From 0c0ac898378db96d0a30c1fb71646ce40a794365 Mon Sep 17 00:00:00 2001
From: Stefan Melmuk <stefan.melmuk@gmail.com>
Date: Mon, 2 Mar 2026 18:10:48 +0100
Subject: [PATCH] prevent managers from creating collections

managers without the access_all flag should not be able to create
collections. the manage all collections permission actually consists of
three separate custom permissions that have not been implemented yet for
more fine-grain access control.
---
 src/api/core/organizations.rs | 8 ++++----
 src/db/models/organization.rs | 3 ++-
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs
index 4a5066ab..3d1a93ca 100644
--- a/src/api/core/organizations.rs
+++ b/src/api/core/organizations.rs
@@ -480,6 +480,10 @@ async fn post_organization_collections(
         err!("Can't find organization details")
     };
 
+    if headers.membership.atype == MembershipType::Manager && !headers.membership.access_all {
+        err!("You don't have permission to create collections")
+    }
+
     let collection = Collection::new(org.uuid, data.name, data.external_id);
     collection.save(&conn).await?;
 
@@ -520,10 +524,6 @@ async fn post_organization_collections(
         .await?;
     }
 
-    if headers.membership.atype == MembershipType::Manager && !headers.membership.access_all {
-        CollectionUser::save(&headers.membership.user_uuid, &collection.uuid, false, false, false, &conn).await?;
-    }
-
     Ok(Json(collection.to_json_details(&headers.membership.user_uuid, None, &conn).await))
 }
 
diff --git a/src/db/models/organization.rs b/src/db/models/organization.rs
index 0b722ef6..e24ad85a 100644
--- a/src/db/models/organization.rs
+++ b/src/db/models/organization.rs
@@ -514,7 +514,8 @@ impl Membership {
             "familySponsorshipValidUntil": null,
             "familySponsorshipToDelete": null,
             "accessSecretsManager": false,
-            "limitCollectionCreation": self.atype < MembershipType::Manager, // If less then a manager return true, to limit collection creations
+            // limit collection creation to managers with access_all permission to prevent issues
+            "limitCollectionCreation": self.atype < MembershipType::Manager || !self.access_all,
             "limitCollectionDeletion": true,
             "limitItemDeletion": false,
             "allowAdminAccessToAllCollectionItems": true,