From 7775f58d69cc5eedca1195c862ab9d776971575f Mon Sep 17 00:00:00 2001 From: "ashutosh.nehete" Date: Tue, 30 Sep 2025 21:13:56 +0530 Subject: [PATCH] Added the check to check if has directory admin permission --- Marco.Pms.Services/Service/DirectoryService.cs | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/Marco.Pms.Services/Service/DirectoryService.cs b/Marco.Pms.Services/Service/DirectoryService.cs index e1cc745..ee0a66d 100644 --- a/Marco.Pms.Services/Service/DirectoryService.cs +++ b/Marco.Pms.Services/Service/DirectoryService.cs @@ -2131,7 +2131,7 @@ namespace Marco.Pms.Services.Service var bucketIds = await _context.ContactBucketMappings.Where(cb => cb.ContactId == noteDto.ContactId).Select(cb => cb.BucketId).ToListAsync(); var hasContactAccess = await _context.EmployeeBucketMappings.AnyAsync(eb => bucketIds.Contains(eb.BucketId) && eb.EmployeeId == loggedInEmployee.Id); - if (!hasAdminPermission && hasContactAccess) + if (!hasAdminPermission && !hasContactAccess) { _logger.LogWarning("Employee {EmployeeId} does not have permission to delete contact {ContactId}", loggedInEmployee.Id, noteDto.ContactId); @@ -2270,10 +2270,11 @@ namespace Marco.Pms.Services.Service return ApiResponse.ErrorResponse("Note not found", "Note not found", 404); } + var (hasAdminPermission, hasManagerPermission, hasUserPermission) = await CheckPermissionsAsync(loggedInEmployee.Id); var bucketIds = await _context.ContactBucketMappings.Where(cb => cb.ContactId == note.ContactId).Select(cb => cb.BucketId).ToListAsync(); var hasContactAccess = await _context.EmployeeBucketMappings.AnyAsync(eb => bucketIds.Contains(eb.BucketId) && eb.EmployeeId == loggedInEmployee.Id); - if (hasContactAccess) + if (!hasAdminPermission && !hasContactAccess) { _logger.LogWarning("Employee {EmployeeId} does not have permission to delete contact {ContactId}", loggedInEmployee.Id, note.ContactId);