diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs index 046be793..bdc644a1 100644 --- a/src/api/core/organizations.rs +++ b/src/api/core/organizations.rs @@ -507,10 +507,6 @@ async fn post_organization_collections( let data: FullCollectionData = data.into_inner(); data.validate(&org_id, &conn).await?; - if headers.membership.atype == MembershipType::Manager && !headers.membership.access_all { - err!("You don't have permission to create collections") - } - let collection = Collection::new(org_id.clone(), data.name, data.external_id); collection.save(&conn).await?; @@ -551,6 +547,10 @@ async fn post_organization_collections( .await?; } + if headers.membership.atype == MembershipType::Manager && !headers.membership.access_all { + CollectionUser::save(&headers.membership.user_uuid, &collection.uuid, false, false, true, &conn).await?; + } + Ok(Json(collection.to_json_details(&headers.membership.user_uuid, None, &conn).await)) } @@ -2491,6 +2491,7 @@ async fn get_groups_data( has_full_access } else { has_full_access + || headers.membership.atype == MembershipType::Manager || Collection::has_manageable_collection_by_user(&org_id, &headers.membership.user_uuid, &conn).await }; if !allowed { diff --git a/src/db/models/organization.rs b/src/db/models/organization.rs index 353a406e..302ca473 100644 --- a/src/db/models/organization.rs +++ b/src/db/models/organization.rs @@ -510,9 +510,8 @@ impl Membership { "familySponsorshipValidUntil": null, "familySponsorshipToDelete": null, "accessSecretsManager": false, - // limit collection creation to managers with access_all permission to prevent issues - "limitCollectionCreation": self.atype < MembershipType::Manager || !self.access_all, - "limitCollectionDeletion": true, + "limitCollectionCreation": self.atype < MembershipType::Manager, // If less then a manager return true, to limit collection creations + "limitCollectionDeletion": self.atype < MembershipType::Manager, // If less then a manager return true, to limit collection deletions "limitItemDeletion": false, "allowAdminAccessToAllCollectionItems": true, "userIsManagedByOrganization": false, // Means not managed via the Members UI, like SSO