From 0b150fed9a87646b33972882c380b5a7c8253884 Mon Sep 17 00:00:00 2001 From: "ashutosh.nehete" Date: Mon, 15 Sep 2025 17:04:18 +0530 Subject: [PATCH] Checking the correct permission updating the notes --- Marco.Pms.Services/Service/DirectoryService.cs | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Marco.Pms.Services/Service/DirectoryService.cs b/Marco.Pms.Services/Service/DirectoryService.cs index 45cdc80..d2d9c0b 100644 --- a/Marco.Pms.Services/Service/DirectoryService.cs +++ b/Marco.Pms.Services/Service/DirectoryService.cs @@ -2109,10 +2109,11 @@ namespace Marco.Pms.Services.Service return ApiResponse.ErrorResponse("Invalid or empty payload", "Invalid or empty payload", 400); } + var (hasAdminPermission, hasManagerPermission, hasUserPermission) = await CheckPermissionsAsync(loggedInEmployee.Id); var bucketIds = await _context.ContactBucketMappings.Where(cb => cb.ContactId == noteDto.ContactId).Select(cb => cb.BucketId).ToListAsync(); var hasContactAccess = await _context.EmployeeBucketMappings.AnyAsync(eb => bucketIds.Contains(eb.BucketId) && eb.EmployeeId == loggedInEmployee.Id); - if (hasContactAccess) + if (!hasAdminPermission && hasContactAccess) { _logger.LogWarning("Employee {EmployeeId} does not have permission to delete contact {ContactId}", loggedInEmployee.Id, noteDto.ContactId);