From 6dac12e499f4f0b74f3ec3a5690ef3f4db4628db Mon Sep 17 00:00:00 2001
From: Thomas Kaul <4159106+dtslvr@users.noreply.github.com>
Date: Wed, 12 Aug 2026 14:08:49 +0200
Subject: [PATCH] Add scopes to access

---
 apps/api/src/app/access/access.controller.ts  | 33 ++++++++++---------
 .../user-account-access.component.ts          | 22 ++++++++-----
 libs/common/src/lib/dtos/create-access.dto.ts |  3 ++
 libs/common/src/lib/dtos/update-access.dto.ts |  3 ++
 .../src/lib/interfaces/access.interface.ts    |  6 ++++
 prisma/schema.prisma                          |  1 +
 6 files changed, 44 insertions(+), 24 deletions(-)

diff --git a/apps/api/src/app/access/access.controller.ts b/apps/api/src/app/access/access.controller.ts
index 6252055f0..f1c73231e 100644
--- a/apps/api/src/app/access/access.controller.ts
+++ b/apps/api/src/app/access/access.controller.ts
@@ -48,29 +48,32 @@ export class AccessController {
       where: { userId: this.request.user.id }
     });
 
-    return accessesWithGranteeUser.map(
-      ({ alias, granteeUser, id, permissions, settings }) => {
-        if (granteeUser) {
-          return {
-            alias,
-            id,
-            permissions,
-            grantee: granteeUser?.id,
-            settings: settings as AccessSettings,
-            type: 'PRIVATE'
-          };
-        }
+    return accessesWithGranteeUser.map((accessItem) => {
+      const { alias, granteeUser, id, permissions, settings } = accessItem;
+      const scopes = getScopesOfAccess(accessItem);
 
+      if (granteeUser) {
         return {
           alias,
           id,
           permissions,
-          grantee: 'Public',
+          scopes,
+          grantee: granteeUser?.id,
           settings: settings as AccessSettings,
-          type: 'PUBLIC'
+          type: 'PRIVATE'
         };
       }
-    );
+
+      return {
+        alias,
+        id,
+        permissions,
+        scopes,
+        grantee: 'Public',
+        settings: settings as AccessSettings,
+        type: 'PUBLIC'
+      };
+    });
   }
 
   @HasPermission(permissions.createAccess)
diff --git a/apps/client/src/app/components/user-account-access/user-account-access.component.ts b/apps/client/src/app/components/user-account-access/user-account-access.component.ts
index c9d74b6b1..4f468c945 100644
--- a/apps/client/src/app/components/user-account-access/user-account-access.component.ts
+++ b/apps/client/src/app/components/user-account-access/user-account-access.component.ts
@@ -229,6 +229,7 @@ export class GfUserAccountAccessComponent implements OnInit {
           grantee: access.grantee === 'Public' ? undefined : access.grantee,
           id: access.id,
           permissions: access.permissions,
+          scopes: access.scopes,
           settings: access.settings,
           type: access.type
         }
@@ -247,15 +248,18 @@ export class GfUserAccountAccessComponent implements OnInit {
   }
 
   private update() {
-    this.accessesGet = this.user.access.map(({ alias, id, permissions }) => {
-      return {
-        id,
-        permissions,
-        alias: alias ?? '',
-        grantee: $localize`Me`,
-        type: 'PRIVATE'
-      };
-    });
+    this.accessesGet = this.user.access.map(
+      ({ alias, id, permissions, scopes }) => {
+        return {
+          id,
+          permissions,
+          scopes,
+          alias: alias ?? '',
+          grantee: $localize`Me`,
+          type: 'PRIVATE'
+        };
+      }
+    );
 
     this.dataService
       .fetchAccesses()
diff --git a/libs/common/src/lib/dtos/create-access.dto.ts b/libs/common/src/lib/dtos/create-access.dto.ts
index d4ba94fd2..370b1a2f8 100644
--- a/libs/common/src/lib/dtos/create-access.dto.ts
+++ b/libs/common/src/lib/dtos/create-access.dto.ts
@@ -16,6 +16,9 @@ export class CreateAccessDto {
   @IsUUID()
   granteeUserId?: string;
 
+  /**
+   * @deprecated Use the scopes instead
+   */
   @IsEnum(AccessPermission, { each: true })
   @IsOptional()
   permissions?: AccessPermission[];
diff --git a/libs/common/src/lib/dtos/update-access.dto.ts b/libs/common/src/lib/dtos/update-access.dto.ts
index b5ed1db61..57d8fe9c0 100644
--- a/libs/common/src/lib/dtos/update-access.dto.ts
+++ b/libs/common/src/lib/dtos/update-access.dto.ts
@@ -19,6 +19,9 @@ export class UpdateAccessDto {
   @IsString()
   id: string;
 
+  /**
+   * @deprecated Use the scopes instead
+   */
   @IsEnum(AccessPermission, { each: true })
   @IsOptional()
   permissions?: AccessPermission[];
diff --git a/libs/common/src/lib/interfaces/access.interface.ts b/libs/common/src/lib/interfaces/access.interface.ts
index 6b361d0b9..819dc60eb 100644
--- a/libs/common/src/lib/interfaces/access.interface.ts
+++ b/libs/common/src/lib/interfaces/access.interface.ts
@@ -8,7 +8,13 @@ export interface Access {
   alias: string | null;
   grantee?: string;
   id: string;
+
+  /**
+   * @deprecated Use the scopes instead
+   */
   permissions: AccessPermission[];
+
+  scopes: string[];
   settings?: AccessSettings;
   type: AccessType;
 }
diff --git a/prisma/schema.prisma b/prisma/schema.prisma
index 27a7da0b2..5d37f0f2a 100644
--- a/prisma/schema.prisma
+++ b/prisma/schema.prisma
@@ -14,6 +14,7 @@ model Access {
   granteeUser   User?              @relation("accessGet", fields: [granteeUserId], onDelete: Cascade, references: [id])
   granteeUserId String?
   id            String             @id @default(uuid())
+  /// @deprecated Use the scopes instead
   permissions   AccessPermission[] @default([READ_RESTRICTED])
   scopes        String[]           @default([])
   settings      Json               @default("{}")