From 09771ac2ad8e40443c07e3fc11d6b3d284bf4be4 Mon Sep 17 00:00:00 2001
From: Alexander Neff <alex99.neff@gmx.de>
Date: Tue, 15 Sep 2026 14:27:12 +0200
Subject: [PATCH] Revert PR #6890

---
 src/api/core/organizations.rs | 9 +++++----
 src/db/models/organization.rs | 5 ++---
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs
index 989ca47d..0a69cc11 100644
--- a/src/api/core/organizations.rs
+++ b/src/api/core/organizations.rs
@@ -506,10 +506,6 @@ async fn post_organization_collections(
     let data: FullCollectionData = data.into_inner();
     data.validate(&org_id, &conn).await?;
 
-    if headers.membership.atype == MembershipType::Manager && !headers.membership.access_all {
-        err!("You don't have permission to create collections")
-    }
-
     let collection = Collection::new(org_id.clone(), data.name, data.external_id);
     collection.save(&conn).await?;
 
@@ -550,6 +546,10 @@ async fn post_organization_collections(
         .await?;
     }
 
+    if headers.membership.atype == MembershipType::Manager && !headers.membership.access_all {
+        CollectionUser::save(&headers.membership.user_uuid, &collection.uuid, false, false, true, &conn).await?;
+    }
+
     Ok(Json(collection.to_json_details(&headers.membership.user_uuid, None, &conn).await))
 }
 
@@ -2473,6 +2473,7 @@ async fn get_groups_data(
         has_full_access
     } else {
         has_full_access
+            || headers.membership.atype == MembershipType::Manager
             || Collection::has_manageable_collection_by_user(&org_id, &headers.membership.user_uuid, &conn).await
     };
     if !allowed {
diff --git a/src/db/models/organization.rs b/src/db/models/organization.rs
index bdb69864..8706ff14 100644
--- a/src/db/models/organization.rs
+++ b/src/db/models/organization.rs
@@ -522,9 +522,8 @@ impl Membership {
             "familySponsorshipValidUntil": null,
             "familySponsorshipToDelete": null,
             "accessSecretsManager": false,
-            // limit collection creation to managers with access_all permission to prevent issues
-            "limitCollectionCreation": self.atype < MembershipType::Manager || !self.access_all,
-            "limitCollectionDeletion": true,
+            "limitCollectionCreation": self.atype < MembershipType::Manager, // If less then a manager return true, to limit collection creations
+            "limitCollectionDeletion": self.atype < MembershipType::Manager, // If less then a manager return true, to limit collection deletions
             "limitItemDeletion": false,
             "allowAdminAccessToAllCollectionItems": true,
             "userIsManagedByOrganization": false, // Means not managed via the Members UI, like SSO