Restrict restricted view and manage permission to MCP

apps/client/src/app/components/user-account-access/create-or-update-access-dialog/create-or-update-access-dialog.component.ts

@@ -195,7 +195,9 @@ export class GfCreateOrUpdateAccessDialogComponent implements OnInit {
 
         // Narrow the permission to the scopes which the type permits, because
         // an access which is not granted to a user never exposes the monetary
-        // values and a public access never changes data
+        // values and a public access never changes data. The type PRIVATE has
+        // no restricted write level, hence the permission to change the data
+        // exposes the monetary values
         const accessLevelOfType = getAccessLevel(
           getScopesOfAccess({
             scopes: getScopesOfAccessLevel(this.accessLevel),
@@ -207,7 +209,7 @@ export class GfCreateOrUpdateAccessDialogComponent implements OnInit {
           .get('accessLevel')
           ?.setValue(
             accessType === 'PRIVATE' &&
-              accessLevelOfType === 'CREATE_READ_RESTRICTED_UPDATE_DELETE'
+              this.accessLevel === 'CREATE_READ_RESTRICTED_UPDATE_DELETE'
               ? 'CREATE_READ_UPDATE_DELETE'
               : accessLevelOfType
           );

libs/common/src/lib/scopes.ts

@@ -96,9 +96,18 @@ export function getScopesOfAccess({
 }): string[] {
   const scopesToEvaluate = scopesOfAccess ?? [];
 
+  // The type PRIVATE has no restricted write level, hence a write scope stays
+  // ineffective without the scope to read the monetary values
+  const permitsWriteAccess =
+    type !== 'PRIVATE' ||
+    hasScope(scopesToEvaluate, scopes.portfolioReadValues);
+
   // An unknown scope is dropped
   return SCOPES_OF_TYPE[type].filter((scope) => {
-    return scopesToEvaluate.includes(scope);
+    return (
+      scopesToEvaluate.includes(scope) &&
+      (permitsWriteAccess || !SCOPES_OF_WRITE_ACCESS.includes(scope))
+    );
   });
 }