From 5e7cf66d67d3546fabb4c73ecd5e061596ccb235 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rapha=C3=ABl=20Roumezin?=
 <94066559+RaphaelRoumezin@users.noreply.github.com>
Date: Tue, 21 Jul 2026 17:11:07 +0200
Subject: [PATCH] fix: reflect ability to delete in display apis

---
 src/db/models/cipher.rs | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/db/models/cipher.rs b/src/db/models/cipher.rs
index 1cfc81ba..f8e8545e 100644
--- a/src/db/models/cipher.rs
+++ b/src/db/models/cipher.rs
@@ -187,6 +187,8 @@ impl Cipher {
             (false, false, false)
         };
 
+        let can_delete = self.is_deletable_by_user(user_uuid, conn).await;
+
         let fields_json: Vec<_> = self
             .fields
             .as_ref()
@@ -393,8 +395,8 @@ impl Cipher {
             json_object["viewPassword"] = json!(!hide_passwords);
             // The new key used by clients since v2025.6.0
             json_object["permissions"] = json!({
-                "delete": !read_only,
-                "restore": !read_only,
+                "delete": can_delete && self.deleted_at.is_none(),
+                "restore": can_delete && self.deleted_at.is_none(),
             });
         }