diff --git a/packages/server/src/api/controllers/application.js b/packages/server/src/api/controllers/application.js index 24cd1cd3c7..c165955b8b 100644 --- a/packages/server/src/api/controllers/application.js +++ b/packages/server/src/api/controllers/application.js @@ -164,7 +164,15 @@ exports.fetchAppDefinition = async function (ctx) { exports.fetchAppPackage = async function (ctx) { const db = new CouchDB(ctx.params.appId) const application = await db.get(DocumentTypes.APP_METADATA) - const [layouts, screens] = await Promise.all([getLayouts(db), getScreens(db)]) + const layouts = await getLayouts(db) + let screens = await getScreens(db) + + // Only filter screens if the user is not a builder + if (!ctx.user.builder?.global) { + const userRoleId = getUserRoleId(ctx) + const accessController = new AccessController(ctx.params.appId) + screens = await accessController.checkScreensAccess(screens, userRoleId) + } ctx.body = { application,