From 26bc8bd48c67b4c9fe03346382aef5f63d1ca269 Mon Sep 17 00:00:00 2001
From: Thomas Kaul <4159106+dtslvr@users.noreply.github.com>
Date: Tue, 1 Sep 2026 08:39:46 +0200
Subject: [PATCH] Restrict restricted view and manage permission to MCP

---
 ...reate-or-update-access-dialog.component.ts | 21 ++++++++++++-------
 .../create-or-update-access-dialog.html       |  2 +-
 2 files changed, 15 insertions(+), 8 deletions(-)

diff --git a/apps/client/src/app/components/user-account-access/create-or-update-access-dialog/create-or-update-access-dialog.component.ts b/apps/client/src/app/components/user-account-access/create-or-update-access-dialog/create-or-update-access-dialog.component.ts
index b0be5c0c52..16ca38fa68 100644
--- a/apps/client/src/app/components/user-account-access/create-or-update-access-dialog/create-or-update-access-dialog.component.ts
+++ b/apps/client/src/app/components/user-account-access/create-or-update-access-dialog/create-or-update-access-dialog.component.ts
@@ -196,15 +196,22 @@ export class GfCreateOrUpdateAccessDialogComponent implements OnInit {
         // Narrow the permission to the scopes which the type permits, because
         // an access which is not granted to a user never exposes the monetary
         // values and a public access never changes data
-        this.accessForm.get('accessLevel')?.setValue(
-          getAccessLevel(
-            getScopesOfAccess({
-              scopes: getScopesOfAccessLevel(this.accessLevel),
-              type: accessType
-            })
-          )
+        const accessLevelOfType = getAccessLevel(
+          getScopesOfAccess({
+            scopes: getScopesOfAccessLevel(this.accessLevel),
+            type: accessType
+          })
         );
 
+        this.accessForm
+          .get('accessLevel')
+          ?.setValue(
+            accessType === 'PRIVATE' &&
+              accessLevelOfType === 'CREATE_READ_RESTRICTED_UPDATE_DELETE'
+              ? 'CREATE_READ_UPDATE_DELETE'
+              : accessLevelOfType
+          );
+
         if (!canApplyFiltersToAccess({ type: accessType })) {
           this.accessForm.get('filters')?.setValue(null);
         }
diff --git a/apps/client/src/app/components/user-account-access/create-or-update-access-dialog/create-or-update-access-dialog.html b/apps/client/src/app/components/user-account-access/create-or-update-access-dialog/create-or-update-access-dialog.html
index 89893e5708..eb8964d469 100644
--- a/apps/client/src/app/components/user-account-access/create-or-update-access-dialog/create-or-update-access-dialog.html
+++ b/apps/client/src/app/components/user-account-access/create-or-update-access-dialog/create-or-update-access-dialog.html
@@ -82,7 +82,7 @@
           <mat-option value="READ_RESTRICTED">
             <gf-access-level-icon accessLevel="READ_RESTRICTED" />
           </mat-option>
-          @if (!isPublicAccess) {
+          @if (accessForm.get('type')?.value === 'MCP') {
             <mat-option
               value="CREATE_READ_RESTRICTED_UPDATE_DELETE"
               [disabled]="!canGrantWriteAccess"