From 92d2df99f9c3ff66460580747b2394a1cc01b399 Mon Sep 17 00:00:00 2001 From: Stefan Melmuk Date: Fri, 5 Jan 2024 04:46:29 +0100 Subject: [PATCH] improve comments for get_org_collections_details --- src/api/core/organizations.rs | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs index 775d3ae9..249c72d4 100644 --- a/src/api/core/organizations.rs +++ b/src/api/core/organizations.rs @@ -320,13 +320,16 @@ async fn get_org_collections_details(org_id: &str, headers: ManagerHeadersLoose, None => err!("User is not part of organization"), }; + // get all collection memberships for the current organization let coll_users = CollectionUser::find_by_organization(org_id, &mut conn).await; + // check if current user has full access to the organization (either directly or via any group) let has_full_access_via_group = CONFIG.org_groups_enabled() && GroupUser::has_full_access_by_member(org_id, &user_org.uuid, &mut conn).await; let has_full_access = user_org.access_all || has_full_access_via_group; for col in Collection::find_by_organization(org_id, &mut conn).await { + // get the group details for the given collection let groups: Vec = if CONFIG.org_groups_enabled() { CollectionGroup::find_by_collection(&col.uuid, &mut conn) .await @@ -336,18 +339,18 @@ async fn get_org_collections_details(org_id: &str, headers: ManagerHeadersLoose, }) .collect() } else { - // The Bitwarden clients seem to call this API regardless of whether groups are enabled, - // so just act as if there are no groups. Vec::with_capacity(0) }; + // assigned indicates whether the current user has access to the given collection let mut assigned = has_full_access; + + // get the users assigned directly to the given collection let users: Vec = coll_users .iter() .filter(|collection_user| collection_user.collection_uuid == col.uuid) .map(|collection_user| { - // Remember `user_uuid` is swapped here with the `user_org.uuid` with a join during the `CollectionUser::find_by_organization` call. - // We check here if the current user is assigned to this collection or not. + // check if the current user is assigned to this collection directly if collection_user.user_uuid == user_org.uuid { assigned = true; }