diff --git a/src/Api/Vault/AuthorizationHandlers/CollectionAuthorizationHandler.cs b/src/Api/Vault/AuthorizationHandlers/CollectionAuthorizationHandler.cs index 5434332a6d..68c382d355 100644 --- a/src/Api/Vault/AuthorizationHandlers/CollectionAuthorizationHandler.cs +++ b/src/Api/Vault/AuthorizationHandlers/CollectionAuthorizationHandler.cs @@ -71,10 +71,17 @@ public class CollectionAuthorizationHandler : BulkAuthorizationHandler c.Manage && c.OrganizationId == targetOrganizationId) + .Where(c => c.OrganizationId == targetOrganizationId) .Select(c => c.Id) .ToHashSet(); diff --git a/src/Infrastructure.EntityFramework/Repositories/CollectionRepository.cs b/src/Infrastructure.EntityFramework/Repositories/CollectionRepository.cs index b877d3f671..8a16f9168f 100644 --- a/src/Infrastructure.EntityFramework/Repositories/CollectionRepository.cs +++ b/src/Infrastructure.EntityFramework/Repositories/CollectionRepository.cs @@ -491,7 +491,6 @@ public class CollectionRepository : Repository sutProvider, ICollection collections, - ICollection collectionDetails, - CurrentContentOrganization organization) + IList collectionDetails, + CurrentContextOrganization organization) { var actingUserId = Guid.NewGuid(); - foreach (var collectionDetail in collectionDetails) + + if (!manageAssignedCollections) { - collectionDetail.Manage = manageCollections; + // Simulate the user not being assigned to a collection + collectionDetails.RemoveAt(0); + organization.Permissions.EditAssignedCollections = false; } organization.Type = userType; @@ -102,7 +105,7 @@ public class CollectionAuthorizationHandlerTests public async Task CanManageCollectionAccessAsync_MissingOrgMembership_Failure( SutProvider sutProvider, ICollection collections, - CurrentContentOrganization organization) + CurrentContextOrganization organization) { var actingUserId = Guid.NewGuid(); @@ -128,17 +131,14 @@ public class CollectionAuthorizationHandlerTests public async Task CanManageCollectionAccessAsync_MissingManageCollectionPermission_Failure( SutProvider sutProvider, ICollection collections, - ICollection collectionDetails, - CurrentContentOrganization organization) + IList collectionDetails, + CurrentContextOrganization organization) { var actingUserId = Guid.NewGuid(); - foreach (var collectionDetail in collectionDetails) - { - collectionDetail.Manage = true; - } - // Simulate one collection missing the manage permission - collectionDetails.First().Manage = false; + // Simulate the user not being assigned to a collection + collectionDetails.RemoveAt(0); + organization.Permissions.EditAssignedCollections = true; // Ensure the user is not an owner/admin and does not have edit any collection permission organization.Type = OrganizationUserType.User; diff --git a/test/Core.Test/OrganizationFeatures/OrganizationCollections/BulkAddCollectionAccessCommandTests.cs b/test/Core.Test/OrganizationFeatures/OrganizationCollections/BulkAddCollectionAccessCommandTests.cs index 6a0a6de462..a6d7da8cf8 100644 --- a/test/Core.Test/OrganizationFeatures/OrganizationCollections/BulkAddCollectionAccessCommandTests.cs +++ b/test/Core.Test/OrganizationFeatures/OrganizationCollections/BulkAddCollectionAccessCommandTests.cs @@ -228,7 +228,6 @@ public class BulkAddCollectionAccessCommandTests return collectionUsers.Select(cu => new CollectionAccessSelection { Id = cu.OrganizationUserId, - Manage = cu.Manage, HidePasswords = cu.HidePasswords, ReadOnly = cu.ReadOnly }).ToList(); @@ -238,7 +237,6 @@ public class BulkAddCollectionAccessCommandTests return collectionGroups.Select(cg => new CollectionAccessSelection { Id = cg.GroupId, - Manage = cg.Manage, HidePasswords = cg.HidePasswords, ReadOnly = cg.ReadOnly }).ToList(); diff --git a/test/Core.Test/Vault/AutoFixture/CollectionFixture.cs b/test/Core.Test/Vault/AutoFixture/CollectionFixture.cs index 8ae819066a..3a84d3438f 100644 --- a/test/Core.Test/Vault/AutoFixture/CollectionFixture.cs +++ b/test/Core.Test/Vault/AutoFixture/CollectionFixture.cs @@ -20,7 +20,7 @@ public class CollectionCustomization : ICustomization fixture.Customize(composer => composer .With(o => o.Id, orgId)); - fixture.Customize(composer => composer + fixture.Customize(composer => composer .With(o => o.Id, orgId)); fixture.Customize(composer => composer diff --git a/util/Migrator/DbScripts/2023-08-25_00_BulkAddCollectionAccess.sql b/util/Migrator/DbScripts/2023-08-25_00_BulkAddCollectionAccess.sql index 254fe628f6..e9ba2b167e 100644 --- a/util/Migrator/DbScripts/2023-08-25_00_BulkAddCollectionAccess.sql +++ b/util/Migrator/DbScripts/2023-08-25_00_BulkAddCollectionAccess.sql @@ -50,8 +50,7 @@ BEGIN cId.[Id] AS [CollectionId], gu.[Id] AS [GroupId], gu.[ReadOnly], - gu.[HidePasswords], - gu.[Manage] + gu.[HidePasswords] FROM @Groups AS gu CROSS JOIN @@ -69,21 +68,19 @@ BEGIN [Target].[CollectionId] = [Source].[CollectionId] AND [Target].[GroupId] = [Source].[GroupId] WHEN MATCHED AND EXISTS( - SELECT [Source].[ReadOnly], [Source].[HidePasswords], [Source].[Manage] + SELECT [Source].[ReadOnly], [Source].[HidePasswords] EXCEPT - SELECT [Target].[ReadOnly], [Target].[HidePasswords], [Target].[Manage] + SELECT [Target].[ReadOnly], [Target].[HidePasswords] ) THEN UPDATE SET [Target].[ReadOnly] = [Source].[ReadOnly], - [Target].[HidePasswords] = [Source].[HidePasswords], - [Target].[Manage] = [Source].[Manage] + [Target].[HidePasswords] = [Source].[HidePasswords] WHEN NOT MATCHED BY TARGET THEN INSERT VALUES ( [Source].[CollectionId], [Source].[GroupId], [Source].[ReadOnly], - [Source].[HidePasswords], - [Source].[Manage] + [Source].[HidePasswords] ); -- Users @@ -92,8 +89,7 @@ BEGIN cId.[Id] AS [CollectionId], cu.[Id] AS [OrganizationUserId], cu.[ReadOnly], - cu.[HidePasswords], - cu.[Manage] + cu.[HidePasswords] FROM @Users AS cu CROSS JOIN @@ -111,21 +107,19 @@ BEGIN [Target].[CollectionId] = [Source].[CollectionId] AND [Target].[OrganizationUserId] = [Source].[OrganizationUserId] WHEN MATCHED AND EXISTS( - SELECT [Source].[ReadOnly], [Source].[HidePasswords], [Source].[Manage] + SELECT [Source].[ReadOnly], [Source].[HidePasswords] EXCEPT - SELECT [Target].[ReadOnly], [Target].[HidePasswords], [Target].[Manage] + SELECT [Target].[ReadOnly], [Target].[HidePasswords] ) THEN UPDATE SET [Target].[ReadOnly] = [Source].[ReadOnly], - [Target].[HidePasswords] = [Source].[HidePasswords], - [Target].[Manage] = [Source].[Manage] + [Target].[HidePasswords] = [Source].[HidePasswords] WHEN NOT MATCHED BY TARGET THEN INSERT VALUES ( [Source].[CollectionId], [Source].[OrganizationUserId], [Source].[ReadOnly], - [Source].[HidePasswords], - [Source].[Manage] + [Source].[HidePasswords] ); EXEC [dbo].[User_BumpAccountRevisionDateByCollectionIds] @CollectionIds, @OrganizationId