Restrict support for filtering to public access

apps/api/src/app/access/access.controller.ts

@@ -4,7 +4,10 @@ import { HasPermissionGuard } from '@ghostfolio/api/guards/has-permission.guard'
 import { ConfigurationService } from '@ghostfolio/api/services/configuration/configuration.service';
 import { CreateAccessDto, UpdateAccessDto } from '@ghostfolio/common/dtos';
 import { SubscriptionType } from '@ghostfolio/common/enums';
-import { isValidGranteeOfAccess } from '@ghostfolio/common/helper';
+import {
+  canApplyFiltersToAccess,
+  isValidGranteeOfAccess
+} from '@ghostfolio/common/helper';
 import { Access, AccessSettings } from '@ghostfolio/common/interfaces';
 import { permissions } from '@ghostfolio/common/permissions';
 import { getScopesOfAccess } from '@ghostfolio/common/scopes';
@@ -53,6 +56,8 @@ export class AccessController {
       const { alias, expiresAt, granteeUser, id, lastUsedAt, settings, type } =
         accessItem;
 
+      const { filters } = (settings ?? {}) as AccessSettings;
+
       return {
         alias,
         expiresAt,
@@ -61,7 +66,7 @@ export class AccessController {
         type,
         grantee: granteeUser?.id,
         scopes: getScopesOfAccess(accessItem),
-        settings: settings as AccessSettings
+        settings: canApplyFiltersToAccess({ type }) ? { filters } : {}
       };
     });
   }
@@ -104,6 +109,13 @@ export class AccessController {
       );
     }
 
+    if (data.filters?.length && !canApplyFiltersToAccess({ type })) {
+      throw new HttpException(
+        getReasonPhrase(StatusCodes.BAD_REQUEST),
+        StatusCodes.BAD_REQUEST
+      );
+    }
+
     try {
       return await this.accessService.createAccess({
         type,
@@ -116,10 +128,7 @@ export class AccessController {
           type,
           scopes: data.scopes
         }),
-        settings: this.accessService.buildSettings({
-          type,
-          filters: data.filters
-        }),
+        settings: this.accessService.buildSettings(data.filters),
         user: { connect: { id: this.request.user.id } }
       });
     } catch {
@@ -195,6 +204,16 @@ export class AccessController {
       );
     }
 
+    if (
+      data.filters?.length &&
+      !canApplyFiltersToAccess({ type: originalAccess.type })
+    ) {
+      throw new HttpException(
+        getReasonPhrase(StatusCodes.BAD_REQUEST),
+        StatusCodes.BAD_REQUEST
+      );
+    }
+
     try {
       return await this.accessService.updateAccess({
         data: {
@@ -207,10 +226,7 @@ export class AccessController {
             scopes: data.scopes ?? originalAccess.scopes,
             type: originalAccess.type
           }),
-          settings: this.accessService.buildSettings({
-            filters: data.filters,
-            type: originalAccess.type
-          })
+          settings: this.accessService.buildSettings(data.filters)
         },
         where: { id }
       });

apps/api/src/app/access/access.service.ts

@@ -3,7 +3,7 @@ import { AccessSettings, Filter } from '@ghostfolio/common/interfaces';
 import { AccessWithGranteeUser } from '@ghostfolio/common/types';
 
 import { Injectable } from '@nestjs/common';
-import { Access, AccessType, Prisma } from '@prisma/client';
+import { Access, Prisma } from '@prisma/client';
 import { isBefore, isToday, isValid } from 'date-fns';
 
 @Injectable()
@@ -41,15 +41,8 @@ export class AccessService {
     });
   }
 
-  public buildSettings({
-    filters,
-    type
-  }: {
-    filters?: Filter[];
-    type: AccessType;
-  }) {
-    const settings: AccessSettings =
-      type === 'PUBLIC' && filters?.length ? { filters } : {};
+  public buildSettings(filters?: Filter[]) {
+    const settings: AccessSettings = filters?.length ? { filters } : {};
 
     return settings as Prisma.InputJsonValue;
   }

apps/client/src/app/components/user-account-access/create-or-update-access-dialog/create-or-update-access-dialog.component.ts

@@ -1,6 +1,7 @@
 import { UserService } from '@ghostfolio/client/services/user/user.service';
 import { DEFAULT_LOCALE } from '@ghostfolio/common/config';
 import { CreateAccessDto, UpdateAccessDto } from '@ghostfolio/common/dtos';
+import { canApplyFiltersToAccess } from '@ghostfolio/common/helper';
 import { Filter, PortfolioPosition } from '@ghostfolio/common/interfaces';
 import { hasPermission, permissions } from '@ghostfolio/common/permissions';
 import {
@@ -52,6 +53,7 @@ import {
 import { MatFormFieldModule } from '@angular/material/form-field';
 import { MatInputModule } from '@angular/material/input';
 import { MatSelectModule } from '@angular/material/select';
+import { AccessType } from '@prisma/client';
 import { addYears, endOfDay, isBefore, isValid, startOfDay } from 'date-fns';
 import { StatusCodes } from 'http-status-codes';
 import { EMPTY, catchError } from 'rxjs';
@@ -112,7 +114,10 @@ export class GfCreateOrUpdateAccessDialogComponent implements OnInit {
   }
 
   public get canApplyFilters() {
-    return this.isPublicAccess && this.hasExperimentalFeatures;
+    return (
+      canApplyFiltersToAccess({ type: this.accessType }) &&
+      this.hasExperimentalFeatures
+    );
   }
 
   public get canGrantMcpAccess() {
@@ -177,7 +182,7 @@ export class GfCreateOrUpdateAccessDialogComponent implements OnInit {
     this.accessForm
       .get('type')
       ?.valueChanges.pipe(takeUntilDestroyed(this.destroyRef))
-      .subscribe((accessType) => {
+      .subscribe((accessType: AccessType) => {
         const granteeUserIdControl = this.accessForm.get('granteeUserId');
 
         if (accessType === 'PRIVATE') {
@@ -191,8 +196,7 @@ export class GfCreateOrUpdateAccessDialogComponent implements OnInit {
           this.accessForm.get('accessLevel')?.setValue('READ_RESTRICTED');
         }
 
-        if (accessType !== 'PUBLIC') {
-          // Only a public access can be limited to a part of the portfolio
+        if (!canApplyFiltersToAccess({ type: accessType })) {
           this.accessForm.get('filters')?.setValue(null);
         }
 
@@ -208,8 +212,12 @@ export class GfCreateOrUpdateAccessDialogComponent implements OnInit {
     return this.accessForm?.get('accessLevel')?.value as AccessLevel;
   }
 
+  protected get accessType(): AccessType {
+    return this.accessForm?.get('type')?.value as AccessType;
+  }
+
   protected get isPublicAccess() {
-    return this.accessForm?.get('type')?.value === 'PUBLIC';
+    return this.accessType === 'PUBLIC';
   }
 
   protected get showExpiresAtErrorMessage() {

libs/common/src/lib/helper.spec.ts

@@ -3,6 +3,7 @@ import {
   TAG_ID_EXCLUDE_FROM_ANALYSIS
 } from '@ghostfolio/common/config';
 import {
+  canApplyFiltersToAccess,
   extractNumberFromString,
   getCountryCodeFromCurrency,
   getNumberFormatGroup,
@@ -19,6 +20,20 @@ import {
 import { UserSettings } from '@ghostfolio/common/interfaces';
 
 describe('Helper', () => {
+  describe('Can apply filters to access', () => {
+    it('An access of the model context protocol', () => {
+      expect(canApplyFiltersToAccess({ type: 'MCP' })).toEqual(false);
+    });
+
+    it('A private access', () => {
+      expect(canApplyFiltersToAccess({ type: 'PRIVATE' })).toEqual(false);
+    });
+
+    it('A public access', () => {
+      expect(canApplyFiltersToAccess({ type: 'PUBLIC' })).toEqual(true);
+    });
+  });
+
   describe('Extract number from string', () => {
     it('Get decimal number', () => {
       expect(extractNumberFromString({ value: '999.99' })).toEqual(999.99);

libs/common/src/lib/helper.ts

@@ -174,6 +174,10 @@ export function calculateMovingAverage({
     .toNumber();
 }
 
+export function canApplyFiltersToAccess({ type }: { type: AccessType }) {
+  return type === 'PUBLIC';
+}
+
 export function canDeleteAssetProfile({
   activitiesCount,
   isBenchmark,