feat: implement `limitItemDeletion` checks

src/api/core/ciphers.rs

@@ -13,8 +13,7 @@ use serde_json::Value;
 use crate::{
     CONFIG,
     api::{self, EmptyResult, JsonResult, Notify, PasswordOrOtpData, UpdateType, core::log_event},
-    auth::ClientVersion,
-    auth::{Headers, OrgIdGuard, OwnerHeaders},
+    auth::{ClientVersion, Headers, OrgIdGuard, OwnerHeaders},
     config::PathType,
     crypto,
     db::{
@@ -1778,7 +1777,7 @@ async fn delete_cipher_by_uuid(
         err!("Cipher doesn't exist")
     };
 
-    if !cipher.is_write_accessible_to_user(&headers.user.uuid, conn).await {
+    if !cipher.is_deletable_by_user(&headers.user.uuid, conn).await {
         err!("Cipher can't be deleted by user")
     }
 

src/db/models/cipher.rs

@@ -25,7 +25,7 @@ use macros::UuidFromParam;
 
 use super::{
     Archive, Attachment, CollectionCipher, CollectionId, Favorite, FolderCipher, FolderId, Group, Membership,
-    MembershipStatus, MembershipType, OrganizationId, User, UserId,
+    MembershipStatus, MembershipType, Organization, OrganizationId, User, UserId,
 };
 
 #[derive(Identifiable, Queryable, Insertable, AsChangeset)]
@@ -723,6 +723,21 @@ impl Cipher {
         }
     }
 
+    pub async fn is_deletable_by_user(&self, user_uuid: &UserId, conn: &DbConn) -> bool {
+        let manage_required = match self.organization_uuid {
+            Some(ref org_id) => match Organization::find_by_uuid(&org_id, &conn).await {
+                Some(org) => org.limit_item_deletion,
+                None => false,
+            },
+            None => false,
+        };
+
+        match self.get_access_restrictions(user_uuid, None, conn).await {
+            Some((read_only, _hide_passwords, manage)) => (!manage_required && !read_only) || manage,
+            None => false,
+        }
+    }
+
     // used for checking if collection can be edited (only if user has access to a collection they
     // can write to and also passwords are not hidden to prevent privilege escalation)
     pub async fn is_in_editable_collection_by_user(&self, user_uuid: &UserId, conn: &DbConn) -> bool {