Plugin development: how can I check if user has the permissions to delete only his own assets?
Thanks to @RobinSchambach advices, I was able to find a safe solution to handle this permission problematic.

This is possible using two main addings:


Register a new custom permission from the plugin


This prevents user from be able to access other users assets

Add a custom User field on the assets to assign ownership ;


Using this we can verify that it was uploaded from user requesting the file deletion



In the plugin Service:

public function linkUserToAssets($assets = [])
{
    $currentUser = Craft::$app-&gt;getUser()-&gt;getIdentity();
    if ($currentUser &amp;&amp; Craft::$app-&gt;request-&gt;getIsSiteRequest()
        &amp;&amp; Craft::$app-&gt;request-&gt;getIsPost()) {
        foreach ($assets-&gt;all() as $asset) {
            if (isset($asset-&gt;id) &amp;&amp; !empty($asset-&gt;id)) {
                $asset = Craft::$app-&gt;assets-&gt;getAssetById($asset-&gt;id);
                if (isset($asset-&gt;assetsOwner)) {
                    $asset-&gt;assetsOwner = [$currentUser-&gt;id];
                    Craft::$app-&gt;elements-&gt;saveElement($asset);
                }
            }
        }
    }
}


This adds a function to call before each entry is saved, to assign the user's ownership on entry's assets using the assetsOwner custom field.

In the plugin Module:

Event::on(
    UserPermissions::class,
    UserPermissions::EVENT_REGISTER_PERMISSIONS,
    function(RegisterUserPermissionsEvent $event) {
        $event-&gt;permissions['User'] = [
            'deleteOwnAssets' =&gt; [
                'label' =&gt; 'Delete Own Assets'
            ],
        ];
    }
);


This adds a custom permission in the CP which should be added to group of users who will perform this action.

In the plugin Controller:

public function actionDeleteAsset()
{
    $currentUser = Craft::$app-&gt;getUser()-&gt;getIdentity();
    if ($currentUser) {
        $request = Craft::$app-&gt;getRequest();
        $assetId = $request-&gt;getBodyParam('assetId');
        $asset = Craft::$app-&gt;getAssets()-&gt;getAssetById($assetId);

        if ($asset-&gt;assetsOwner[0]-&gt;id !== $currentUser-&gt;id || !Craft::$app-&gt;user-&gt;checkPermission('deleteOwnAssets')) {
            return $this-&gt;asErrorJson(Craft::t('app', self::TEXT_PERMISSION_REQUIRED));
        }
    }
}


This deletes requested assets if the current user was the owner of the asset (using assetsOwner custom field) and has the required custom permission (in this case, deleteOwnAssets).