From 2d4843e92dbee3276782ae8b7b7c203539fc9291 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rapha=C3=ABl=20Roumezin?=
 <94066559+RaphaelRoumezin@users.noreply.github.com>
Date: Wed, 22 Jul 2026 14:05:15 +0200
Subject: [PATCH] feat: implement `limitCollectionDeletion` checks

---
 src/api/core/organizations.rs | 9 +++++++++
 src/auth.rs                   | 3 +++
 2 files changed, 12 insertions(+)

diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs
index 15607f58..d5f57eb1 100644
--- a/src/api/core/organizations.rs
+++ b/src/api/core/organizations.rs
@@ -767,9 +767,18 @@ async fn delete_organization_collection_impl(
     if org_id != &headers.org_id {
         err!("Organization not found", "Organization id's do not match");
     }
+    let Some(org_settings) = Organization::find_collection_settings_by_uuid(&org_id, &conn).await else {
+        err!("Can't find organization details")
+    };
+
     let Some(collection) = Collection::find_by_uuid_and_org(col_id, org_id, conn).await else {
         err!("Collection not found", "Collection does not exist or does not belong to this organization")
     };
+
+    if headers.membership_type <= MembershipType::Manager && org_settings.limit_collection_deletion {
+        err!("The current user isn't allowed to delete this collection")
+    }
+
     log_event(
         EventType::CollectionDeleted as i32,
         &collection.uuid,
diff --git a/src/auth.rs b/src/auth.rs
index 88a59b4b..f12f0e91 100644
--- a/src/auth.rs
+++ b/src/auth.rs
@@ -868,6 +868,7 @@ pub struct ManagerHeaders {
     pub host: String,
     pub device: Device,
     pub user: User,
+    pub membership_type: MembershipType,
     pub ip: ClientIp,
     pub org_id: OrganizationId,
 }
@@ -895,6 +896,7 @@ impl<'r> FromRequest<'r> for ManagerHeaders {
                 host: headers.host,
                 device: headers.device,
                 user: headers.user,
+                membership_type: headers.membership_type,
                 ip: headers.ip,
                 org_id: headers.membership.org_uuid,
             })
@@ -975,6 +977,7 @@ impl ManagerHeaders {
             host: h.host,
             device: h.device,
             user: h.user,
+            membership_type: MembershipType::from_i32(h.membership.atype).unwrap(),
             ip: h.ip,
             org_id: h.membership.org_uuid,
         })