BUGFIX: Ensure cache flushing for asset changes works with foreign workspaces

[mficzel]

If metadata of assets that are already used in workspaces the current user has no access to is changed the AssetChangeHandlerForCacheFlushing yields an exception Read access denied for workspace ....

This is fixed by flushing the caches inside inside a securityContext->withoutAuthorizationChecks closure.

Resolves: #5414

Upgrade instructions

Review instructions

Checklist

• Code follows the PSR-2 coding style
• Tests have been created, run and adjusted as needed
• The PR is created against the lowest maintained branch
• Reviewer - PR Title is brief but complete and starts with FEATURE|TASK|BUGFIX
• Reviewer - The first section explains the change briefly for change-logs
• Reviewer - Breaking Changes are marked with !!! and have upgrade-instructions

[mficzel]

While this solves the problem from #5414 i am not sure wether and how to test this.

[dlubitz]

Thank you. Works as expected.

[dlubitz]

AFAIS the ContentRepositorySecurityTrait provides some helper for testing this. I gueess we need to extend some AssetUsage tests with an authenticated user and enabled contentrepository security.

neos-development-collection/Neos.Neos/Tests/Behavior/Features/Bootstrap/ContentRepositorySecurityTrait.php

Line 35 in e339da0

trait ContentRepositorySecurityTrait

See example:

neos-development-collection/Neos.Neos/Tests/Behavior/Features/ContentRepository/Security/WorkspacePermissions.feature

Lines 54 to 57 in e339da0

	When content repository security is enabled
	And the shared workspace "shared-workspace" is created with the target workspace "live" and role assignments:
	| Role | Type | Value |
	| COLLABORATOR | GROUP | Neos.Neos:AbstractEditor |

[mhsdesign]

jup using the withoutAuthorizationChecks is the way for now ... if this would have been triggered by a catchup hook we could use the ContentRepositoryReadModel directly (which ignored security) which is here not the case ... but just for reference: #5328

---

still if the time allows i think a test would be neat ^^ we seem to have steps like Then the asset "an-asset-to-change" has the title "First changed asset" already in place, but its not that critical either i guess?

[nezaniel]

lgtm