diff --git a/Marco.Pms.Services/Controllers/TenantController.cs b/Marco.Pms.Services/Controllers/TenantController.cs index 80366ab..8523ebb 100644 --- a/Marco.Pms.Services/Controllers/TenantController.cs +++ b/Marco.Pms.Services/Controllers/TenantController.cs @@ -290,7 +290,7 @@ namespace Marco.Pms.Services.Controllers } _logger.LogInfo("Tenant {TenantId} found.", tenant.Id); - if (!hasManagePermission && (tenant.OrganizationId != loggedInEmployee.OrganizationId && !(hasModifyPermission || hasViewPermission))) + if (!hasManagePermission && (tenant.OrganizationId != loggedInEmployee.OrganizationId || (!hasModifyPermission && !hasViewPermission))) { _logger.LogWarning("Permission denied: User {EmployeeId} attempted to access tenant details of other tenant.", loggedInEmployee.Id); return StatusCode(403,