services.yml b/src/bundle/Resources/config/services.yml
index e698ed2c5e..0ea9257be0 100644
--- a/src/bundle/Resources/config/services.yml
+++ b/src/bundle/Resources/config/services.yml
@@ -18,6 +18,7 @@ imports:
     - { resource: services/translation.yml }
     - { resource: services/user_settings.yml }
     - { resource: services/rest.yml }
+    - { resource: services/permission.yml }
 
 services:
     _defaults:
diff --git a/src/bundle/Resources/config/services/permission.yml b/src/bundle/Resources/config/services/permission.yml
new file mode 100644
index 0000000000..354825a632
--- /dev/null
+++ b/src/bundle/Resources/config/services/permission.yml
@@ -0,0 +1,11 @@
+services:
+    _defaults:
+        autowire: true
+        autoconfigure: true
+        public: false
+
+    EzSystems\EzPlatformAdminUi\Permission\:
+        resource: "../../../lib/Permission"
+
+    EzSystems\EzPlatformAdminUi\Permission\PermissionCheckerInterface:
+        alias: EzSystems\EzPlatformAdminUi\Permission\PermissionChecker
diff --git a/src/bundle/Resources/config/services/utils.yml b/src/bundle/Resources/config/services/utils.yml
index 02bddb8e3a..0b2accacf1 100644
--- a/src/bundle/Resources/config/services/utils.yml
+++ b/src/bundle/Resources/config/services/utils.yml
@@ -6,6 +6,3 @@ services:
 
     EzSystems\EzPlatformAdminUi\Util\:
         resource: "../../../lib/Util"
-
-    EzSystems\EzPlatformAdminUi\Util\PermissionUtilInterface:
-        alias: EzSystems\EzPlatformAdminUi\Util\PermissionUtil
diff --git a/src/bundle/Resources/public/scss/_forms.scss b/src/bundle/Resources/public/scss/_forms.scss
index 7b5bd9818d..96b7fb7d6b 100644
--- a/src/bundle/Resources/public/scss/_forms.scss
+++ b/src/bundle/Resources/public/scss/_forms.scss
@@ -31,7 +31,6 @@ form:not(.form-inline) {
 
     .form-control[readonly] {
         background-color: $ez-white;
-        pointer-events: none;
     }
 
     .form-control:focus {
@@ -102,3 +101,7 @@ form:not(.form-inline) {
         position: absolute;
     }
 }
+
+.ez-content-create[readonly] {
+    pointer-events: none;
+}
diff --git a/src/bundle/Resources/views/content/widgets/content_create.html.twig b/src/bundle/Resources/views/content/widgets/content_create.html.twig
index adc1cb1ed8..ca94b1f294 100644
--- a/src/bundle/Resources/views/content/widgets/content_create.html.twig
+++ b/src/bundle/Resources/views/content/widgets/content_create.html.twig
@@ -7,7 +7,7 @@
             <div class="ez-extra-actions__section-header">{{ 'content.create.select_language'|trans|desc('Select language') }}</div>
             <div class="ez-extra-actions__section-content">
                 {% if form.language.vars.choices|length == 1 %}
-                    {{ form_widget(form.language, {'attr': {'readonly': true}}) }}
+                    {{ form_widget(form.language, {'attr': {'class': 'ez-content-create', 'readonly': true}}) }}
                 {% else %}
                     {{ form_widget(form.language) }}
                 {% endif %}
diff --git a/src/lib/Form/Type/ChoiceList/Provider/PermissionAwareContentTypeChoiceListProvider.php b/src/lib/Form/Type/ChoiceList/Provider/PermissionAwareContentTypeChoiceListProvider.php
index c285bbacd9..7a76183fa1 100644
--- a/src/lib/Form/Type/ChoiceList/Provider/PermissionAwareContentTypeChoiceListProvider.php
+++ b/src/lib/Form/Type/ChoiceList/Provider/PermissionAwareContentTypeChoiceListProvider.php
@@ -10,7 +10,7 @@
 
 use eZ\Publish\API\Repository\PermissionResolver;
 use eZ\Publish\API\Repository\Values\User\Limitation\ContentTypeLimitation;
-use EzSystems\EzPlatformAdminUi\Util\PermissionUtilInterface;
+use EzSystems\EzPlatformAdminUi\Permission\PermissionCheckerInterface;
 use eZ\Publish\API\Repository\Values\ContentType\ContentType;
 
 class PermissionAwareContentTypeChoiceListProvider implements ChoiceListProviderInterface
@@ -21,8 +21,8 @@ class PermissionAwareContentTypeChoiceListProvider implements ChoiceListProvider
     /** @var \eZ\Publish\API\Repository\PermissionResolver */
     private $permissionResolver;
 
-    /** @var \EzSystems\EzPlatformAdminUi\Util\PermissionUtilInterface */
-    private $permissionUtil;
+    /** @var \EzSystems\EzPlatformAdminUi\Permission\PermissionCheckerInterface */
+    private $permissionChecker;
 
     /** @var string */
     private $module;
@@ -32,21 +32,21 @@ class PermissionAwareContentTypeChoiceListProvider implements ChoiceListProvider
 
     /**
      * @param \eZ\Publish\API\Repository\PermissionResolver $permissionResolver
-     * @param \EzSystems\EzPlatformAdminUi\Util\PermissionUtilInterface $permissionUtil
+     * @param \EzSystems\EzPlatformAdminUi\Permission\PermissionCheckerInterface $permissionChecker
      * @param \EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\ContentTypeChoiceListProvider $decorated
      * @param string $module
      * @param string $function
      */
     public function __construct(
         PermissionResolver $permissionResolver,
-        PermissionUtilInterface $permissionUtil,
+        PermissionCheckerInterface $permissionChecker,
         ContentTypeChoiceListProvider $decorated,
         string $module,
         string $function
     ) {
         $this->decorated = $decorated;
         $this->permissionResolver = $permissionResolver;
-        $this->permissionUtil = $permissionUtil;
+        $this->permissionChecker = $permissionChecker;
         $this->module = $module;
         $this->function = $function;
     }
@@ -60,7 +60,7 @@ public function getChoiceList(): array
     {
         $hasAccess = $this->permissionResolver->hasAccess($this->module, $this->function);
         if (!is_bool($hasAccess)) {
-            $restrictedContentTypesIds = $this->permissionUtil->getRestrictions($hasAccess, ContentTypeLimitation::class);
+            $restrictedContentTypesIds = $this->permissionChecker->getRestrictions($hasAccess, ContentTypeLimitation::class);
         }
 
         $contentTypesGroups = $this->decorated->getChoiceList();
diff --git a/src/lib/Form/Type/ChoiceList/Provider/PermissionAwareLanguageChoiceListProvider.php b/src/lib/Form/Type/ChoiceList/Provider/PermissionAwareLanguageChoiceListProvider.php
index 4e34ddb810..c2588904e3 100644
--- a/src/lib/Form/Type/ChoiceList/Provider/PermissionAwareLanguageChoiceListProvider.php
+++ b/src/lib/Form/Type/ChoiceList/Provider/PermissionAwareLanguageChoiceListProvider.php
@@ -10,7 +10,7 @@
 
 use eZ\Publish\API\Repository\PermissionResolver;
 use eZ\Publish\API\Repository\Values\User\Limitation\LanguageLimitation;
-use EzSystems\EzPlatformAdminUi\Util\PermissionUtilInterface;
+use EzSystems\EzPlatformAdminUi\Permission\PermissionCheckerInterface;
 use eZ\Publish\API\Repository\Values\Content\Language;
 
 class PermissionAwareLanguageChoiceListProvider implements ChoiceListProviderInterface
@@ -21,8 +21,8 @@ class PermissionAwareLanguageChoiceListProvider implements ChoiceListProviderInt
     /** @var \eZ\Publish\API\Repository\PermissionResolver */
     private $permissionResolver;
 
-    /** @var \EzSystems\EzPlatformAdminUi\Util\PermissionUtilInterface */
-    private $permissionUtil;
+    /** @var \EzSystems\EzPlatformAdminUi\Permission\PermissionCheckerInterface */
+    private $permissionChecker;
 
     /** @var string */
     private $module;
@@ -32,21 +32,21 @@ class PermissionAwareLanguageChoiceListProvider implements ChoiceListProviderInt
 
     /**
      * @param \eZ\Publish\API\Repository\PermissionResolver $permissionResolver
-     * @param \EzSystems\EzPlatformAdminUi\Util\PermissionUtilInterface $permissionUtil
+     * @param \EzSystems\EzPlatformAdminUi\Permission\PermissionCheckerInterface $permissionChecker
      * @param \EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\LanguageChoiceListProvider $decorated
      * @param string $module
      * @param string $function
      */
     public function __construct(
         PermissionResolver $permissionResolver,
-        PermissionUtilInterface $permissionUtil,
+        PermissionCheckerInterface $permissionChecker,
         LanguageChoiceListProvider $decorated,
         string $module,
         string $function
     ) {
         $this->decorated = $decorated;
         $this->permissionResolver = $permissionResolver;
-        $this->permissionUtil = $permissionUtil;
+        $this->permissionChecker = $permissionChecker;
         $this->module = $module;
         $this->function = $function;
     }
@@ -61,7 +61,7 @@ public function getChoiceList(): array
         $restrictedLanguagesCodes = [];
         $hasAccess = $this->permissionResolver->hasAccess($this->module, $this->function);
         if (!is_bool($hasAccess)) {
-            $restrictedLanguagesCodes = $this->permissionUtil->getRestrictions($hasAccess, LanguageLimitation::class);
+            $restrictedLanguagesCodes = $this->permissionChecker->getRestrictions($hasAccess, LanguageLimitation::class);
         }
 
         $languages = $this->decorated->getChoiceList();
diff --git a/src/lib/Menu/ContentRightSidebarBuilder.php b/src/lib/Menu/ContentRightSidebarBuilder.php
index f6fa029f36..70e4168734 100644
--- a/src/lib/Menu/ContentRightSidebarBuilder.php
+++ b/src/lib/Menu/ContentRightSidebarBuilder.php
@@ -22,7 +22,7 @@
 use EzSystems\EzPlatformAdminUi\Specification\ContentIsUser;
 use EzSystems\EzPlatformAdminUi\Specification\Location\HasChildren;
 use EzSystems\EzPlatformAdminUi\Specification\Location\IsRoot;
-use EzSystems\EzPlatformAdminUi\Util\PermissionUtilInterface;
+use EzSystems\EzPlatformAdminUi\Permission\PermissionCheckerInterface;
 use EzSystems\EzPlatformAdminUiBundle\Templating\Twig\UniversalDiscoveryExtension;
 use EzSystems\EzPlatformAdminUi\Specification\Location\IsWithinCopySubtreeLimit;
 use JMS\TranslationBundle\Model\Message;
@@ -71,8 +71,8 @@ class ContentRightSidebarBuilder extends AbstractBuilder implements TranslationC
     /** @var \eZ\Publish\API\Repository\LocationService */
     private $locationService;
 
-    /** @var \EzSystems\EzPlatformAdminUi\Util\PermissionUtilInterface */
-    private $permissionUtil;
+    /** @var \EzSystems\EzPlatformAdminUi\Permission\PermissionCheckerInterface */
+    private $permissionChecker;
 
     /**
      * @param \EzSystems\EzPlatformAdminUi\Menu\MenuItemFactory $factory
@@ -85,7 +85,7 @@ class ContentRightSidebarBuilder extends AbstractBuilder implements TranslationC
      * @param \EzSystems\EzPlatformAdminUiBundle\Templating\Twig\UniversalDiscoveryExtension $udwExtension
      * @param \eZ\Publish\API\Repository\ContentService $contentService
      * @param \eZ\Publish\API\Repository\LocationService $locationService
-     * @param \EzSystems\EzPlatformAdminUi\Util\PermissionUtilInterface $permissionUtil
+     * @param \EzSystems\EzPlatformAdminUi\Permission\PermissionCheckerInterface $permissionChecker
      */
     public function __construct(
         MenuItemFactory $factory,
@@ -98,7 +98,7 @@ public function __construct(
         UniversalDiscoveryExtension $udwExtension,
         ContentService $contentService,
         LocationService $locationService,
-        PermissionUtilInterface $permissionUtil
+        PermissionCheckerInterface $permissionChecker
     ) {
         parent::__construct($factory, $eventDispatcher);
 
@@ -110,7 +110,7 @@ public function __construct(
         $this->udwExtension = $udwExtension;
         $this->contentService = $contentService;
         $this->locationService = $locationService;
-        $this->permissionUtil = $permissionUtil;
+        $this->permissionChecker = $permissionChecker;
     }
 
     /**
@@ -141,7 +141,7 @@ public function createStructure(array $options): ItemInterface
         $menu = $this->factory->createItem('root');
 
         $hasAccess = $this->permissionResolver->hasAccess('content', 'create');
-        $canCreateInLocation = $this->permissionUtil->canCreateInLocation($location, $hasAccess);
+        $canCreateInLocation = $this->permissionChecker->canCreateInLocation($location, $hasAccess);
 
         $canCreate = $canCreateInLocation && $contentType->isContainer;
         $canEdit = $this->permissionResolver->canUser(
diff --git a/src/lib/Util/PermissionUtil.php b/src/lib/Permission/PermissionChecker.php
similarity index 63%
rename from src/lib/Util/PermissionUtil.php
rename to src/lib/Permission/PermissionChecker.php
index ae2ab9225a..b4380a9ac8 100644
--- a/src/lib/Util/PermissionUtil.php
+++ b/src/lib/Permission/PermissionChecker.php
@@ -6,63 +6,43 @@
  */
 declare(strict_types=1);
 
-namespace EzSystems\EzPlatformAdminUi\Util;
+namespace EzSystems\EzPlatformAdminUi\Permission;
 
 use eZ\Publish\API\Repository\PermissionResolver;
+use eZ\Publish\API\Repository\UserService;
 use eZ\Publish\API\Repository\Values\Content\Location;
 use eZ\Publish\API\Repository\Values\User\Limitation\LocationLimitation;
 use eZ\Publish\API\Repository\Values\User\Limitation\ParentContentTypeLimitation;
 use eZ\Publish\API\Repository\Values\User\Limitation\ParentDepthLimitation;
 use eZ\Publish\API\Repository\Values\User\Limitation\ParentOwnerLimitation;
+use eZ\Publish\API\Repository\Values\User\Limitation\ParentUserGroupLimitation;
 use eZ\Publish\API\Repository\Values\User\Limitation\SectionLimitation;
 use eZ\Publish\API\Repository\Values\User\Limitation\SubtreeLimitation;
+use eZ\Publish\API\Repository\Values\User\User;
 
-class PermissionUtil implements PermissionUtilInterface
+class PermissionChecker implements PermissionCheckerInterface
 {
+    private const USER_GROUPS_LIMIT = 1;
+
     /** @var \eZ\Publish\API\Repository\PermissionResolver */
     private $permissionResolver;
 
+    /** @var \eZ\Publish\API\Repository\UserService */
+    private $userService;
+
+    /** @var array */
     private $flattenArrayOfLimitations;
 
     /**
      * @param \eZ\Publish\API\Repository\PermissionResolver $permissionResolver
+     * @param \eZ\Publish\API\Repository\UserService $userService
      */
     public function __construct(
-        PermissionResolver $permissionResolver
+        PermissionResolver $permissionResolver,
+        UserService $userService
     ) {
         $this->permissionResolver = $permissionResolver;
-    }
-
-    /**
-     * This method should only be used for very specific use cases. It should be used in a content cases
-     * where assignment limitations are not relevant.
-     *
-     * @param array $hasAccess
-     *
-     * @return array
-     */
-    public function flattenArrayOfLimitations(array $hasAccess): array
-    {
-        if (is_array($this->flattenArrayOfLimitations)) {
-            return $this->flattenArrayOfLimitations;
-        }
-        $limitations = [];
-        foreach ($hasAccess as $permissionSet) {
-            if ($permissionSet['limitation'] !== null) {
-                $limitations[] = $permissionSet['limitation'];
-            }
-            /** @var \eZ\Publish\API\Repository\Values\User\Policy $policy */
-            foreach ($permissionSet['policies'] as $policy) {
-                $policyLimitations = $policy->getLimitations();
-                if (!empty($policyLimitations)) {
-                    foreach ($policyLimitations as $policyLimitation) {
-                        $limitations[$policy->id][] = $policyLimitation;
-                    }
-                }
-            }
-        }
-
-        return $this->flattenArrayOfLimitations = $limitations;
+        $this->userService = $userService;
     }
 
     /**
@@ -75,7 +55,8 @@ public function getRestrictions($hasAccess, string $class): array
     {
         $restrictions = [];
         $oneOfPoliciesHasNoLimitation = false;
-        foreach ($this->flattenArrayOfLimitations($hasAccess) as $policy => $limitations) {
+
+        foreach ($this->flattenArrayOfLimitationsForCurrentUser($hasAccess) as $policy => $limitations) {
             $policyHasLimitation = false;
             foreach ($limitations as $limitation) {
                 if ($limitation instanceof $class) {
@@ -131,6 +112,11 @@ public function canCreateInLocation(Location $location, $hasAccess): bool
             ? true
             : in_array($location->contentInfo->sectionId, array_map('intval', $restrictedSections), true);
 
+        $restrictedParentUserGroups = $this->getRestrictions($hasAccess, ParentUserGroupLimitation::class);
+        $canCreateInParentUserGroup = empty($restrictedParentUserGroups)
+            ? true
+            : $this->hasSameParentUserGroup($location);
+
         $restrictedSubtrees = $this->getRestrictions($hasAccess, SubtreeLimitation::class);
         $canCreateInSubtree = empty($restrictedSubtrees)
             ? true
@@ -143,6 +129,86 @@ public function canCreateInLocation(Location $location, $hasAccess): bool
             && $canCreateInParentDepth
             && $canCreateInParentOwner
             && $canCreateInSection
-            && $canCreateInSubtree;
+            && $canCreateInSubtree
+            && $canCreateInParentUserGroup;
+    }
+
+    /**
+     * This method should only be used for very specific use cases. It should be used in a content cases
+     * where assignment limitations are not relevant.
+     *
+     * @param array $hasAccess
+     *
+     * @return array
+     */
+    private function flattenArrayOfLimitationsForCurrentUser(array $hasAccess): array
+    {
+        $currentUserId = $this->permissionResolver->getCurrentUserReference()->getUserId();
+
+        if (is_array($this->flattenArrayOfLimitations[$currentUserId])) {
+            return $this->flattenArrayOfLimitations[$currentUserId];
+        }
+
+        $limitations = [];
+        foreach ($hasAccess as $permissionSet) {
+            if ($permissionSet['limitation'] !== null) {
+                $limitations[] = $permissionSet['limitation'];
+            }
+            /** @var \eZ\Publish\API\Repository\Values\User\Policy $policy */
+            foreach ($permissionSet['policies'] as $policy) {
+                $policyLimitations = $policy->getLimitations();
+                if (!empty($policyLimitations)) {
+                    foreach ($policyLimitations as $policyLimitation) {
+                        $limitations[$policy->id][] = $policyLimitation;
+                    }
+                }
+            }
+        }
+
+        return $this->flattenArrayOfLimitations[$currentUserId] = $limitations;
+    }
+
+    /**
+     * @param \eZ\Publish\API\Repository\Values\Content\Location $location
+     *
+     * @return bool
+     *
+     * @throws \eZ\Publish\API\Repository\Exceptions\NotFoundException
+     * @throws \eZ\Publish\API\Repository\Exceptions\UnauthorizedException
+     */
+    private function hasSameParentUserGroup(Location $location): bool
+    {
+        $currentUserId = $this->permissionResolver->getCurrentUserReference()->getUserId();
+        $currentUser = $this->userService->loadUser($currentUserId);
+        $currentUserGroups = $this->loadAllUserGroupsIdsOfUser($currentUser);
+
+        $locationOwnerId = $location->contentInfo->ownerId;
+        $locationOwner = $this->userService->loadUser($locationOwnerId);
+        $locationOwnerGroups = $this->loadAllUserGroupsIdsOfUser($locationOwner);
+
+        return !empty(array_intersect($currentUserGroups, $locationOwnerGroups));
+    }
+
+    /**
+     * @param \eZ\Publish\API\Repository\Values\User\User $user
+     *
+     * @return int[]
+     *
+     * @throws \eZ\Publish\API\Repository\Exceptions\UnauthorizedException
+     */
+    private function loadAllUserGroupsIdsOfUser(User $user): array
+    {
+        $allUserGroups = [];
+        $offset = 0;
+
+        do {
+            $userGroups = $this->userService->loadUserGroupsOfUser($user, $offset, self::USER_GROUPS_LIMIT);
+            foreach ($userGroups as $userGroup) {
+                $allUserGroups[] = $userGroup->contentInfo->id;
+            }
+            $offset += self::USER_GROUPS_LIMIT;
+        } while (count($userGroups) === self::USER_GROUPS_LIMIT);
+
+        return $allUserGroups;
     }
 }
diff --git a/src/lib/Util/PermissionUtilInterface.php b/src/lib/Permission/PermissionCheckerInterface.php
similarity index 62%
rename from src/lib/Util/PermissionUtilInterface.php
rename to src/lib/Permission/PermissionCheckerInterface.php
index 9876475a26..28e60c3b31 100644
--- a/src/lib/Util/PermissionUtilInterface.php
+++ b/src/lib/Permission/PermissionCheckerInterface.php
@@ -4,22 +4,12 @@
  * @copyright Copyright (C) eZ Systems AS. All rights reserved.
  * @license For full copyright and license information view LICENSE file distributed with this source code.
  */
-namespace EzSystems\EzPlatformAdminUi\Util;
+namespace EzSystems\EzPlatformAdminUi\Permission;
 
 use eZ\Publish\API\Repository\Values\Content\Location;
 
-interface PermissionUtilInterface
+interface PermissionCheckerInterface
 {
-    /**
-     * This method should only be used for very specific use cases. It should be used in a content cases
-     * where assignment limitations are not relevant.
-     *
-     * @param array $hasAccess
-     *
-     * @return array
-     */
-    public function flattenArrayOfLimitations(array $hasAccess): array;
-
     /**
      * @param $hasAccess
      * @param string $class
diff --git a/src/lib/UniversalDiscovery/Event/Subscriber/ContentCreate.php b/src/lib/UniversalDiscovery/Event/Subscriber/ContentCreate.php
index fed5ceb160..bfec364a4d 100644
--- a/src/lib/UniversalDiscovery/Event/Subscriber/ContentCreate.php
+++ b/src/lib/UniversalDiscovery/Event/Subscriber/ContentCreate.php
@@ -13,7 +13,7 @@
 use eZ\Publish\API\Repository\PermissionResolver;
 use eZ\Publish\API\Repository\Values\User\Limitation\ContentTypeLimitation;
 use EzSystems\EzPlatformAdminUi\UniversalDiscovery\Event\ConfigResolveEvent;
-use EzSystems\EzPlatformAdminUi\Util\PermissionUtilInterface;
+use EzSystems\EzPlatformAdminUi\Permission\PermissionCheckerInterface;
 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
 
 class ContentCreate implements EventSubscriberInterface
@@ -21,26 +21,26 @@ class ContentCreate implements EventSubscriberInterface
     /** @var array */
     private $restrictedContentTypesIdentifiers;
 
-    /** @var \EzSystems\EzPlatformAdminUi\Util\PermissionUtilInterface */
-    private $permissionUtil;
+    /** @var \EzSystems\EzPlatformAdminUi\Permission\PermissionCheckerInterface */
+    private $permissionChecker;
 
     /** @var \eZ\Publish\API\Repository\ContentTypeService */
     private $contentTypeService;
 
     /**
      * @param \eZ\Publish\API\Repository\PermissionResolver $permissionResolver
-     * @param \EzSystems\EzPlatformAdminUi\Util\PermissionUtilInterface $permissionUtil
+     * @param \EzSystems\EzPlatformAdminUi\Permission\PermissionCheckerInterface $permissionChecker
      * @param \eZ\Publish\API\Repository\ContentTypeService $contentTypeService
      *
      * @throws \eZ\Publish\API\Repository\Exceptions\InvalidArgumentException
      */
     public function __construct(
         PermissionResolver $permissionResolver,
-        PermissionUtilInterface $permissionUtil,
+        PermissionCheckerInterface $permissionChecker,
         ContentTypeService $contentTypeService
     ) {
         $this->contentTypeService = $contentTypeService;
-        $this->permissionUtil = $permissionUtil;
+        $this->permissionChecker = $permissionChecker;
 
         $hasAccess = $permissionResolver->hasAccess('content', 'create');
         $this->restrictedContentTypesIdentifiers = $this->getRestrictedContentTypesIdentifiers($hasAccess);
@@ -92,7 +92,7 @@ private function getRestrictedContentTypesIdentifiers($hasAccess): array
             return [];
         }
 
-        $restrictedContentTypesIds = $this->permissionUtil->getRestrictions($hasAccess, ContentTypeLimitation::class);
+        $restrictedContentTypesIds = $this->permissionChecker->getRestrictions($hasAccess, ContentTypeLimitation::class);
 
         if (empty($restrictedContentTypesIds)) {
             return [];
diff --git a/src/lib/UniversalDiscovery/Event/Subscriber/SectionAssign.php b/src/lib/UniversalDiscovery/Event/Subscriber/SectionAssign.php
index a50a3d4d64..e322535223 100644
--- a/src/lib/UniversalDiscovery/Event/Subscriber/SectionAssign.php
+++ b/src/lib/UniversalDiscovery/Event/Subscriber/SectionAssign.php
@@ -13,7 +13,7 @@
 use eZ\Publish\API\Repository\PermissionResolver;
 use eZ\Publish\API\Repository\Values\User\Limitation\ContentTypeLimitation;
 use EzSystems\EzPlatformAdminUi\UniversalDiscovery\Event\ConfigResolveEvent;
-use EzSystems\EzPlatformAdminUi\Util\PermissionUtilInterface;
+use EzSystems\EzPlatformAdminUi\Permission\PermissionCheckerInterface;
 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
 
 class SectionAssign implements EventSubscriberInterface
@@ -21,25 +21,25 @@ class SectionAssign implements EventSubscriberInterface
     /** @var array */
     private $restrictedContentTypes;
 
-    /** @var \EzSystems\EzPlatformAdminUi\Util\PermissionUtilInterface */
-    private $permissionUtil;
+    /** @var \EzSystems\EzPlatformAdminUi\Permission\PermissionCheckerInterface */
+    private $permissionChecker;
 
     /** @var \eZ\Publish\API\Repository\ContentTypeService */
     private $contentTypeService;
 
     /**
      * @param \eZ\Publish\API\Repository\PermissionResolver $permissionResolver
-     * @param \EzSystems\EzPlatformAdminUi\Util\PermissionUtilInterface $permissionUtil
+     * @param \EzSystems\EzPlatformAdminUi\Permission\PermissionCheckerInterface $permissionChecker
      * @param \eZ\Publish\API\Repository\ContentTypeService $contentTypeService
      *
      * @throws \eZ\Publish\API\Repository\Exceptions\InvalidArgumentException
      */
     public function __construct(
         PermissionResolver $permissionResolver,
-        PermissionUtilInterface $permissionUtil,
+        PermissionCheckerInterface $permissionChecker,
         ContentTypeService $contentTypeService
     ) {
-        $this->permissionUtil = $permissionUtil;
+        $this->permissionChecker = $permissionChecker;
         $this->contentTypeService = $contentTypeService;
         $hasAccess = $permissionResolver->hasAccess('section', 'assign');
         $this->restrictedContentTypes = is_array($hasAccess) ? $this->getRestrictedContentTypes($hasAccess) : [];
@@ -88,7 +88,7 @@ public function onUdwConfigResolve(ConfigResolveEvent $event): void
     private function getRestrictedContentTypes(array $hasAccess): array
     {
         $restrictedContentTypes = [];
-        $restrictedContentTypesIds = $this->permissionUtil->getRestrictions($hasAccess, ContentTypeLimitation::class);
+        $restrictedContentTypesIds = $this->permissionChecker->getRestrictions($hasAccess, ContentTypeLimitation::class);
 
         foreach ($restrictedContentTypesIds as $restrictedContentTypeId) {
             // TODO: Change to `contentTypeService->loadContentTypeList($restrictedContentTypesIds)` after #2444 will be merged

From afe3a5ff8e15118de2213689b16c688e5694a7c1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miko=C5=82aj=20Adamczyk?= <mikadamczyk@gmail.com>
Date: Wed, 14 Nov 2018 13:18:03 +0100
Subject: [PATCH 4/5] EZP-29742: Implement permissions for Content/Create in
 Content item view - choice loaders

---
 src/bundle/Resources/config/services.yml      | 49 +---------
 .../Resources/config/services/forms.yml       | 49 ++++++++++
 .../{permission.yml => permissions.yml}       |  3 +-
 .../Loader/ContentTypeChoiceLoader.php        | 89 +++++++++++++++++++
 .../LanguageChoiceLoader.php}                 | 58 +++++++++++-
 ...ermissionAwareContentTypeChoiceLoader.php} | 61 ++++++++++---
 .../PermissionAwareLanguageChoiceLoader.php}  | 62 ++++++++++---
 .../Provider/ChoiceListProviderInterface.php  | 12 ---
 .../ContentTypeChoiceListProvider.php         | 39 --------
 .../Type/Content/Draft/ContentCreateType.php  | 27 +++---
 .../ContentType/ContentTypeChoiceType.php     | 15 ++--
 .../Form/Type/Language/LanguageChoiceType.php | 15 ++--
 src/lib/Permission/PermissionChecker.php      | 53 ++++++++---
 .../Event/Subscriber/ContentCreate.php        | 41 ++++++++-
 14 files changed, 401 insertions(+), 172 deletions(-)
 create mode 100644 src/bundle/Resources/config/services/forms.yml
 rename src/bundle/Resources/config/services/{permission.yml => permissions.yml} (73%)
 create mode 100644 src/lib/Form/Type/ChoiceList/Loader/ContentTypeChoiceLoader.php
 rename src/lib/Form/Type/ChoiceList/{Provider/LanguageChoiceListProvider.php => Loader/LanguageChoiceLoader.php} (50%)
 rename src/lib/Form/Type/ChoiceList/{Provider/PermissionAwareContentTypeChoiceListProvider.php => Loader/PermissionAwareContentTypeChoiceLoader.php} (59%)
 rename src/lib/Form/Type/ChoiceList/{Provider/PermissionAwareLanguageChoiceListProvider.php => Loader/PermissionAwareLanguageChoiceLoader.php} (55%)
 delete mode 100644 src/lib/Form/Type/ChoiceList/Provider/ChoiceListProviderInterface.php
 delete mode 100644 src/lib/Form/Type/ChoiceList/Provider/ContentTypeChoiceListProvider.php

diff --git a/src/bundle/Resources/config/services.yml b/src/bundle/Resources/config/services.yml
index 0ea9257be0..bcb1212b95 100644
--- a/src/bundle/Resources/config/services.yml
+++ b/src/bundle/Resources/config/services.yml
@@ -18,7 +18,8 @@ imports:
     - { resource: services/translation.yml }
     - { resource: services/user_settings.yml }
     - { resource: services/rest.yml }
-    - { resource: services/permission.yml }
+    - { resource: services/permissions.yml }
+    - { resource: services/forms.yml }
 
 services:
     _defaults:
@@ -77,23 +78,6 @@ services:
         tags:
             - {name: kernel.event_subscriber}
 
-    EzSystems\EzPlatformAdminUi\Form\SubmitHandler: ~
-
-    EzSystems\EzPlatformAdminUi\Form\Type\:
-        resource: '../../../lib/Form/Type'
-
-    EzSystems\EzPlatformAdminUi\Form\DataMapper\:
-        resource: '../../../lib/Form/DataMapper'
-
-    EzSystems\EzPlatformAdminUi\Form\Type\Policy\PolicyChoiceType:
-        arguments:
-            $policyMap: "%ezpublish.api.role.policy_map%"
-
-    EzSystems\EzPlatformAdminUi\Form\Type\Content\Draft\ContentCreateType:
-        arguments:
-            $choiceListProvider: '@EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\PermissionAwareContentTypeChoiceListProvider'
-            $languageChoiceListProvider: '@EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\PermissionAwareLanguageChoiceListProvider'
-
     EzSystems\EzPlatformAdminUi\UI\Dataset\DatasetFactory:
         arguments:
             $userContentTypeIdentifier: '$user_content_type_identifier$'
@@ -107,16 +91,10 @@ services:
         tags:
             - { name: form.type }
 
-    EzSystems\EzPlatformAdminUi\Form\Factory\FormFactory: ~
-
     EzSystems\EzPlatformAdminUi\Notification\FlashBagNotificationHandler: ~
 
     EzSystems\EzPlatformAdminUi\Notification\NotificationHandlerInterface: '@EzSystems\EzPlatformAdminUi\Notification\FlashBagNotificationHandler'
 
-    EzSystems\EzPlatformAdminUi\Form\Type\Extension\Content\ContentEditTypeExtension:
-        tags:
-            - { name: form.type_extension, extended_type: EzSystems\RepositoryForms\Form\Type\Content\ContentEditType }
-
     EzSystems\EzPlatformAdminUi\RepositoryForms\View\ViewParametersListener:
         public: true
         tags:
@@ -141,9 +119,6 @@ services:
         tags:
             - { name: knp_menu.voter }
 
-    EzSystems\EzPlatformAdminUi\Form\EventListener\:
-        resource: '../../../lib/Form/EventListener'
-
     EzSystems\EzPlatformAdminUi\RepositoryForms\Dispatcher\ContentOnTheFlyDispatcher:
         calls:
             - [setEventDispatcher, ["@event_dispatcher"]]
@@ -153,23 +128,3 @@ services:
             - {name: kernel.event_subscriber, priority: -250}
 
     EzSystems\EzPlatformAdminUiBundle\Templating\Twig\UserPreferencesGlobalExtension: ~
-
-    EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\ContentTypeChoiceListProvider: ~
-
-    EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\LanguageChoiceListProvider:
-        arguments:
-            $siteAccessLanguages: '$languages$'
-
-    EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\PermissionAwareContentTypeChoiceListProvider:
-        arguments:
-            $decorated: '@EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\ContentTypeChoiceListProvider'
-            $module: 'content'
-            $function: 'create'
-
-    EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\PermissionAwareLanguageChoiceListProvider:
-        arguments:
-            $decorated: '@EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\LanguageChoiceListProvider'
-            $module: 'content'
-            $function: 'create'
-
-
diff --git a/src/bundle/Resources/config/services/forms.yml b/src/bundle/Resources/config/services/forms.yml
new file mode 100644
index 0000000000..ef57c3f337
--- /dev/null
+++ b/src/bundle/Resources/config/services/forms.yml
@@ -0,0 +1,49 @@
+services:
+    _defaults:
+        autowire: true
+        autoconfigure: true
+        public: false
+
+    EzSystems\EzPlatformAdminUi\Form\SubmitHandler: ~
+
+    EzSystems\EzPlatformAdminUi\Form\Factory\FormFactory: ~
+
+    EzSystems\EzPlatformAdminUi\Form\DataMapper\:
+        resource: '../../../lib/Form/DataMapper'
+
+    EzSystems\EzPlatformAdminUi\Form\Type\:
+        resource: '../../../lib/Form/Type'
+
+    EzSystems\EzPlatformAdminUi\Form\EventListener\:
+        resource: '../../../lib/Form/EventListener'
+
+    EzSystems\EzPlatformAdminUi\Form\Type\Extension\Content\ContentEditTypeExtension:
+        tags:
+            - { name: form.type_extension, extended_type: EzSystems\RepositoryForms\Form\Type\Content\ContentEditType }
+
+    EzSystems\EzPlatformAdminUi\Form\Type\Policy\PolicyChoiceType:
+        arguments:
+            $policyMap: "%ezpublish.api.role.policy_map%"
+
+    EzSystems\EzPlatformAdminUi\Form\Type\Content\Draft\ContentCreateType:
+        arguments:
+            $contentTypeChoiceLoader: '@EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Loader\PermissionAwareContentTypeChoiceLoader'
+            $languageChoiceLoader: '@EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Loader\PermissionAwareLanguageChoiceLoader'
+
+    EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Loader\ContentTypeChoiceLoader: ~
+
+    EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Loader\LanguageChoiceLoader:
+        arguments:
+            $siteAccessLanguages: '$languages$'
+
+    EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Loader\PermissionAwareContentTypeChoiceLoader:
+        arguments:
+            $decorated: '@EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Loader\ContentTypeChoiceLoader'
+            $module: 'content'
+            $function: 'create'
+
+    EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Loader\PermissionAwareLanguageChoiceLoader:
+        arguments:
+            $decorated: '@EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Loader\LanguageChoiceLoader'
+            $module: 'content'
+            $function: 'create'
diff --git a/src/bundle/Resources/config/services/permission.yml b/src/bundle/Resources/config/services/permissions.yml
similarity index 73%
rename from src/bundle/Resources/config/services/permission.yml
rename to src/bundle/Resources/config/services/permissions.yml
index 354825a632..8f18779f19 100644
--- a/src/bundle/Resources/config/services/permission.yml
+++ b/src/bundle/Resources/config/services/permissions.yml
@@ -4,8 +4,7 @@ services:
         autoconfigure: true
         public: false
 
-    EzSystems\EzPlatformAdminUi\Permission\:
-        resource: "../../../lib/Permission"
+    EzSystems\EzPlatformAdminUi\Permission\PermissionChecker: ~
 
     EzSystems\EzPlatformAdminUi\Permission\PermissionCheckerInterface:
         alias: EzSystems\EzPlatformAdminUi\Permission\PermissionChecker
diff --git a/src/lib/Form/Type/ChoiceList/Loader/ContentTypeChoiceLoader.php b/src/lib/Form/Type/ChoiceList/Loader/ContentTypeChoiceLoader.php
new file mode 100644
index 0000000000..721962a051
--- /dev/null
+++ b/src/lib/Form/Type/ChoiceList/Loader/ContentTypeChoiceLoader.php
@@ -0,0 +1,89 @@
+<?php
+
+/**
+ * @copyright Copyright (C) eZ Systems AS. All rights reserved.
+ * @license For full copyright and license information view LICENSE file distributed with this source code.
+ */
+declare(strict_types=1);
+
+namespace EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Loader;
+
+use eZ\Publish\API\Repository\ContentTypeService;
+use Symfony\Component\Form\ChoiceList\ArrayChoiceList;
+use Symfony\Component\Form\ChoiceList\Loader\ChoiceLoaderInterface;
+
+class ContentTypeChoiceLoader implements ChoiceLoaderInterface
+{
+    /** @var \eZ\Publish\API\Repository\ContentTypeService */
+    protected $contentTypeService;
+
+    /**
+     * @param \eZ\Publish\API\Repository\ContentTypeService $contentTypeService
+     */
+    public function __construct(ContentTypeService $contentTypeService)
+    {
+        $this->contentTypeService = $contentTypeService;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function getChoiceList(): array
+    {
+        $contentTypes = [];
+        $contentTypeGroups = $this->contentTypeService->loadContentTypeGroups();
+        foreach ($contentTypeGroups as $contentTypeGroup) {
+            $contentTypes[$contentTypeGroup->identifier] = $this->contentTypeService->loadContentTypes($contentTypeGroup);
+        }
+
+        return $contentTypes;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function loadChoiceList($value = null)
+    {
+        $choices = $this->getChoiceList();
+
+        return new ArrayChoiceList($choices, $value);
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function loadChoicesForValues(array $values, $value = null)
+    {
+        // Optimize
+        $values = array_filter($values);
+        if (empty($values)) {
+            return [];
+        }
+
+        // If no callable is set, values are the same as choices
+        if (null === $value) {
+            return $values;
+        }
+
+        return $this->loadChoiceList($value)->getChoicesForValues($values);
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function loadValuesForChoices(array $choices, $value = null)
+    {
+        // Optimize
+        $choices = array_filter($choices);
+        if (empty($choices)) {
+            return [];
+        }
+
+        // If no callable is set, choices are the same as values
+        if (null === $value) {
+            return $choices;
+        }
+
+        return $this->loadChoiceList($value)->getValuesForChoices($choices);
+    }
+}
diff --git a/src/lib/Form/Type/ChoiceList/Provider/LanguageChoiceListProvider.php b/src/lib/Form/Type/ChoiceList/Loader/LanguageChoiceLoader.php
similarity index 50%
rename from src/lib/Form/Type/ChoiceList/Provider/LanguageChoiceListProvider.php
rename to src/lib/Form/Type/ChoiceList/Loader/LanguageChoiceLoader.php
index b3a8c44cf3..6066bb2e5b 100644
--- a/src/lib/Form/Type/ChoiceList/Provider/LanguageChoiceListProvider.php
+++ b/src/lib/Form/Type/ChoiceList/Loader/LanguageChoiceLoader.php
@@ -6,16 +6,18 @@
  */
 declare(strict_types=1);
 
-namespace EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider;
+namespace EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Loader;
 
 use eZ\Publish\API\Repository\LanguageService;
+use Symfony\Component\Form\ChoiceList\ArrayChoiceList;
+use Symfony\Component\Form\ChoiceList\Loader\ChoiceLoaderInterface;
 
-class LanguageChoiceListProvider implements ChoiceListProviderInterface
+class LanguageChoiceLoader implements ChoiceLoaderInterface
 {
     /** @var \eZ\Publish\API\Repository\LanguageService */
     protected $languageService;
 
-    /** @var array */
+    /** @var string[] */
     protected $siteAccessLanguages;
 
     /**
@@ -29,7 +31,7 @@ public function __construct(LanguageService $languageService, array $siteAccessL
     }
 
     /**
-     * @return array
+     * {@inheritdoc}
      */
     public function getChoiceList(): array
     {
@@ -53,4 +55,52 @@ public function getChoiceList(): array
 
         return array_merge($saLanguages, array_values($languagesByCode));
     }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function loadChoiceList($value = null)
+    {
+        $choices = $this->getChoiceList();
+
+        return new ArrayChoiceList($choices, $value);
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function loadChoicesForValues(array $values, $value = null)
+    {
+        // Optimize
+        $values = array_filter($values);
+        if (empty($values)) {
+            return [];
+        }
+
+        // If no callable is set, values are the same as choices
+        if (null === $value) {
+            return $values;
+        }
+
+        return $this->loadChoiceList($value)->getChoicesForValues($values);
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function loadValuesForChoices(array $choices, $value = null)
+    {
+        // Optimize
+        $choices = array_filter($choices);
+        if (empty($choices)) {
+            return [];
+        }
+
+        // If no callable is set, choices are the same as values
+        if (null === $value) {
+            return $choices;
+        }
+
+        return $this->loadChoiceList($value)->getValuesForChoices($choices);
+    }
 }
diff --git a/src/lib/Form/Type/ChoiceList/Provider/PermissionAwareContentTypeChoiceListProvider.php b/src/lib/Form/Type/ChoiceList/Loader/PermissionAwareContentTypeChoiceLoader.php
similarity index 59%
rename from src/lib/Form/Type/ChoiceList/Provider/PermissionAwareContentTypeChoiceListProvider.php
rename to src/lib/Form/Type/ChoiceList/Loader/PermissionAwareContentTypeChoiceLoader.php
index 7a76183fa1..6573299cea 100644
--- a/src/lib/Form/Type/ChoiceList/Provider/PermissionAwareContentTypeChoiceListProvider.php
+++ b/src/lib/Form/Type/ChoiceList/Loader/PermissionAwareContentTypeChoiceLoader.php
@@ -6,16 +6,18 @@
  */
 declare(strict_types=1);
 
-namespace EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider;
+namespace EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Loader;
 
 use eZ\Publish\API\Repository\PermissionResolver;
 use eZ\Publish\API\Repository\Values\User\Limitation\ContentTypeLimitation;
 use EzSystems\EzPlatformAdminUi\Permission\PermissionCheckerInterface;
 use eZ\Publish\API\Repository\Values\ContentType\ContentType;
+use Symfony\Component\Form\ChoiceList\ArrayChoiceList;
+use Symfony\Component\Form\ChoiceList\Loader\ChoiceLoaderInterface;
 
-class PermissionAwareContentTypeChoiceListProvider implements ChoiceListProviderInterface
+class PermissionAwareContentTypeChoiceLoader implements ChoiceLoaderInterface
 {
-    /** @var \EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\ChoiceListProviderInterface */
+    /** @var \Symfony\Component\Form\ChoiceList\Loader\ChoiceLoaderInterface */
     private $decorated;
 
     /** @var \eZ\Publish\API\Repository\PermissionResolver */
@@ -33,14 +35,14 @@ class PermissionAwareContentTypeChoiceListProvider implements ChoiceListProvider
     /**
      * @param \eZ\Publish\API\Repository\PermissionResolver $permissionResolver
      * @param \EzSystems\EzPlatformAdminUi\Permission\PermissionCheckerInterface $permissionChecker
-     * @param \EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\ContentTypeChoiceListProvider $decorated
+     * @param \EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Loader\ContentTypeChoiceLoader $decorated
      * @param string $module
      * @param string $function
      */
     public function __construct(
         PermissionResolver $permissionResolver,
         PermissionCheckerInterface $permissionChecker,
-        ContentTypeChoiceListProvider $decorated,
+        ContentTypeChoiceLoader $decorated,
         string $module,
         string $function
     ) {
@@ -52,21 +54,18 @@ public function __construct(
     }
 
     /**
-     * @return array
-     *
-     * @throws \eZ\Publish\API\Repository\Exceptions\InvalidArgumentException
+     * {@inheritdoc}
      */
-    public function getChoiceList(): array
+    public function loadChoiceList($value = null)
     {
         $hasAccess = $this->permissionResolver->hasAccess($this->module, $this->function);
         if (!is_bool($hasAccess)) {
             $restrictedContentTypesIds = $this->permissionChecker->getRestrictions($hasAccess, ContentTypeLimitation::class);
         }
-
         $contentTypesGroups = $this->decorated->getChoiceList();
 
         if (empty($restrictedContentTypesIds)) {
-            return $contentTypesGroups;
+            return new ArrayChoiceList($contentTypesGroups, $value);
         }
 
         foreach ($contentTypesGroups as $group => $contentTypes) {
@@ -75,6 +74,44 @@ public function getChoiceList(): array
             });
         }
 
-        return $contentTypesGroups;
+        return new ArrayChoiceList($contentTypesGroups, $value);
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function loadChoicesForValues(array $values, $value = null)
+    {
+        // Optimize
+        $values = array_filter($values);
+        if (empty($values)) {
+            return [];
+        }
+
+        // If no callable is set, values are the same as choices
+        if (null === $value) {
+            return $values;
+        }
+
+        return $this->loadChoiceList($value)->getChoicesForValues($values);
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function loadValuesForChoices(array $choices, $value = null)
+    {
+        // Optimize
+        $choices = array_filter($choices);
+        if (empty($choices)) {
+            return [];
+        }
+
+        // If no callable is set, choices are the same as values
+        if (null === $value) {
+            return $choices;
+        }
+
+        return $this->loadChoiceList($value)->getValuesForChoices($choices);
     }
 }
diff --git a/src/lib/Form/Type/ChoiceList/Provider/PermissionAwareLanguageChoiceListProvider.php b/src/lib/Form/Type/ChoiceList/Loader/PermissionAwareLanguageChoiceLoader.php
similarity index 55%
rename from src/lib/Form/Type/ChoiceList/Provider/PermissionAwareLanguageChoiceListProvider.php
rename to src/lib/Form/Type/ChoiceList/Loader/PermissionAwareLanguageChoiceLoader.php
index c2588904e3..f02e0c3a99 100644
--- a/src/lib/Form/Type/ChoiceList/Provider/PermissionAwareLanguageChoiceListProvider.php
+++ b/src/lib/Form/Type/ChoiceList/Loader/PermissionAwareLanguageChoiceLoader.php
@@ -6,16 +6,18 @@
  */
 declare(strict_types=1);
 
-namespace EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider;
+namespace EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Loader;
 
 use eZ\Publish\API\Repository\PermissionResolver;
 use eZ\Publish\API\Repository\Values\User\Limitation\LanguageLimitation;
 use EzSystems\EzPlatformAdminUi\Permission\PermissionCheckerInterface;
 use eZ\Publish\API\Repository\Values\Content\Language;
+use Symfony\Component\Form\ChoiceList\ArrayChoiceList;
+use Symfony\Component\Form\ChoiceList\Loader\ChoiceLoaderInterface;
 
-class PermissionAwareLanguageChoiceListProvider implements ChoiceListProviderInterface
+class PermissionAwareLanguageChoiceLoader implements ChoiceLoaderInterface
 {
-    /** @var \EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\ChoiceListProviderInterface */
+    /** @var \Symfony\Component\Form\ChoiceList\Loader\ChoiceLoaderInterface */
     private $decorated;
 
     /** @var \eZ\Publish\API\Repository\PermissionResolver */
@@ -33,14 +35,14 @@ class PermissionAwareLanguageChoiceListProvider implements ChoiceListProviderInt
     /**
      * @param \eZ\Publish\API\Repository\PermissionResolver $permissionResolver
      * @param \EzSystems\EzPlatformAdminUi\Permission\PermissionCheckerInterface $permissionChecker
-     * @param \EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\LanguageChoiceListProvider $decorated
+     * @param \EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Loader\LanguageChoiceLoader $decorated
      * @param string $module
      * @param string $function
      */
     public function __construct(
         PermissionResolver $permissionResolver,
         PermissionCheckerInterface $permissionChecker,
-        LanguageChoiceListProvider $decorated,
+        LanguageChoiceLoader $decorated,
         string $module,
         string $function
     ) {
@@ -52,11 +54,9 @@ public function __construct(
     }
 
     /**
-     * @return array
-     *
-     * @throws \eZ\Publish\API\Repository\Exceptions\InvalidArgumentException
+     * {@inheritdoc}
      */
-    public function getChoiceList(): array
+    public function loadChoiceList($value = null)
     {
         $restrictedLanguagesCodes = [];
         $hasAccess = $this->permissionResolver->hasAccess($this->module, $this->function);
@@ -67,11 +67,51 @@ public function getChoiceList(): array
         $languages = $this->decorated->getChoiceList();
 
         if (empty($restrictedLanguagesCodes)) {
-            return $languages;
+            return new ArrayChoiceList($languages, $value);
         }
 
-        return array_filter($languages, function (Language $language) use ($restrictedLanguagesCodes) {
+        $languages = array_filter($languages, function (Language $language) use ($restrictedLanguagesCodes) {
             return in_array($language->languageCode, $restrictedLanguagesCodes, true);
         });
+
+        return new ArrayChoiceList($languages, $value);
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function loadChoicesForValues(array $values, $value = null)
+    {
+        // Optimize
+        $values = array_filter($values);
+        if (empty($values)) {
+            return [];
+        }
+
+        // If no callable is set, values are the same as choices
+        if (null === $value) {
+            return $values;
+        }
+
+        return $this->loadChoiceList($value)->getChoicesForValues($values);
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function loadValuesForChoices(array $choices, $value = null)
+    {
+        // Optimize
+        $choices = array_filter($choices);
+        if (empty($choices)) {
+            return [];
+        }
+
+        // If no callable is set, choices are the same as values
+        if (null === $value) {
+            return $choices;
+        }
+
+        return $this->loadChoiceList($value)->getValuesForChoices($choices);
     }
 }
diff --git a/src/lib/Form/Type/ChoiceList/Provider/ChoiceListProviderInterface.php b/src/lib/Form/Type/ChoiceList/Provider/ChoiceListProviderInterface.php
deleted file mode 100644
index 988074d116..0000000000
--- a/src/lib/Form/Type/ChoiceList/Provider/ChoiceListProviderInterface.php
+++ /dev/null
@@ -1,12 +0,0 @@
-<?php
-
-/**
- * @copyright Copyright (C) eZ Systems AS. All rights reserved.
- * @license For full copyright and license information view LICENSE file distributed with this source code.
- */
-namespace EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider;
-
-interface ChoiceListProviderInterface
-{
-    public function getChoiceList(): array;
-}
diff --git a/src/lib/Form/Type/ChoiceList/Provider/ContentTypeChoiceListProvider.php b/src/lib/Form/Type/ChoiceList/Provider/ContentTypeChoiceListProvider.php
deleted file mode 100644
index c2cf3c0446..0000000000
--- a/src/lib/Form/Type/ChoiceList/Provider/ContentTypeChoiceListProvider.php
+++ /dev/null
@@ -1,39 +0,0 @@
-<?php
-
-/**
- * @copyright Copyright (C) eZ Systems AS. All rights reserved.
- * @license For full copyright and license information view LICENSE file distributed with this source code.
- */
-declare(strict_types=1);
-
-namespace EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider;
-
-use eZ\Publish\API\Repository\ContentTypeService;
-
-class ContentTypeChoiceListProvider implements ChoiceListProviderInterface
-{
-    /** @var \eZ\Publish\API\Repository\ContentTypeService */
-    protected $contentTypeService;
-
-    /**
-     * @param \eZ\Publish\API\Repository\ContentTypeService $contentTypeService
-     */
-    public function __construct(ContentTypeService $contentTypeService)
-    {
-        $this->contentTypeService = $contentTypeService;
-    }
-
-    /**
-     * @return array
-     */
-    public function getChoiceList(): array
-    {
-        $contentTypes = [];
-        $contentTypeGroups = $this->contentTypeService->loadContentTypeGroups();
-        foreach ($contentTypeGroups as $contentTypeGroup) {
-            $contentTypes[$contentTypeGroup->identifier] = $this->contentTypeService->loadContentTypes($contentTypeGroup);
-        }
-
-        return $contentTypes;
-    }
-}
diff --git a/src/lib/Form/Type/Content/Draft/ContentCreateType.php b/src/lib/Form/Type/Content/Draft/ContentCreateType.php
index 721c1b86ff..8a0a007a69 100644
--- a/src/lib/Form/Type/Content/Draft/ContentCreateType.php
+++ b/src/lib/Form/Type/Content/Draft/ContentCreateType.php
@@ -10,12 +10,11 @@
 
 use eZ\Publish\API\Repository\LanguageService;
 use EzSystems\EzPlatformAdminUi\Form\Data\Content\Draft\ContentCreateData;
-use EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\ChoiceListProviderInterface;
 use EzSystems\EzPlatformAdminUi\Form\Type\Content\LocationType;
 use EzSystems\EzPlatformAdminUi\Form\Type\ContentType\ContentTypeChoiceType;
 use EzSystems\EzPlatformAdminUi\Form\Type\Language\LanguageChoiceType;
 use Symfony\Component\Form\AbstractType;
-use Symfony\Component\Form\ChoiceList\Loader\CallbackChoiceLoader;
+use Symfony\Component\Form\ChoiceList\Loader\ChoiceLoaderInterface;
 use Symfony\Component\Form\Extension\Core\Type\SubmitType;
 use Symfony\Component\Form\FormBuilderInterface;
 use Symfony\Component\OptionsResolver\OptionsResolver;
@@ -25,25 +24,25 @@ class ContentCreateType extends AbstractType
     /** @var \eZ\Publish\API\Repository\LanguageService */
     protected $languageService;
 
-    /** @var \EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\ChoiceListProviderInterface */
-    private $choiceListProvider;
+    /** @var \Symfony\Component\Form\ChoiceList\Loader\ChoiceLoaderInterface */
+    private $contentTypeChoiceLoader;
 
-    /** @var \EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\ChoiceListProviderInterface */
-    private $languageChoiceListProvider;
+    /** @var \Symfony\Component\Form\ChoiceList\Loader\ChoiceLoaderInterface */
+    private $languageChoiceLoader;
 
     /**
      * @param \eZ\Publish\API\Repository\LanguageService $languageService
-     * @param \EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\ChoiceListProviderInterface $choiceListProvider
-     * @param \EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\ChoiceListProviderInterface $languageChoiceListProvider
+     * @param \Symfony\Component\Form\ChoiceList\Loader\ChoiceLoaderInterface $contentTypeChoiceLoader
+     * @param \Symfony\Component\Form\ChoiceList\Loader\ChoiceLoaderInterface $languageChoiceLoader
      */
     public function __construct(
         LanguageService $languageService,
-        ChoiceListProviderInterface $choiceListProvider,
-        ChoiceListProviderInterface $languageChoiceListProvider
+        ChoiceLoaderInterface $contentTypeChoiceLoader,
+        ChoiceLoaderInterface $languageChoiceLoader
     ) {
         $this->languageService = $languageService;
-        $this->choiceListProvider = $choiceListProvider;
-        $this->languageChoiceListProvider = $languageChoiceListProvider;
+        $this->contentTypeChoiceLoader = $contentTypeChoiceLoader;
+        $this->languageChoiceLoader = $languageChoiceLoader;
     }
 
     public function buildForm(FormBuilderInterface $builder, array $options)
@@ -56,7 +55,7 @@ public function buildForm(FormBuilderInterface $builder, array $options)
                     'label' => false,
                     'multiple' => false,
                     'expanded' => true,
-                    'choice_loader' => new CallbackChoiceLoader([$this->choiceListProvider, 'getChoiceList']),
+                    'choice_loader' => $this->contentTypeChoiceLoader,
                 ]
             )
             ->add(
@@ -71,7 +70,7 @@ public function buildForm(FormBuilderInterface $builder, array $options)
                     'label' => false,
                     'multiple' => false,
                     'expanded' => false,
-                    'choice_loader' => new CallbackChoiceLoader([$this->languageChoiceListProvider, 'getChoiceList']),
+                    'choice_loader' => $this->languageChoiceLoader,
                 ]
             )
             ->add(
diff --git a/src/lib/Form/Type/ContentType/ContentTypeChoiceType.php b/src/lib/Form/Type/ContentType/ContentTypeChoiceType.php
index 7703127234..39d7dbac1b 100644
--- a/src/lib/Form/Type/ContentType/ContentTypeChoiceType.php
+++ b/src/lib/Form/Type/ContentType/ContentTypeChoiceType.php
@@ -9,9 +9,8 @@
 namespace EzSystems\EzPlatformAdminUi\Form\Type\ContentType;
 
 use eZ\Publish\API\Repository\ContentTypeService;
-use EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\ContentTypeChoiceListProvider;
+use EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Loader\ContentTypeChoiceLoader;
 use Symfony\Component\Form\AbstractType;
-use Symfony\Component\Form\ChoiceList\Loader\CallbackChoiceLoader;
 use Symfony\Component\Form\Extension\Core\Type\ChoiceType;
 use Symfony\Component\OptionsResolver\OptionsResolver;
 
@@ -23,19 +22,19 @@ class ContentTypeChoiceType extends AbstractType
     /** @var \eZ\Publish\API\Repository\ContentTypeService */
     protected $contentTypeService;
 
-    /** @var \EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\ContentTypeChoiceListProvider */
-    private $contentTypeChoiceListProvider;
+    /** @var \EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Loader\ContentTypeChoiceLoader */
+    private $contentTypeChoiceLoader;
 
     /**
      * @param \eZ\Publish\API\Repository\ContentTypeService $contentTypeService
-     * @param \EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\ContentTypeChoiceListProvider $contentTypeChoiceListProvider
+     * @param \EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Loader\ContentTypeChoiceLoader $contentTypeChoiceLoader
      */
     public function __construct(
         ContentTypeService $contentTypeService,
-        ContentTypeChoiceListProvider $contentTypeChoiceListProvider
+        ContentTypeChoiceLoader $contentTypeChoiceLoader
     ) {
         $this->contentTypeService = $contentTypeService;
-        $this->contentTypeChoiceListProvider = $contentTypeChoiceListProvider;
+        $this->contentTypeChoiceLoader = $contentTypeChoiceLoader;
     }
 
     public function getParent()
@@ -47,7 +46,7 @@ public function configureOptions(OptionsResolver $resolver)
     {
         $resolver
             ->setDefaults([
-                'choice_loader' => new CallbackChoiceLoader([$this->contentTypeChoiceListProvider, 'getChoiceList']),
+                'choice_loader' => $this->contentTypeChoiceLoader,
                 'choice_label' => 'name',
                 'choice_name' => 'identifier',
                 'choice_value' => 'identifier',
diff --git a/src/lib/Form/Type/Language/LanguageChoiceType.php b/src/lib/Form/Type/Language/LanguageChoiceType.php
index b08c4952d0..590fd5944e 100644
--- a/src/lib/Form/Type/Language/LanguageChoiceType.php
+++ b/src/lib/Form/Type/Language/LanguageChoiceType.php
@@ -8,9 +8,8 @@
 
 namespace EzSystems\EzPlatformAdminUi\Form\Type\Language;
 
-use EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\LanguageChoiceListProvider;
+use EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Loader\LanguageChoiceLoader;
 use Symfony\Component\Form\AbstractType;
-use Symfony\Component\Form\ChoiceList\Loader\CallbackChoiceLoader;
 use Symfony\Component\Form\Extension\Core\Type\ChoiceType;
 use Symfony\Component\OptionsResolver\OptionsResolver;
 
@@ -21,15 +20,15 @@
  */
 class LanguageChoiceType extends AbstractType
 {
-    /** @var \EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\LanguageChoiceListProvider */
-    private $languageChoiceListProvider;
+    /** @var \EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Loader\LanguageChoiceLoader */
+    private $languageChoiceLoader;
 
     /**
-     * @param \EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Provider\LanguageChoiceListProvider $languageChoiceListProvider
+     * @param \EzSystems\EzPlatformAdminUi\Form\Type\ChoiceList\Loader\LanguageChoiceLoader $languageChoiceLoader
      */
-    public function __construct(LanguageChoiceListProvider $languageChoiceListProvider)
+    public function __construct(LanguageChoiceLoader $languageChoiceLoader)
     {
-        $this->languageChoiceListProvider = $languageChoiceListProvider;
+        $this->languageChoiceLoader = $languageChoiceLoader;
     }
 
     public function getParent()
@@ -41,7 +40,7 @@ public function configureOptions(OptionsResolver $resolver)
     {
         $resolver
             ->setDefaults([
-                'choice_loader' => new CallbackChoiceLoader([$this->languageChoiceListProvider, 'getChoiceList']),
+                'choice_loader' => $this->languageChoiceLoader,
                 'choice_label' => 'name',
                 'choice_name' => 'languageCode',
                 'choice_value' => 'languageCode',
diff --git a/src/lib/Permission/PermissionChecker.php b/src/lib/Permission/PermissionChecker.php
index b4380a9ac8..9c4d444137 100644
--- a/src/lib/Permission/PermissionChecker.php
+++ b/src/lib/Permission/PermissionChecker.php
@@ -22,7 +22,7 @@
 
 class PermissionChecker implements PermissionCheckerInterface
 {
-    private const USER_GROUPS_LIMIT = 1;
+    private const USER_GROUPS_LIMIT = 25;
 
     /** @var \eZ\Publish\API\Repository\PermissionResolver */
     private $permissionResolver;
@@ -81,6 +81,9 @@ public function getRestrictions($hasAccess, string $class): array
      * @param array|bool $hasAccess
      *
      * @return bool
+     *
+     * @throws \eZ\Publish\API\Repository\Exceptions\NotFoundException
+     * @throws \eZ\Publish\API\Repository\Exceptions\UnauthorizedException
      */
     public function canCreateInLocation(Location $location, $hasAccess): bool
     {
@@ -90,33 +93,57 @@ public function canCreateInLocation(Location $location, $hasAccess): bool
         $restrictedLocations = $this->getRestrictions($hasAccess, LocationLimitation::class);
         $canCreateInLocation = empty($restrictedLocations)
             ? true
-            : in_array($location->id, array_map('intval', $restrictedLocations), true);
+            : \in_array($location->id, array_map('intval', $restrictedLocations), true);
+
+        if (false === $canCreateInLocation) {
+            return false;
+        }
 
         $restrictedParentContentTypes = $this->getRestrictions($hasAccess, ParentContentTypeLimitation::class);
         $canCreateInParentContentType = empty($restrictedParentContentTypes)
             ? true
-            : in_array($location->contentInfo->contentTypeId, array_map('intval', $restrictedParentContentTypes), true);
+            : \in_array($location->contentInfo->contentTypeId, array_map('intval', $restrictedParentContentTypes), true);
+
+        if (false === $canCreateInParentContentType) {
+            return false;
+        }
 
         $restrictedParentDepths = $this->getRestrictions($hasAccess, ParentDepthLimitation::class);
         $canCreateInParentDepth = empty($restrictedParentDepths)
             ? true
-            : in_array($location->depth, array_map('intval', $restrictedParentDepths), true);
+            : \in_array($location->depth, array_map('intval', $restrictedParentDepths), true);
+
+        if (false === $canCreateInParentDepth) {
+            return false;
+        }
 
         $restrictedParentOwner = $this->getRestrictions($hasAccess, ParentOwnerLimitation::class);
         $canCreateInParentOwner = empty($restrictedParentOwner)
             ? true
             : $location->contentInfo->ownerId === $this->permissionResolver->getCurrentUserReference()->getUserId();
 
+        if (false === $canCreateInParentOwner) {
+            return false;
+        }
+
         $restrictedSections = $this->getRestrictions($hasAccess, SectionLimitation::class);
         $canCreateInSection = empty($restrictedSections)
             ? true
-            : in_array($location->contentInfo->sectionId, array_map('intval', $restrictedSections), true);
+            : \in_array($location->contentInfo->sectionId, array_map('intval', $restrictedSections), true);
+
+        if (false === $canCreateInSection) {
+            return false;
+        }
 
         $restrictedParentUserGroups = $this->getRestrictions($hasAccess, ParentUserGroupLimitation::class);
         $canCreateInParentUserGroup = empty($restrictedParentUserGroups)
             ? true
             : $this->hasSameParentUserGroup($location);
 
+        if (false === $canCreateInParentUserGroup) {
+            return false;
+        }
+
         $restrictedSubtrees = $this->getRestrictions($hasAccess, SubtreeLimitation::class);
         $canCreateInSubtree = empty($restrictedSubtrees)
             ? true
@@ -124,13 +151,11 @@ public function canCreateInLocation(Location $location, $hasAccess): bool
                 return strpos($location->pathString, $restrictedSubtree) === 0;
             }));
 
-        return $canCreateInParentContentType
-            && $canCreateInLocation
-            && $canCreateInParentDepth
-            && $canCreateInParentOwner
-            && $canCreateInSection
-            && $canCreateInSubtree
-            && $canCreateInParentUserGroup;
+        if (false === $canCreateInSubtree) {
+            return false;
+        }
+
+        return true;
     }
 
     /**
@@ -145,7 +170,7 @@ private function flattenArrayOfLimitationsForCurrentUser(array $hasAccess): arra
     {
         $currentUserId = $this->permissionResolver->getCurrentUserReference()->getUserId();
 
-        if (is_array($this->flattenArrayOfLimitations[$currentUserId])) {
+        if (\is_array($this->flattenArrayOfLimitations[$currentUserId])) {
             return $this->flattenArrayOfLimitations[$currentUserId];
         }
 
@@ -207,7 +232,7 @@ private function loadAllUserGroupsIdsOfUser(User $user): array
                 $allUserGroups[] = $userGroup->contentInfo->id;
             }
             $offset += self::USER_GROUPS_LIMIT;
-        } while (count($userGroups) === self::USER_GROUPS_LIMIT);
+        } while (\count($userGroups) === self::USER_GROUPS_LIMIT);
 
         return $allUserGroups;
     }
diff --git a/src/lib/UniversalDiscovery/Event/Subscriber/ContentCreate.php b/src/lib/UniversalDiscovery/Event/Subscriber/ContentCreate.php
index bfec364a4d..6f3f51e31d 100644
--- a/src/lib/UniversalDiscovery/Event/Subscriber/ContentCreate.php
+++ b/src/lib/UniversalDiscovery/Event/Subscriber/ContentCreate.php
@@ -12,6 +12,7 @@
 use eZ\Publish\API\Repository\Exceptions\NotFoundException;
 use eZ\Publish\API\Repository\PermissionResolver;
 use eZ\Publish\API\Repository\Values\User\Limitation\ContentTypeLimitation;
+use eZ\Publish\API\Repository\Values\User\Limitation\LanguageLimitation;
 use EzSystems\EzPlatformAdminUi\UniversalDiscovery\Event\ConfigResolveEvent;
 use EzSystems\EzPlatformAdminUi\Permission\PermissionCheckerInterface;
 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
@@ -21,6 +22,9 @@ class ContentCreate implements EventSubscriberInterface
     /** @var array */
     private $restrictedContentTypesIdentifiers;
 
+    /** @var array */
+    private $restrictedLanguagesCodes;
+
     /** @var \EzSystems\EzPlatformAdminUi\Permission\PermissionCheckerInterface */
     private $permissionChecker;
 
@@ -44,10 +48,11 @@ public function __construct(
 
         $hasAccess = $permissionResolver->hasAccess('content', 'create');
         $this->restrictedContentTypesIdentifiers = $this->getRestrictedContentTypesIdentifiers($hasAccess);
+        $this->restrictedLanguagesCodes = $this->getRestrictedLanguagesCodes($hasAccess);
     }
 
     /**
-     * @return array
+     * {@inheritdoc}
      */
     public static function getSubscribedEvents(): array
     {
@@ -79,6 +84,12 @@ public function onUdwConfigResolve(ConfigResolveEvent $event): void
             $config['content_on_the_fly']['allowed_content_types'] = $this->restrictedContentTypesIdentifiers;
             $event->setConfig($config);
         }
+
+        if ($this->hasLanguagesRestrictions()) {
+            $config = $event->getConfig();
+            $config['content_on_the_fly']['allowed_languages'] = $this->restrictedLanguagesCodes;
+            $event->setConfig($config);
+        }
     }
 
     /**
@@ -118,4 +129,32 @@ private function hasContentTypeRestrictions(): bool
     {
         return !empty($this->restrictedContentTypesIdentifiers);
     }
+
+    /**
+     * @param $hasAccess
+     *
+     * @return string[]
+     */
+    private function getRestrictedLanguagesCodes($hasAccess): array
+    {
+        if (!\is_array($hasAccess)) {
+            return [];
+        }
+
+        $restrictedLanguagesCodes = $this->permissionChecker->getRestrictions($hasAccess, LanguageLimitation::class);
+
+        if (empty($restrictedLanguagesCodes)) {
+            return [];
+        }
+
+        return $restrictedLanguagesCodes;
+    }
+
+    /**
+     * @return bool
+     */
+    private function hasLanguagesRestrictions(): bool
+    {
+        return !empty($this->restrictedLanguagesCodes);
+    }
 }

From b169ec93388237ea4ea0005800e27f80b3b7bbab Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miko=C5=82aj=20Adamczyk?= <mikadamczyk@gmail.com>
Date: Tue, 20 Nov 2018 08:35:52 +0100
Subject: [PATCH 5/5] EZP-29742: Implement permissions for Content/Create in
 Content item view - content create policy in UDW

---
 src/lib/Menu/LeftSidebarBuilder.php                           | 4 +++-
 src/lib/UniversalDiscovery/Event/Subscriber/ContentCreate.php | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/lib/Menu/LeftSidebarBuilder.php b/src/lib/Menu/LeftSidebarBuilder.php
index 2eb02b1094..586749ef76 100644
--- a/src/lib/Menu/LeftSidebarBuilder.php
+++ b/src/lib/Menu/LeftSidebarBuilder.php
@@ -93,7 +93,9 @@ public function createStructure(array $options): ItemInterface
                     'extras' => ['icon' => 'browse'],
                     'attributes' => [
                         'class' => 'btn--udw-browse',
-                        'data-udw-config' => $this->udwExtension->renderUniversalDiscoveryWidgetConfig('single'),
+                        'data-udw-config' => $this->udwExtension->renderUniversalDiscoveryWidgetConfig('single', [
+                            'type' => 'content_create',
+                        ]),
                         'data-starting-location-id' => $this->configResolver->getParameter(
                             'universal_discovery_widget_module.default_location_id'
                         ),
diff --git a/src/lib/UniversalDiscovery/Event/Subscriber/ContentCreate.php b/src/lib/UniversalDiscovery/Event/Subscriber/ContentCreate.php
index 6f3f51e31d..3146c8b552 100644
--- a/src/lib/UniversalDiscovery/Event/Subscriber/ContentCreate.php
+++ b/src/lib/UniversalDiscovery/Event/Subscriber/ContentCreate.php
@@ -67,7 +67,7 @@ public static function getSubscribedEvents(): array
     public function onUdwConfigResolve(ConfigResolveEvent $event): void
     {
         $configName = $event->getConfigName();
-        if ('create' !== $configName) {
+        if ('create' !== $configName && 'single' !== $configName) {
             return;
         }