From cc4e0a05243e71b50abda4f18fdba2cc11a7aa37 Mon Sep 17 00:00:00 2001
From: Thomas Kaul <4159106+dtslvr@users.noreply.github.com>
Date: Thu, 20 Aug 2026 08:01:05 +0200
Subject: [PATCH] Remove deprecated permissions attribute of access

---
 ...reate-or-update-access-dialog.component.ts | 20 +++++++++----------
 libs/common/src/lib/dtos/create-access.dto.ts |  1 +
 libs/common/src/lib/dtos/update-access.dto.ts |  1 +
 .../src/lib/interfaces/access.interface.ts    |  1 -
 libs/common/src/lib/scopes.spec.ts            | 13 ++++++++++++
 libs/common/src/lib/scopes.ts                 | 11 +++++++---
 6 files changed, 33 insertions(+), 14 deletions(-)

diff --git a/apps/client/src/app/components/user-account-access/create-or-update-access-dialog/create-or-update-access-dialog.component.ts b/apps/client/src/app/components/user-account-access/create-or-update-access-dialog/create-or-update-access-dialog.component.ts
index dfd56bdfb..35ca5ae34 100644
--- a/apps/client/src/app/components/user-account-access/create-or-update-access-dialog/create-or-update-access-dialog.component.ts
+++ b/apps/client/src/app/components/user-account-access/create-or-update-access-dialog/create-or-update-access-dialog.component.ts
@@ -116,10 +116,10 @@ export class GfCreateOrUpdateAccessDialogComponent implements OnInit {
         access?.grantee ?? null,
         isPublic ? null : Validators.required
       ],
-      hasScopeToReadValues: [
-        hasScope(access?.scopes, scopes.portfolioReadValues),
-        Validators.required
-      ],
+      hasScopeToReadValues: hasScope(
+        access?.scopes,
+        scopes.portfolioReadValues
+      ),
       type: [
         { disabled: this.mode === 'update', value: access?.type ?? 'PRIVATE' },
         Validators.required
@@ -178,6 +178,12 @@ export class GfCreateOrUpdateAccessDialogComponent implements OnInit {
     }
   }
 
+  private buildFilters(): Filter[] {
+    return getFiltersFromPortfolioFilterFormValue(
+      this.accessForm.get('filters')?.value
+    );
+  }
+
   // The dialog offers the read access only. The write scopes are not granted
   // here yet.
   private buildScopes() {
@@ -188,12 +194,6 @@ export class GfCreateOrUpdateAccessDialogComponent implements OnInit {
     ];
   }
 
-  private buildFilters(): Filter[] {
-    return getFiltersFromPortfolioFilterFormValue(
-      this.accessForm.get('filters')?.value
-    );
-  }
-
   private async createAccess() {
     const filters = this.buildFilters();
 
diff --git a/libs/common/src/lib/dtos/create-access.dto.ts b/libs/common/src/lib/dtos/create-access.dto.ts
index 9b8b9f108..abfaa30a4 100644
--- a/libs/common/src/lib/dtos/create-access.dto.ts
+++ b/libs/common/src/lib/dtos/create-access.dto.ts
@@ -16,6 +16,7 @@ export class CreateAccessDto {
   @IsUUID()
   granteeUserId?: string;
 
+  @IsArray()
   @IsIn(Object.values(scopes), { each: true })
   @IsOptional()
   scopes?: Scope[];
diff --git a/libs/common/src/lib/dtos/update-access.dto.ts b/libs/common/src/lib/dtos/update-access.dto.ts
index 3c3e339b1..c96294fc4 100644
--- a/libs/common/src/lib/dtos/update-access.dto.ts
+++ b/libs/common/src/lib/dtos/update-access.dto.ts
@@ -19,6 +19,7 @@ export class UpdateAccessDto {
   @IsString()
   id: string;
 
+  @IsArray()
   @IsIn(Object.values(scopes), { each: true })
   @IsOptional()
   scopes?: Scope[];
diff --git a/libs/common/src/lib/interfaces/access.interface.ts b/libs/common/src/lib/interfaces/access.interface.ts
index 53613e6df..54ddaecfd 100644
--- a/libs/common/src/lib/interfaces/access.interface.ts
+++ b/libs/common/src/lib/interfaces/access.interface.ts
@@ -6,7 +6,6 @@ export interface Access {
   alias: string | null;
   grantee?: string;
   id: string;
-
   scopes: string[];
   settings?: AccessSettings;
   type: AccessType;
diff --git a/libs/common/src/lib/scopes.spec.ts b/libs/common/src/lib/scopes.spec.ts
index 97015863a..c19e0ffbb 100644
--- a/libs/common/src/lib/scopes.spec.ts
+++ b/libs/common/src/lib/scopes.spec.ts
@@ -81,6 +81,19 @@ describe('Scopes', () => {
         })
       ).toEqual([]);
     });
+
+    // TODO: Remove this expectation once the dialog allows to configure the
+    // write scopes
+    it('Gives no write scope', () => {
+      const scopesOfAccess = getScopesOfAccess({
+        granteeUserId: 'ffb08949-2f8a-4b6e-88fd-0f1e6b6b5f5d',
+        scopes: [...SCOPES_OF_READ_ACCESS, ...SCOPES_OF_WRITE_ACCESS]
+      });
+
+      for (const scope of SCOPES_OF_WRITE_ACCESS) {
+        expect(scopesOfAccess).not.toContain(scope);
+      }
+    });
   });
 
   describe('Get scopes of public access', () => {
diff --git a/libs/common/src/lib/scopes.ts b/libs/common/src/lib/scopes.ts
index 406d41873..2c0a07e34 100644
--- a/libs/common/src/lib/scopes.ts
+++ b/libs/common/src/lib/scopes.ts
@@ -59,19 +59,24 @@ export const SCOPES_OF_READ_RESTRICTED_ACCESS: readonly Scope[] =
 
 export function getScopesOfAccess({
   granteeUserId,
-  scopes: scopesOfAccess = []
+  scopes: scopesOfAccess
 }: {
   granteeUserId?: string | null;
   scopes?: string[];
 }): string[] {
+  const scopesToEvaluate = scopesOfAccess ?? [];
+
   if (granteeUserId) {
-    return [...scopesOfAccess];
+    // TODO: Permit the write scopes once the dialog allows to configure them
+    return SCOPES_OF_READ_ACCESS.filter((scope) => {
+      return scopesToEvaluate.includes(scope);
+    });
   }
 
   // An access which has not been granted to a user is public, hence it is
   // narrowed to the scopes exposed by the public endpoints
   return SCOPES_OF_PUBLIC_ACCESS.filter((scope) => {
-    return scopesOfAccess.includes(scope);
+    return scopesToEvaluate.includes(scope);
   });
 }