Check if a specific role has read access to an item

Question

Is there a way to check if a specific user role has been granted read permission to a specific item?

I've tried using item.Security.CanRead(role) but to no success (this returns true when I'd expect false).

Edit:

May have been a bit premature with this, I seem to be able to achieve it with;

foreach(var role in roles)
{
    var accessRules = item.Security.GetAccessRules();
    foreach (var accessRule in accessRules)
    {
        if (accessRule.Account == role && accessRule.AccessRight == Sitecore.Security.AccessControl.AccessRight.ItemRead)
        {
            return true;
        }
    }
}

but any more succient methods would be good!

Answer 1

The code you pasted above is incorrect. It doesn't check roles inheritance.

item.Security.CanRead(role) method is exactly what you're looking for.

If it returns you true when you expect it to return false, most probably you should check:

• AccessViewer application and see why that role has read access to the item
• role inheritance - maybe one of the base roles has read access granted
• check if your code is not used in SecurityDisabler context