Security issue: Row-level Predicate Policy avoids restrictions of Create action

[vfadeevGit]

Environment

Jmix version: <2.2.2>

Bug Description

After implementing Row-level role predicate policy for a dedicated Entity which avoids all actions (Create, Read, Update, Delete) for the user, who has got all Resource-level permissions on the same Entity -> Jmix blocks all buttons in runtime except Create.

Steps To Reproduce

1. Create a Resource-level with all permissions for the Entity
2. Create a Row-level Predicate Policy avoiding all actions for the same Entity like the following:

@RowLevelRole(name = "TankRestriction", code = TankRestrictionRole.CODE)
public interface TankRestrictionRole {
    String CODE = "tank-restriction";

    @PredicateRowLevelPolicy(entityClass = Tank.class, 
            actions = {RowLevelPolicyAction.READ, RowLevelPolicyAction.CREATE, RowLevelPolicyAction.UPDATE, RowLevelPolicyAction.DELETE})
    default RowLevelBiPredicate<Tank, ApplicationContext> tankPredicate() {
        return (tank, applicationContext) -> {
            return false;
        };
    }
}

3. Assign both roles in runtime for some user
4. Login under this user and open the list view of the Entity
5. All buttons will be disabled except Create

Expected Behavior

All buttons should be blocked

[glebfox]

RowLevelPolicyAction.CREATE cannot be applied to CreateAction because it creates a new entity and opens it in a detail view, i.e. there is nothing to check yet. In other words RowLevelPolicyAction.CREATE checks commit attempt instead of creating a new Java instance.