From eaac51f23d151fcc64ea31671dd5136906b76ad5 Mon Sep 17 00:00:00 2001 From: Thomas Kaul <4159106+dtslvr@users.noreply.github.com> Date: Tue, 1 Sep 2026 09:09:11 +0200 Subject: [PATCH] Restrict restricted view and manage permission to MCP --- .../create-or-update-access-dialog.component.ts | 6 ++++-- libs/common/src/lib/scopes.ts | 11 ++++++++++- 2 files changed, 14 insertions(+), 3 deletions(-) diff --git a/apps/client/src/app/components/user-account-access/create-or-update-access-dialog/create-or-update-access-dialog.component.ts b/apps/client/src/app/components/user-account-access/create-or-update-access-dialog/create-or-update-access-dialog.component.ts index 16ca38fa68..fa543974ab 100644 --- a/apps/client/src/app/components/user-account-access/create-or-update-access-dialog/create-or-update-access-dialog.component.ts +++ b/apps/client/src/app/components/user-account-access/create-or-update-access-dialog/create-or-update-access-dialog.component.ts @@ -195,7 +195,9 @@ export class GfCreateOrUpdateAccessDialogComponent implements OnInit { // Narrow the permission to the scopes which the type permits, because // an access which is not granted to a user never exposes the monetary - // values and a public access never changes data + // values and a public access never changes data. The type PRIVATE has + // no restricted write level, hence the permission to change the data + // exposes the monetary values const accessLevelOfType = getAccessLevel( getScopesOfAccess({ scopes: getScopesOfAccessLevel(this.accessLevel), @@ -207,7 +209,7 @@ export class GfCreateOrUpdateAccessDialogComponent implements OnInit { .get('accessLevel') ?.setValue( accessType === 'PRIVATE' && - accessLevelOfType === 'CREATE_READ_RESTRICTED_UPDATE_DELETE' + this.accessLevel === 'CREATE_READ_RESTRICTED_UPDATE_DELETE' ? 'CREATE_READ_UPDATE_DELETE' : accessLevelOfType ); diff --git a/libs/common/src/lib/scopes.ts b/libs/common/src/lib/scopes.ts index 18270c7886..c02661e675 100644 --- a/libs/common/src/lib/scopes.ts +++ b/libs/common/src/lib/scopes.ts @@ -96,9 +96,18 @@ export function getScopesOfAccess({ }): string[] { const scopesToEvaluate = scopesOfAccess ?? []; + // The type PRIVATE has no restricted write level, hence a write scope stays + // ineffective without the scope to read the monetary values + const permitsWriteAccess = + type !== 'PRIVATE' || + hasScope(scopesToEvaluate, scopes.portfolioReadValues); + // An unknown scope is dropped return SCOPES_OF_TYPE[type].filter((scope) => { - return scopesToEvaluate.includes(scope); + return ( + scopesToEvaluate.includes(scope) && + (permitsWriteAccess || !SCOPES_OF_WRITE_ACCESS.includes(scope)) + ); }); }