From 212985e18fd8d8e915fb9e69f09605acc08f8b19 Mon Sep 17 00:00:00 2001
From: Tom Moor <tom.moor@gmail.com>
Date: Wed, 31 Aug 2022 08:12:27 +0200
Subject: [PATCH] feat: Allow viewers to be upgraded to editors on individual
 collections (#4023)

* Improve types

* More types, fix default permission for viewers added to collection

* fix change of default role for CollectionGroup

* Restore policy

* test

* tests
---
 app/components/InputSelectPermission.tsx      |   5 +-
 app/models/Collection.ts                      |   3 +-
 app/models/CollectionGroupMembership.ts       |  10 +-
 app/models/Membership.ts                      |  10 +-
 app/scenes/CollectionNew.tsx                  |   7 +-
 .../AddGroupsToCollection.tsx                 |   1 -
 .../AddPeopleToCollection.tsx                 |   1 -
 .../CollectionGroupMemberListItem.tsx         |  27 +-
 .../components/MemberListItem.tsx             |  27 +-
 app/scenes/CollectionPermissions/index.tsx    |  13 +-
 app/scenes/DocumentReparent.tsx               |   5 +-
 app/stores/CollectionGroupMembershipsStore.ts |   3 +-
 app/stores/CollectionsStore.ts                |   7 +-
 app/stores/MembershipsStore.ts                |   3 +-
 server/middlewares/authentication.ts          |   6 +-
 server/models/Collection.ts                   |  20 +-
 server/models/CollectionGroup.ts              |   9 +-
 server/models/CollectionUser.ts               |   9 +-
 server/models/Team.ts                         |   3 +-
 server/models/User.test.ts                    |   7 +-
 server/models/User.ts                         |  11 +-
 server/policies/collection.test.ts            | 333 ++++++++++++------
 server/policies/collection.ts                 |  42 ++-
 server/policies/document.test.ts              |  34 +-
 server/policies/document.ts                   |   9 -
 server/policies/team.test.ts                  |   1 +
 .../presenters/collectionGroupMembership.ts   |   3 +-
 server/presenters/membership.ts               |   3 +-
 server/queues/tasks/ImportTask.ts             |   5 +-
 .../__snapshots__/collections.test.ts.snap    |   9 -
 server/routes/api/collections.test.ts         | 101 ++----
 server/routes/api/collections.ts              |  52 ++-
 server/routes/api/documents.test.ts           |  13 +-
 server/routes/api/documents.ts                | 147 ++++----
 server/routes/api/shares.test.ts              |   3 +-
 server/routes/api/views.test.ts               |   5 +-
 server/test/factories.ts                      |   3 +-
 server/test/support.ts                        |   3 +-
 server/types.ts                               |   4 +-
 server/validation.ts                          |   8 +
 shared/i18n/locales/en_US/translation.json    |   2 +-
 shared/types.ts                               |   5 +
 42 files changed, 537 insertions(+), 435 deletions(-)

diff --git a/app/components/InputSelectPermission.tsx b/app/components/InputSelectPermission.tsx
index bbe37751f..6d406e161 100644
--- a/app/components/InputSelectPermission.tsx
+++ b/app/components/InputSelectPermission.tsx
@@ -1,6 +1,7 @@
 import * as React from "react";
 import { useTranslation } from "react-i18next";
 import { $Diff } from "utility-types";
+import { CollectionPermission } from "@shared/types";
 import InputSelect, { Props, Option } from "./InputSelect";
 
 export default function InputSelectPermission(
@@ -31,11 +32,11 @@ export default function InputSelectPermission(
       options={[
         {
           label: t("View and edit"),
-          value: "read_write",
+          value: CollectionPermission.ReadWrite,
         },
         {
           label: t("View only"),
-          value: "read",
+          value: CollectionPermission.Read,
         },
         {
           label: t("No access"),
diff --git a/app/models/Collection.ts b/app/models/Collection.ts
index c13d5efe9..623e78837 100644
--- a/app/models/Collection.ts
+++ b/app/models/Collection.ts
@@ -1,5 +1,6 @@
 import { trim } from "lodash";
 import { action, computed, observable } from "mobx";
+import { CollectionPermission } from "@shared/types";
 import { sortNavigationNodes } from "@shared/utils/collections";
 import CollectionsStore from "~/stores/CollectionsStore";
 import Document from "~/models/Document";
@@ -39,7 +40,7 @@ export default class Collection extends ParanoidModel {
 
   @Field
   @observable
-  permission: "read" | "read_write" | void;
+  permission: CollectionPermission | void;
 
   @Field
   @observable
diff --git a/app/models/CollectionGroupMembership.ts b/app/models/CollectionGroupMembership.ts
index 893ddd4bc..4563eefd4 100644
--- a/app/models/CollectionGroupMembership.ts
+++ b/app/models/CollectionGroupMembership.ts
@@ -1,4 +1,5 @@
 import { computed } from "mobx";
+import { CollectionPermission } from "@shared/types";
 import BaseModel from "./BaseModel";
 
 class CollectionGroupMembership extends BaseModel {
@@ -8,16 +9,11 @@ class CollectionGroupMembership extends BaseModel {
 
   collectionId: string;
 
-  permission: string;
+  permission: CollectionPermission;
 
   @computed
   get isEditor(): boolean {
-    return this.permission === "read_write";
-  }
-
-  @computed
-  get isMaintainer(): boolean {
-    return this.permission === "maintainer";
+    return this.permission === CollectionPermission.ReadWrite;
   }
 }
 
diff --git a/app/models/Membership.ts b/app/models/Membership.ts
index 6b6647059..17ea36bdc 100644
--- a/app/models/Membership.ts
+++ b/app/models/Membership.ts
@@ -1,4 +1,5 @@
 import { computed } from "mobx";
+import { CollectionPermission } from "@shared/types";
 import BaseModel from "./BaseModel";
 
 class Membership extends BaseModel {
@@ -8,16 +9,11 @@ class Membership extends BaseModel {
 
   collectionId: string;
 
-  permission: string;
+  permission: CollectionPermission;
 
   @computed
   get isEditor(): boolean {
-    return this.permission === "read_write";
-  }
-
-  @computed
-  get isMaintainer(): boolean {
-    return this.permission === "maintainer";
+    return this.permission === CollectionPermission.ReadWrite;
   }
 }
 
diff --git a/app/scenes/CollectionNew.tsx b/app/scenes/CollectionNew.tsx
index 8e26bb6bc..e6293212a 100644
--- a/app/scenes/CollectionNew.tsx
+++ b/app/scenes/CollectionNew.tsx
@@ -4,6 +4,7 @@ import { observer } from "mobx-react";
 import * as React from "react";
 import { withTranslation, Trans, WithTranslation } from "react-i18next";
 import { randomElement } from "@shared/random";
+import { CollectionPermission } from "@shared/types";
 import { colorPalette } from "@shared/utils/collections";
 import { CollectionValidation } from "@shared/validations";
 import RootStore from "~/stores/RootStore";
@@ -38,7 +39,7 @@ class CollectionNew extends React.Component<Props> {
   sharing = true;
 
   @observable
-  permission = "read_write";
+  permission = CollectionPermission.ReadWrite;
 
   @observable
   isSaving: boolean;
@@ -100,8 +101,8 @@ class CollectionNew extends React.Component<Props> {
     this.hasOpenedIconPicker = true;
   };
 
-  handlePermissionChange = (newPermission: string) => {
-    this.permission = newPermission;
+  handlePermissionChange = (permission: CollectionPermission) => {
+    this.permission = permission;
   };
 
   handleSharingChange = (ev: React.ChangeEvent<HTMLInputElement>) => {
diff --git a/app/scenes/CollectionPermissions/AddGroupsToCollection.tsx b/app/scenes/CollectionPermissions/AddGroupsToCollection.tsx
index 32981beb3..59059f52c 100644
--- a/app/scenes/CollectionPermissions/AddGroupsToCollection.tsx
+++ b/app/scenes/CollectionPermissions/AddGroupsToCollection.tsx
@@ -59,7 +59,6 @@ class AddGroupsToCollection extends React.Component<Props> {
       this.props.collectionGroupMemberships.create({
         collectionId: this.props.collection.id,
         groupId: group.id,
-        permission: "read_write",
       });
       this.props.toasts.showToast(
         t("{{ groupName }} was added to the collection", {
diff --git a/app/scenes/CollectionPermissions/AddPeopleToCollection.tsx b/app/scenes/CollectionPermissions/AddPeopleToCollection.tsx
index 596fe25d0..5cefd0932 100644
--- a/app/scenes/CollectionPermissions/AddPeopleToCollection.tsx
+++ b/app/scenes/CollectionPermissions/AddPeopleToCollection.tsx
@@ -57,7 +57,6 @@ class AddPeopleToCollection extends React.Component<Props> {
       this.props.memberships.create({
         collectionId: this.props.collection.id,
         userId: user.id,
-        permission: "read_write",
       });
       this.props.toasts.showToast(
         t("{{ userName }} was added to the collection", {
diff --git a/app/scenes/CollectionPermissions/components/CollectionGroupMemberListItem.tsx b/app/scenes/CollectionPermissions/components/CollectionGroupMemberListItem.tsx
index ae63edc89..8bc8eae78 100644
--- a/app/scenes/CollectionPermissions/components/CollectionGroupMemberListItem.tsx
+++ b/app/scenes/CollectionPermissions/components/CollectionGroupMemberListItem.tsx
@@ -1,6 +1,7 @@
 import * as React from "react";
 import { useTranslation } from "react-i18next";
 import styled from "styled-components";
+import { CollectionPermission } from "@shared/types";
 import CollectionGroupMembership from "~/models/CollectionGroupMembership";
 import Group from "~/models/Group";
 import GroupListItem from "~/components/GroupListItem";
@@ -10,7 +11,7 @@ import CollectionGroupMemberMenu from "~/menus/CollectionGroupMemberMenu";
 type Props = {
   group: Group;
   collectionGroupMembership: CollectionGroupMembership | null | undefined;
-  onUpdate: (permission: string) => void;
+  onUpdate: (permission: CollectionPermission) => void;
   onRemove: () => void;
 };
 
@@ -21,19 +22,6 @@ const CollectionGroupMemberListItem = ({
   onRemove,
 }: Props) => {
   const { t } = useTranslation();
-  const PERMISSIONS = React.useMemo(
-    () => [
-      {
-        label: t("View only"),
-        value: "read",
-      },
-      {
-        label: t("View and edit"),
-        value: "read_write",
-      },
-    ],
-    [t]
-  );
 
   return (
     <GroupListItem
@@ -43,7 +31,16 @@ const CollectionGroupMemberListItem = ({
         <>
           <Select
             label={t("Permissions")}
-            options={PERMISSIONS}
+            options={[
+              {
+                label: t("View only"),
+                value: CollectionPermission.Read,
+              },
+              {
+                label: t("View and edit"),
+                value: CollectionPermission.ReadWrite,
+              },
+            ]}
             value={
               collectionGroupMembership
                 ? collectionGroupMembership.permission
diff --git a/app/scenes/CollectionPermissions/components/MemberListItem.tsx b/app/scenes/CollectionPermissions/components/MemberListItem.tsx
index 306448712..06a7d0c24 100644
--- a/app/scenes/CollectionPermissions/components/MemberListItem.tsx
+++ b/app/scenes/CollectionPermissions/components/MemberListItem.tsx
@@ -2,6 +2,7 @@ import { observer } from "mobx-react";
 import * as React from "react";
 import { Trans, useTranslation } from "react-i18next";
 import styled from "styled-components";
+import { CollectionPermission } from "@shared/types";
 import Membership from "~/models/Membership";
 import User from "~/models/User";
 import Avatar from "~/components/Avatar";
@@ -19,7 +20,7 @@ type Props = {
   canEdit: boolean;
   onAdd?: () => void;
   onRemove?: () => void;
-  onUpdate?: (permission: string) => void;
+  onUpdate?: (permission: CollectionPermission) => void;
 };
 
 const MemberListItem = ({
@@ -31,19 +32,6 @@ const MemberListItem = ({
   canEdit,
 }: Props) => {
   const { t } = useTranslation();
-  const PERMISSIONS = React.useMemo(
-    () => [
-      {
-        label: t("View only"),
-        value: "read",
-      },
-      {
-        label: t("View and edit"),
-        value: "read_write",
-      },
-    ],
-    [t]
-  );
 
   return (
     <ListItem
@@ -67,7 +55,16 @@ const MemberListItem = ({
           {onUpdate && (
             <Select
               label={t("Permissions")}
-              options={PERMISSIONS}
+              options={[
+                {
+                  label: t("View only"),
+                  value: CollectionPermission.Read,
+                },
+                {
+                  label: t("View and edit"),
+                  value: CollectionPermission.ReadWrite,
+                },
+              ]}
               value={membership ? membership.permission : undefined}
               onChange={onUpdate}
               disabled={!canEdit}
diff --git a/app/scenes/CollectionPermissions/index.tsx b/app/scenes/CollectionPermissions/index.tsx
index 62c1db942..b10977f4e 100644
--- a/app/scenes/CollectionPermissions/index.tsx
+++ b/app/scenes/CollectionPermissions/index.tsx
@@ -3,6 +3,7 @@ import { PlusIcon } from "outline-icons";
 import * as React from "react";
 import { useTranslation, Trans } from "react-i18next";
 import styled from "styled-components";
+import { CollectionPermission } from "@shared/types";
 import Collection from "~/models/Collection";
 import Group from "~/models/Group";
 import User from "~/models/User";
@@ -151,7 +152,7 @@ function CollectionPermissions({ collection }: Props) {
   );
 
   const handleChangePermission = React.useCallback(
-    async (permission: string) => {
+    async (permission: CollectionPermission) => {
       try {
         await collection.save({
           permission,
@@ -218,9 +219,10 @@ function CollectionPermissions({ collection }: Props) {
             }}
           />
         )}
-        {collection.permission === "read" && (
+        {collection.permission === CollectionPermission.ReadWrite && (
           <Trans
-            defaults="Team members can view documents in the <em>{{ collectionName }}</em> collection by default."
+            defaults="Team members can view and edit documents in the <em>{{ collectionName }}</em> collection by
+          default."
             values={{
               collectionName,
             }}
@@ -229,10 +231,9 @@ function CollectionPermissions({ collection }: Props) {
             }}
           />
         )}
-        {collection.permission === "read_write" && (
+        {collection.permission === CollectionPermission.Read && (
           <Trans
-            defaults="Team members can view and edit documents in the <em>{{ collectionName }}</em> collection by
-          default."
+            defaults="Team members can view documents in the <em>{{ collectionName }}</em> collection by default."
             values={{
               collectionName,
             }}
diff --git a/app/scenes/DocumentReparent.tsx b/app/scenes/DocumentReparent.tsx
index 9e9482e56..61125dc97 100644
--- a/app/scenes/DocumentReparent.tsx
+++ b/app/scenes/DocumentReparent.tsx
@@ -2,6 +2,7 @@ import { observer } from "mobx-react";
 import { useState } from "react";
 import * as React from "react";
 import { Trans, useTranslation } from "react-i18next";
+import { CollectionPermission } from "@shared/types";
 import Collection from "~/models/Collection";
 import Button from "~/components/Button";
 import Flex from "~/components/Flex";
@@ -38,8 +39,8 @@ function DocumentReparent({ collection, item, onSubmit, onCancel }: Props) {
   const { t } = useTranslation();
   const prevCollection = collections.get(item.collectionId);
   const accessMapping = {
-    read_write: t("view and edit access"),
-    read: t("view only access"),
+    [CollectionPermission.ReadWrite]: t("view and edit access"),
+    [CollectionPermission.Read]: t("view only access"),
     null: t("no access"),
   };
 
diff --git a/app/stores/CollectionGroupMembershipsStore.ts b/app/stores/CollectionGroupMembershipsStore.ts
index b6e88a0b1..3e689c861 100644
--- a/app/stores/CollectionGroupMembershipsStore.ts
+++ b/app/stores/CollectionGroupMembershipsStore.ts
@@ -1,5 +1,6 @@
 import invariant from "invariant";
 import { action, runInAction } from "mobx";
+import { CollectionPermission } from "@shared/types";
 import CollectionGroupMembership from "~/models/CollectionGroupMembership";
 import { PaginationParams } from "~/types";
 import { client } from "~/utils/ApiClient";
@@ -45,7 +46,7 @@ export default class CollectionGroupMembershipsStore extends BaseStore<
   }: {
     collectionId: string;
     groupId: string;
-    permission: string;
+    permission?: CollectionPermission;
   }) {
     const res = await client.post("/collections.add_group", {
       id: collectionId,
diff --git a/app/stores/CollectionsStore.ts b/app/stores/CollectionsStore.ts
index dd37dcf74..ddec75641 100644
--- a/app/stores/CollectionsStore.ts
+++ b/app/stores/CollectionsStore.ts
@@ -1,6 +1,7 @@
 import invariant from "invariant";
 import { concat, find, last } from "lodash";
 import { computed, action } from "mobx";
+import { CollectionPermission } from "@shared/types";
 import Collection from "~/models/Collection";
 import { NavigationNode } from "~/types";
 import { client } from "~/utils/ApiClient";
@@ -171,8 +172,10 @@ export default class CollectionsStore extends BaseStore<Collection> {
 
   @computed
   get publicCollections() {
-    return this.orderedData.filter((collection) =>
-      ["read", "read_write"].includes(collection.permission || "")
+    return this.orderedData.filter(
+      (collection) =>
+        collection.permission &&
+        Object.values(CollectionPermission).includes(collection.permission)
     );
   }
 
diff --git a/app/stores/MembershipsStore.ts b/app/stores/MembershipsStore.ts
index 5f3847bea..5730752fe 100644
--- a/app/stores/MembershipsStore.ts
+++ b/app/stores/MembershipsStore.ts
@@ -1,5 +1,6 @@
 import invariant from "invariant";
 import { action, runInAction } from "mobx";
+import { CollectionPermission } from "@shared/types";
 import Membership from "~/models/Membership";
 import { PaginationParams } from "~/types";
 import { client } from "~/utils/ApiClient";
@@ -43,7 +44,7 @@ export default class MembershipsStore extends BaseStore<Membership> {
   }: {
     collectionId: string;
     userId: string;
-    permission: string;
+    permission?: CollectionPermission;
   }) {
     const res = await client.post("/collections.add_user", {
       id: collectionId,
diff --git a/server/middlewares/authentication.ts b/server/middlewares/authentication.ts
index 809a56cb7..577c0ca9b 100644
--- a/server/middlewares/authentication.ts
+++ b/server/middlewares/authentication.ts
@@ -8,7 +8,7 @@ import {
   AuthorizationError,
   UserSuspendedError,
 } from "../errors";
-import { ContextWithState, AuthenticationTypes } from "../types";
+import { ContextWithState, AuthenticationType } from "../types";
 
 type AuthenticationOptions = {
   /* An admin user role is required to access the route */
@@ -63,7 +63,7 @@ export default function auth(options: AuthenticationOptions = {}) {
 
     if (token) {
       if (String(token).match(/^[\w]{38}$/)) {
-        ctx.state.authType = AuthenticationTypes.API;
+        ctx.state.authType = AuthenticationType.API;
         let apiKey;
 
         try {
@@ -94,7 +94,7 @@ export default function auth(options: AuthenticationOptions = {}) {
           throw AuthenticationError("Invalid API key");
         }
       } else {
-        ctx.state.authType = AuthenticationTypes.APP;
+        ctx.state.authType = AuthenticationType.APP;
         user = await getUserForJWT(String(token));
       }
 
diff --git a/server/models/Collection.ts b/server/models/Collection.ts
index 1674cb1a5..1426540e3 100644
--- a/server/models/Collection.ts
+++ b/server/models/Collection.ts
@@ -21,11 +21,12 @@ import {
   Length as SimpleLength,
 } from "sequelize-typescript";
 import isUUID from "validator/lib/isUUID";
+import { CollectionPermission } from "@shared/types";
 import { sortNavigationNodes } from "@shared/utils/collections";
 import { SLUG_URL_REGEX } from "@shared/utils/urlHelpers";
 import { CollectionValidation } from "@shared/validations";
 import slugify from "@server/utils/slugify";
-import { NavigationNode, CollectionSort } from "~/types";
+import type { NavigationNode, CollectionSort } from "~/types";
 import CollectionGroup from "./CollectionGroup";
 import CollectionUser from "./CollectionUser";
 import Document from "./Document";
@@ -39,9 +40,6 @@ import IsHexColor from "./validators/IsHexColor";
 import Length from "./validators/Length";
 import NotContainsUrl from "./validators/NotContainsUrl";
 
-// without this indirection, the app crashes on starup
-type Sort = CollectionSort;
-
 @Scopes(() => ({
   withAllMemberships: {
     include: [
@@ -174,9 +172,9 @@ class Collection extends ParanoidModel {
   @Column
   index: string | null;
 
-  @IsIn([["read", "read_write"]])
-  @Column
-  permission: "read" | "read_write" | null;
+  @IsIn([Object.values(CollectionPermission)])
+  @Column(DataType.STRING)
+  permission: CollectionPermission | null;
 
   @Default(false)
   @Column
@@ -193,7 +191,7 @@ class Collection extends ParanoidModel {
   @Column({
     type: DataType.JSONB,
     validate: {
-      isSort(value: Sort) {
+      isSort(value: CollectionSort) {
         if (
           typeof value !== "object" ||
           !value.direction ||
@@ -213,7 +211,7 @@ class Collection extends ParanoidModel {
       },
     },
   })
-  sort: Sort;
+  sort: CollectionSort;
 
   // getters
 
@@ -255,14 +253,14 @@ class Collection extends ParanoidModel {
     model: Collection,
     options: { transaction: Transaction }
   ) {
-    if (model.permission !== "read_write") {
+    if (model.permission !== CollectionPermission.ReadWrite) {
       return CollectionUser.findOrCreate({
         where: {
           collectionId: model.id,
           userId: model.createdById,
         },
         defaults: {
-          permission: "read_write",
+          permission: CollectionPermission.ReadWrite,
           createdById: model.createdById,
         },
         transaction: options.transaction,
diff --git a/server/models/CollectionGroup.ts b/server/models/CollectionGroup.ts
index bb51a7ef2..baba676e9 100644
--- a/server/models/CollectionGroup.ts
+++ b/server/models/CollectionGroup.ts
@@ -8,6 +8,7 @@ import {
   DataType,
   Scopes,
 } from "sequelize-typescript";
+import { CollectionPermission } from "@shared/types";
 import Collection from "./Collection";
 import Group from "./Group";
 import User from "./User";
@@ -33,10 +34,10 @@ import Fix from "./decorators/Fix";
 @Table({ tableName: "collection_groups", modelName: "collection_group" })
 @Fix
 class CollectionGroup extends BaseModel {
-  @Default("read_write")
-  @IsIn([["read", "read_write", "maintainer"]])
-  @Column
-  permission: string;
+  @Default(CollectionPermission.ReadWrite)
+  @IsIn([Object.values(CollectionPermission)])
+  @Column(DataType.STRING)
+  permission: CollectionPermission;
 
   // associations
 
diff --git a/server/models/CollectionUser.ts b/server/models/CollectionUser.ts
index 7499e4a85..ad9ae55fc 100644
--- a/server/models/CollectionUser.ts
+++ b/server/models/CollectionUser.ts
@@ -8,6 +8,7 @@ import {
   DataType,
   Scopes,
 } from "sequelize-typescript";
+import { CollectionPermission } from "@shared/types";
 import Collection from "./Collection";
 import User from "./User";
 import BaseModel from "./base/BaseModel";
@@ -32,10 +33,10 @@ import Fix from "./decorators/Fix";
 @Table({ tableName: "collection_users", modelName: "collection_user" })
 @Fix
 class CollectionUser extends BaseModel {
-  @Default("read_write")
-  @IsIn([["read", "read_write", "maintainer"]])
-  @Column
-  permission: string;
+  @Default(CollectionPermission.ReadWrite)
+  @IsIn([Object.values(CollectionPermission)])
+  @Column(DataType.STRING)
+  permission: CollectionPermission;
 
   // associations
 
diff --git a/server/models/Team.ts b/server/models/Team.ts
index b09aa1a5d..2af250246 100644
--- a/server/models/Team.ts
+++ b/server/models/Team.ts
@@ -19,6 +19,7 @@ import {
   IsUrl,
   AllowNull,
 } from "sequelize-typescript";
+import { CollectionPermission } from "@shared/types";
 import { getBaseDomain, RESERVED_SUBDOMAINS } from "@shared/utils/domains";
 import env from "@server/env";
 import { generateAvatarUrl } from "@server/utils/avatars";
@@ -172,7 +173,7 @@ class Team extends ParanoidModel {
           teamId: this.id,
           createdById: userId,
           sort: Collection.DEFAULT_SORT,
-          permission: "read_write",
+          permission: CollectionPermission.ReadWrite,
         },
         {
           transaction,
diff --git a/server/models/User.test.ts b/server/models/User.test.ts
index f941c2a06..e921813e2 100644
--- a/server/models/User.test.ts
+++ b/server/models/User.test.ts
@@ -1,3 +1,4 @@
+import { CollectionPermission } from "@shared/types";
 import { buildUser, buildTeam, buildCollection } from "@server/test/factories";
 import { getTestDatabase } from "@server/test/support";
 import CollectionUser from "./CollectionUser";
@@ -39,7 +40,7 @@ describe("user model", () => {
       });
       const collection = await buildCollection({
         teamId: team.id,
-        permission: "read_write",
+        permission: CollectionPermission.ReadWrite,
       });
       const response = await user.collectionIds();
       expect(response.length).toEqual(1);
@@ -52,7 +53,7 @@ describe("user model", () => {
       });
       const collection = await buildCollection({
         teamId: team.id,
-        permission: "read",
+        permission: CollectionPermission.Read,
       });
       const response = await user.collectionIds();
       expect(response.length).toEqual(1);
@@ -83,7 +84,7 @@ describe("user model", () => {
         createdById: user.id,
         collectionId: collection.id,
         userId: user.id,
-        permission: "read",
+        permission: CollectionPermission.Read,
       });
       const response = await user.collectionIds();
       expect(response.length).toEqual(1);
diff --git a/server/models/User.ts b/server/models/User.ts
index 7459dab27..404571b54 100644
--- a/server/models/User.ts
+++ b/server/models/User.ts
@@ -22,6 +22,7 @@ import {
   AllowNull,
 } from "sequelize-typescript";
 import { languages } from "@shared/i18n";
+import { CollectionPermission } from "@shared/types";
 import { stringToColor } from "@shared/utils/color";
 import env from "@server/env";
 import { ValidationError } from "../errors";
@@ -219,6 +220,12 @@ class User extends ParanoidModel {
     return stringToColor(this.id);
   }
 
+  get defaultCollectionPermission(): CollectionPermission {
+    return this.isViewer
+      ? CollectionPermission.Read
+      : CollectionPermission.ReadWrite;
+  }
+
   /**
    * Returns a code that can be used to delete this user account. The code will
    * be rotated when the user signs out.
@@ -298,8 +305,8 @@ class User extends ParanoidModel {
     return collectionStubs
       .filter(
         (c) =>
-          c.permission === "read" ||
-          c.permission === "read_write" ||
+          c.permission === CollectionPermission.Read ||
+          c.permission === CollectionPermission.ReadWrite ||
           c.memberships.length > 0 ||
           c.collectionGroupMemberships.length > 0
       )
diff --git a/server/policies/collection.test.ts b/server/policies/collection.test.ts
index e5537b5b9..49d605671 100644
--- a/server/policies/collection.test.ts
+++ b/server/policies/collection.test.ts
@@ -1,3 +1,4 @@
+import { CollectionPermission } from "@shared/types";
 import { CollectionUser, Collection } from "@server/models";
 import { buildUser, buildTeam, buildCollection } from "@server/test/factories";
 import { getTestDatabase } from "@server/test/support";
@@ -9,128 +10,248 @@ afterAll(db.disconnect);
 
 beforeEach(db.flush);
 
-describe("read_write permission", () => {
-  it("should allow read write permissions for team member", async () => {
-    const team = await buildTeam();
-    const user = await buildUser({
-      teamId: team.id,
+describe("member", () => {
+  describe("read_write permission", () => {
+    it("should allow read write permissions for team member", async () => {
+      const team = await buildTeam();
+      const user = await buildUser({
+        teamId: team.id,
+      });
+      const collection = await buildCollection({
+        teamId: team.id,
+        permission: CollectionPermission.ReadWrite,
+      });
+      const abilities = serialize(user, collection);
+      expect(abilities.read).toEqual(true);
+      expect(abilities.update).toEqual(true);
+      expect(abilities.share).toEqual(true);
     });
-    const collection = await buildCollection({
-      teamId: team.id,
-      permission: "read_write",
+
+    it("should override read membership permission", async () => {
+      const team = await buildTeam();
+      const user = await buildUser({
+        teamId: team.id,
+      });
+      const collection = await buildCollection({
+        teamId: team.id,
+        permission: CollectionPermission.ReadWrite,
+      });
+      await CollectionUser.create({
+        createdById: user.id,
+        collectionId: collection.id,
+        userId: user.id,
+        permission: CollectionPermission.Read,
+      });
+      // reload to get membership
+      const reloaded = await Collection.scope({
+        method: ["withMembership", user.id],
+      }).findByPk(collection.id);
+      const abilities = serialize(user, reloaded);
+      expect(abilities.read).toEqual(true);
+      expect(abilities.update).toEqual(true);
+      expect(abilities.share).toEqual(true);
     });
-    const abilities = serialize(user, collection);
-    expect(abilities.read).toEqual(true);
-    expect(abilities.update).toEqual(true);
-    expect(abilities.share).toEqual(true);
   });
 
-  it("should override read membership permission", async () => {
-    const team = await buildTeam();
-    const user = await buildUser({
-      teamId: team.id,
+  describe("read permission", () => {
+    it("should allow read permissions for team member", async () => {
+      const team = await buildTeam();
+      const user = await buildUser({
+        teamId: team.id,
+      });
+      const collection = await buildCollection({
+        teamId: team.id,
+        permission: CollectionPermission.Read,
+      });
+      const abilities = serialize(user, collection);
+      expect(abilities.read).toEqual(true);
+      expect(abilities.update).toEqual(false);
+      expect(abilities.share).toEqual(false);
     });
-    const collection = await buildCollection({
-      teamId: team.id,
-      permission: "read_write",
+
+    it("should allow override with read_write membership permission", async () => {
+      const team = await buildTeam();
+      const user = await buildUser({
+        teamId: team.id,
+      });
+      const collection = await buildCollection({
+        teamId: team.id,
+        permission: CollectionPermission.Read,
+      });
+      await CollectionUser.create({
+        createdById: user.id,
+        collectionId: collection.id,
+        userId: user.id,
+        permission: CollectionPermission.ReadWrite,
+      });
+      // reload to get membership
+      const reloaded = await Collection.scope({
+        method: ["withMembership", user.id],
+      }).findByPk(collection.id);
+      const abilities = serialize(user, reloaded);
+      expect(abilities.read).toEqual(true);
+      expect(abilities.update).toEqual(true);
+      expect(abilities.share).toEqual(true);
     });
-    await CollectionUser.create({
-      createdById: user.id,
-      collectionId: collection.id,
-      userId: user.id,
-      permission: "read",
+  });
+
+  describe("no permission", () => {
+    it("should allow no permissions for team member", async () => {
+      const team = await buildTeam();
+      const user = await buildUser({
+        teamId: team.id,
+      });
+      const collection = await buildCollection({
+        teamId: team.id,
+        permission: null,
+      });
+      const abilities = serialize(user, collection);
+      expect(abilities.read).toEqual(false);
+      expect(abilities.update).toEqual(false);
+      expect(abilities.share).toEqual(false);
+    });
+
+    it("should allow override with team member membership permission", async () => {
+      const team = await buildTeam();
+      const user = await buildUser({
+        teamId: team.id,
+      });
+      const collection = await buildCollection({
+        teamId: team.id,
+        permission: null,
+      });
+      await CollectionUser.create({
+        createdById: user.id,
+        collectionId: collection.id,
+        userId: user.id,
+        permission: CollectionPermission.ReadWrite,
+      });
+      // reload to get membership
+      const reloaded = await Collection.scope({
+        method: ["withMembership", user.id],
+      }).findByPk(collection.id);
+      const abilities = serialize(user, reloaded);
+      expect(abilities.read).toEqual(true);
+      expect(abilities.update).toEqual(true);
+      expect(abilities.share).toEqual(true);
     });
-    // reload to get membership
-    const reloaded = await Collection.scope({
-      method: ["withMembership", user.id],
-    }).findByPk(collection.id);
-    const abilities = serialize(user, reloaded);
-    expect(abilities.read).toEqual(true);
-    expect(abilities.update).toEqual(true);
-    expect(abilities.share).toEqual(true);
   });
 });
 
-describe("read permission", () => {
-  it("should allow read permissions for team member", async () => {
-    const team = await buildTeam();
-    const user = await buildUser({
-      teamId: team.id,
+describe("viewer", () => {
+  describe("read_write permission", () => {
+    it("should allow read permissions for viewer", async () => {
+      const team = await buildTeam();
+      const user = await buildUser({
+        isViewer: true,
+        teamId: team.id,
+      });
+      const collection = await buildCollection({
+        teamId: team.id,
+        permission: CollectionPermission.ReadWrite,
+      });
+      const abilities = serialize(user, collection);
+      expect(abilities.read).toEqual(true);
+      expect(abilities.update).toEqual(false);
+      expect(abilities.share).toEqual(false);
     });
-    const collection = await buildCollection({
-      teamId: team.id,
-      permission: "read",
+
+    it("should override read membership permission", async () => {
+      const team = await buildTeam();
+      const user = await buildUser({
+        isViewer: true,
+        teamId: team.id,
+      });
+      const collection = await buildCollection({
+        teamId: team.id,
+        permission: CollectionPermission.ReadWrite,
+      });
+      await CollectionUser.create({
+        createdById: user.id,
+        collectionId: collection.id,
+        userId: user.id,
+        permission: CollectionPermission.ReadWrite,
+      });
+      // reload to get membership
+      const reloaded = await Collection.scope({
+        method: ["withMembership", user.id],
+      }).findByPk(collection.id);
+      const abilities = serialize(user, reloaded);
+      expect(abilities.read).toEqual(true);
+      expect(abilities.update).toEqual(true);
+      expect(abilities.share).toEqual(true);
     });
-    const abilities = serialize(user, collection);
-    expect(abilities.read).toEqual(true);
-    expect(abilities.update).toEqual(false);
-    expect(abilities.share).toEqual(false);
   });
 
-  it("should allow override with read_write membership permission", async () => {
-    const team = await buildTeam();
-    const user = await buildUser({
-      teamId: team.id,
+  describe("read permission", () => {
+    it("should allow override with read_write membership permission", async () => {
+      const team = await buildTeam();
+      const user = await buildUser({
+        isViewer: true,
+        teamId: team.id,
+      });
+      const collection = await buildCollection({
+        teamId: team.id,
+        permission: CollectionPermission.Read,
+      });
+      await CollectionUser.create({
+        createdById: user.id,
+        collectionId: collection.id,
+        userId: user.id,
+        permission: CollectionPermission.ReadWrite,
+      });
+      // reload to get membership
+      const reloaded = await Collection.scope({
+        method: ["withMembership", user.id],
+      }).findByPk(collection.id);
+      const abilities = serialize(user, reloaded);
+      expect(abilities.read).toEqual(true);
+      expect(abilities.update).toEqual(true);
+      expect(abilities.share).toEqual(true);
     });
-    const collection = await buildCollection({
-      teamId: team.id,
-      permission: "read",
+  });
+
+  describe("no permission", () => {
+    it("should allow no permissions for viewer", async () => {
+      const team = await buildTeam();
+      const user = await buildUser({
+        isViewer: true,
+        teamId: team.id,
+      });
+      const collection = await buildCollection({
+        teamId: team.id,
+        permission: null,
+      });
+      const abilities = serialize(user, collection);
+      expect(abilities.read).toEqual(false);
+      expect(abilities.update).toEqual(false);
+      expect(abilities.share).toEqual(false);
     });
-    await CollectionUser.create({
-      createdById: user.id,
-      collectionId: collection.id,
-      userId: user.id,
-      permission: "read_write",
+
+    it("should allow override with team member membership permission", async () => {
+      const team = await buildTeam();
+      const user = await buildUser({
+        isViewer: true,
+        teamId: team.id,
+      });
+      const collection = await buildCollection({
+        teamId: team.id,
+        permission: null,
+      });
+      await CollectionUser.create({
+        createdById: user.id,
+        collectionId: collection.id,
+        userId: user.id,
+        permission: CollectionPermission.ReadWrite,
+      });
+      // reload to get membership
+      const reloaded = await Collection.scope({
+        method: ["withMembership", user.id],
+      }).findByPk(collection.id);
+      const abilities = serialize(user, reloaded);
+      expect(abilities.read).toEqual(true);
+      expect(abilities.update).toEqual(true);
+      expect(abilities.share).toEqual(true);
     });
-    // reload to get membership
-    const reloaded = await Collection.scope({
-      method: ["withMembership", user.id],
-    }).findByPk(collection.id);
-    const abilities = serialize(user, reloaded);
-    expect(abilities.read).toEqual(true);
-    expect(abilities.update).toEqual(true);
-    expect(abilities.share).toEqual(true);
-  });
-});
-
-describe("no permission", () => {
-  it("should allow no permissions for team member", async () => {
-    const team = await buildTeam();
-    const user = await buildUser({
-      teamId: team.id,
-    });
-    const collection = await buildCollection({
-      teamId: team.id,
-      permission: null,
-    });
-    const abilities = serialize(user, collection);
-    expect(abilities.read).toEqual(false);
-    expect(abilities.update).toEqual(false);
-    expect(abilities.share).toEqual(false);
-  });
-
-  it("should allow override with team member membership permission", async () => {
-    const team = await buildTeam();
-    const user = await buildUser({
-      teamId: team.id,
-    });
-    const collection = await buildCollection({
-      teamId: team.id,
-      permission: null,
-    });
-    await CollectionUser.create({
-      createdById: user.id,
-      collectionId: collection.id,
-      userId: user.id,
-      permission: "read_write",
-    });
-    // reload to get membership
-    const reloaded = await Collection.scope({
-      method: ["withMembership", user.id],
-    }).findByPk(collection.id);
-    const abilities = serialize(user, reloaded);
-    expect(abilities.read).toEqual(true);
-    expect(abilities.update).toEqual(true);
-    expect(abilities.share).toEqual(true);
   });
 });
diff --git a/server/policies/collection.ts b/server/policies/collection.ts
index 6ccdcf0e5..60bf381dd 100644
--- a/server/policies/collection.ts
+++ b/server/policies/collection.ts
@@ -1,5 +1,6 @@
 import invariant from "invariant";
 import { some } from "lodash";
+import { CollectionPermission } from "@shared/types";
 import { Collection, User, Team } from "@server/models";
 import { AdminRequiredError } from "../errors";
 import { allow } from "./cancan";
@@ -57,7 +58,7 @@ allow(User, ["read", "star", "unstar"], Collection, (user, collection) => {
       ...collection.collectionGroupMemberships,
     ];
     return some(allMemberships, (m) =>
-      ["read", "read_write", "maintainer"].includes(m.permission)
+      Object.values(CollectionPermission).includes(m.permission)
     );
   }
 
@@ -65,9 +66,6 @@ allow(User, ["read", "star", "unstar"], Collection, (user, collection) => {
 });
 
 allow(User, "share", Collection, (user, collection) => {
-  if (user.isViewer) {
-    return false;
-  }
   if (!collection || user.teamId !== collection.teamId) {
     return false;
   }
@@ -78,7 +76,10 @@ allow(User, "share", Collection, (user, collection) => {
     return true;
   }
 
-  if (collection.permission !== "read_write") {
+  if (
+    collection.permission !== CollectionPermission.ReadWrite ||
+    user.isViewer
+  ) {
     invariant(
       collection.memberships,
       "membership should be preloaded, did you forget withMembership scope?"
@@ -87,8 +88,9 @@ allow(User, "share", Collection, (user, collection) => {
       ...collection.memberships,
       ...collection.collectionGroupMemberships,
     ];
-    return some(allMemberships, (m) =>
-      ["read_write", "maintainer"].includes(m.permission)
+    return some(
+      allMemberships,
+      (m) => m.permission === CollectionPermission.ReadWrite
     );
   }
 
@@ -96,9 +98,6 @@ allow(User, "share", Collection, (user, collection) => {
 });
 
 allow(User, ["publish", "update"], Collection, (user, collection) => {
-  if (user.isViewer) {
-    return false;
-  }
   if (!collection || user.teamId !== collection.teamId) {
     return false;
   }
@@ -106,7 +105,10 @@ allow(User, ["publish", "update"], Collection, (user, collection) => {
     return true;
   }
 
-  if (collection.permission !== "read_write") {
+  if (
+    collection.permission !== CollectionPermission.ReadWrite ||
+    user.isViewer
+  ) {
     invariant(
       collection.memberships,
       "membership should be preloaded, did you forget withMembership scope?"
@@ -115,8 +117,9 @@ allow(User, ["publish", "update"], Collection, (user, collection) => {
       ...collection.memberships,
       ...collection.collectionGroupMemberships,
     ];
-    return some(allMemberships, (m) =>
-      ["read_write", "maintainer"].includes(m.permission)
+    return some(
+      allMemberships,
+      (m) => m.permission === CollectionPermission.ReadWrite
     );
   }
 
@@ -124,9 +127,6 @@ allow(User, ["publish", "update"], Collection, (user, collection) => {
 });
 
 allow(User, "delete", Collection, (user, collection) => {
-  if (user.isViewer) {
-    return false;
-  }
   if (!collection || user.teamId !== collection.teamId) {
     return false;
   }
@@ -134,7 +134,10 @@ allow(User, "delete", Collection, (user, collection) => {
     return true;
   }
 
-  if (collection.permission !== "read_write") {
+  if (
+    collection.permission !== CollectionPermission.ReadWrite ||
+    user.isViewer
+  ) {
     invariant(
       collection.memberships,
       "membership should be preloaded, did you forget withMembership scope?"
@@ -143,8 +146,9 @@ allow(User, "delete", Collection, (user, collection) => {
       ...collection.memberships,
       ...collection.collectionGroupMemberships,
     ];
-    return some(allMemberships, (m) =>
-      ["read_write", "maintainer"].includes(m.permission)
+    return some(
+      allMemberships,
+      (m) => m.permission === CollectionPermission.ReadWrite
     );
   }
 
diff --git a/server/policies/document.test.ts b/server/policies/document.test.ts
index 755c20fd1..ad0533f45 100644
--- a/server/policies/document.test.ts
+++ b/server/policies/document.test.ts
@@ -1,3 +1,4 @@
+import { CollectionPermission } from "@shared/types";
 import {
   buildUser,
   buildTeam,
@@ -14,14 +15,14 @@ afterAll(db.disconnect);
 beforeEach(db.flush);
 
 describe("read_write collection", () => {
-  it("should allow read write permissions for team member", async () => {
+  it("should allow read write permissions for member", async () => {
     const team = await buildTeam();
     const user = await buildUser({
       teamId: team.id,
     });
     const collection = await buildCollection({
       teamId: team.id,
-      permission: "read_write",
+      permission: CollectionPermission.ReadWrite,
     });
     const document = await buildDocument({
       teamId: team.id,
@@ -37,17 +38,42 @@ describe("read_write collection", () => {
     expect(abilities.share).toEqual(true);
     expect(abilities.move).toEqual(true);
   });
+
+  it("should allow read permissions for viewer", async () => {
+    const team = await buildTeam();
+    const user = await buildUser({
+      teamId: team.id,
+      isViewer: true,
+    });
+    const collection = await buildCollection({
+      teamId: team.id,
+      permission: CollectionPermission.ReadWrite,
+    });
+    const document = await buildDocument({
+      teamId: team.id,
+      collectionId: collection.id,
+    });
+    const abilities = serialize(user, document);
+    expect(abilities.read).toEqual(true);
+    expect(abilities.download).toEqual(true);
+    expect(abilities.update).toEqual(false);
+    expect(abilities.createChildDocument).toEqual(false);
+    expect(abilities.archive).toEqual(false);
+    expect(abilities.delete).toEqual(false);
+    expect(abilities.share).toEqual(false);
+    expect(abilities.move).toEqual(false);
+  });
 });
 
 describe("read collection", () => {
-  it("should allow read only permissions permissions for team member", async () => {
+  it("should allow read permissions for team member", async () => {
     const team = await buildTeam();
     const user = await buildUser({
       teamId: team.id,
     });
     const collection = await buildCollection({
       teamId: team.id,
-      permission: "read",
+      permission: CollectionPermission.Read,
     });
     const document = await buildDocument({
       teamId: team.id,
diff --git a/server/policies/document.ts b/server/policies/document.ts
index d55f46502..41806ee3e 100644
--- a/server/policies/document.ts
+++ b/server/policies/document.ts
@@ -209,9 +209,6 @@ allow(User, "delete", Document, (user, document) => {
   if (document.deletedAt) {
     return false;
   }
-  if (user.isViewer) {
-    return false;
-  }
 
   // allow deleting document without a collection
   if (document.collection && cannot(user, "update", document.collection)) {
@@ -237,9 +234,6 @@ allow(User, "permanentDelete", Document, (user, document) => {
   if (!document.deletedAt) {
     return false;
   }
-  if (user.isViewer) {
-    return false;
-  }
 
   // allow deleting document without a collection
   if (document.collection && cannot(user, "update", document.collection)) {
@@ -256,9 +250,6 @@ allow(User, "restore", Document, (user, document) => {
   if (!document.deletedAt) {
     return false;
   }
-  if (user.isViewer) {
-    return false;
-  }
 
   if (document.collection && cannot(user, "update", document.collection)) {
     return false;
diff --git a/server/policies/team.test.ts b/server/policies/team.test.ts
index f04545212..f997da3a4 100644
--- a/server/policies/team.test.ts
+++ b/server/policies/team.test.ts
@@ -22,6 +22,7 @@ it("should allow reading only", async () => {
   expect(abilities.createGroup).toEqual(false);
   expect(abilities.createIntegration).toEqual(false);
 });
+
 it("should allow admins to manage", async () => {
   const team = await buildTeam();
   const admin = await buildAdmin({
diff --git a/server/presenters/collectionGroupMembership.ts b/server/presenters/collectionGroupMembership.ts
index aa927c58f..3e9938b99 100644
--- a/server/presenters/collectionGroupMembership.ts
+++ b/server/presenters/collectionGroupMembership.ts
@@ -1,10 +1,11 @@
+import { CollectionPermission } from "@shared/types";
 import { CollectionGroup } from "@server/models";
 
 type Membership = {
   id: string;
   groupId: string;
   collectionId: string;
-  permission: string;
+  permission: CollectionPermission;
 };
 
 export default (membership: CollectionGroup): Membership => {
diff --git a/server/presenters/membership.ts b/server/presenters/membership.ts
index 99614194c..90843accd 100644
--- a/server/presenters/membership.ts
+++ b/server/presenters/membership.ts
@@ -1,10 +1,11 @@
+import { CollectionPermission } from "@shared/types";
 import { CollectionUser } from "@server/models";
 
 type Membership = {
   id: string;
   userId: string;
   collectionId: string;
-  permission: string;
+  permission: CollectionPermission;
 };
 
 export default (membership: CollectionUser): Membership => {
diff --git a/server/queues/tasks/ImportTask.ts b/server/queues/tasks/ImportTask.ts
index 5ef5b77cd..cb0dc30af 100644
--- a/server/queues/tasks/ImportTask.ts
+++ b/server/queues/tasks/ImportTask.ts
@@ -1,5 +1,6 @@
 import { S3 } from "aws-sdk";
 import { truncate } from "lodash";
+import { CollectionPermission } from "@shared/types";
 import { CollectionValidation } from "@shared/validations";
 import attachmentCreator from "@server/commands/attachmentCreator";
 import documentCreator from "@server/commands/documentCreator";
@@ -272,7 +273,7 @@ export default abstract class ImportTask extends BaseTask<Props> {
                 length: CollectionValidation.maxDescriptionLength,
               }),
               createdById: fileOperation.userId,
-              permission: "read_write",
+              permission: CollectionPermission.ReadWrite,
             },
             transaction,
           });
@@ -292,7 +293,7 @@ export default abstract class ImportTask extends BaseTask<Props> {
                 teamId: fileOperation.teamId,
                 createdById: fileOperation.userId,
                 name,
-                permission: "read_write",
+                permission: CollectionPermission.ReadWrite,
               },
               { transaction }
             );
diff --git a/server/routes/api/__snapshots__/collections.test.ts.snap b/server/routes/api/__snapshots__/collections.test.ts.snap
index 011369c38..9738e34b7 100644
--- a/server/routes/api/__snapshots__/collections.test.ts.snap
+++ b/server/routes/api/__snapshots__/collections.test.ts.snap
@@ -130,12 +130,3 @@ Object {
   "status": 401,
 }
 `;
-
-exports[`#collections.users should require authentication 1`] = `
-Object {
-  "error": "authentication_required",
-  "message": "Authentication required",
-  "ok": false,
-  "status": 401,
-}
-`;
diff --git a/server/routes/api/collections.test.ts b/server/routes/api/collections.test.ts
index dcb66c242..9c8e7b9a2 100644
--- a/server/routes/api/collections.test.ts
+++ b/server/routes/api/collections.test.ts
@@ -1,3 +1,4 @@
+import { CollectionPermission } from "@shared/types";
 import { colorPalette } from "@shared/utils/collections";
 import { Document, CollectionUser, CollectionGroup } from "@server/models";
 import {
@@ -101,7 +102,7 @@ describe("#collections.list", () => {
     });
     await collection.$add("group", group, {
       through: {
-        permission: "read",
+        permission: CollectionPermission.Read,
         createdById: user.id,
       },
     });
@@ -293,7 +294,7 @@ describe("#collections.export", () => {
       createdById: admin.id,
       collectionId: collection.id,
       userId: admin.id,
-      permission: "read_write",
+      permission: CollectionPermission.ReadWrite,
     });
     const res = await server.post("/api/collections.export", {
       body: {
@@ -320,7 +321,7 @@ describe("#collections.export", () => {
     });
     await collection.$add("group", group, {
       through: {
-        permission: "read_write",
+        permission: CollectionPermission.ReadWrite,
         createdById: admin.id,
       },
     });
@@ -671,48 +672,6 @@ describe("#collections.remove_user", () => {
   });
 });
 
-describe("#collections.users", () => {
-  it("should return users in private collection", async () => {
-    const { collection, user } = await seed();
-    collection.permission = null;
-    await collection.save();
-    await CollectionUser.create({
-      createdById: user.id,
-      collectionId: collection.id,
-      userId: user.id,
-      permission: "read",
-    });
-    const res = await server.post("/api/collections.users", {
-      body: {
-        token: user.getJwtToken(),
-        id: collection.id,
-      },
-    });
-    const body = await res.json();
-    expect(res.status).toEqual(200);
-    expect(body.data.length).toEqual(1);
-  });
-
-  it("should require authentication", async () => {
-    const res = await server.post("/api/collections.users");
-    const body = await res.json();
-    expect(res.status).toEqual(401);
-    expect(body).toMatchSnapshot();
-  });
-
-  it("should require authorization", async () => {
-    const { collection } = await seed();
-    const user = await buildUser();
-    const res = await server.post("/api/collections.users", {
-      body: {
-        token: user.getJwtToken(),
-        id: collection.id,
-      },
-    });
-    expect(res.status).toEqual(403);
-  });
-});
-
 describe("#collections.group_memberships", () => {
   it("should return groups in private collection", async () => {
     const user = await buildUser();
@@ -727,13 +686,13 @@ describe("#collections.group_memberships", () => {
       createdById: user.id,
       collectionId: collection.id,
       userId: user.id,
-      permission: "read_write",
+      permission: CollectionPermission.ReadWrite,
     });
     await CollectionGroup.create({
       createdById: user.id,
       collectionId: collection.id,
       groupId: group.id,
-      permission: "read_write",
+      permission: CollectionPermission.ReadWrite,
     });
     const res = await server.post("/api/collections.group_memberships", {
       body: {
@@ -747,7 +706,7 @@ describe("#collections.group_memberships", () => {
     expect(body.data.groups[0].id).toEqual(group.id);
     expect(body.data.collectionGroupMemberships.length).toEqual(1);
     expect(body.data.collectionGroupMemberships[0].permission).toEqual(
-      "read_write"
+      CollectionPermission.ReadWrite
     );
   });
 
@@ -769,19 +728,19 @@ describe("#collections.group_memberships", () => {
       createdById: user.id,
       collectionId: collection.id,
       userId: user.id,
-      permission: "read_write",
+      permission: CollectionPermission.ReadWrite,
     });
     await CollectionGroup.create({
       createdById: user.id,
       collectionId: collection.id,
       groupId: group.id,
-      permission: "read_write",
+      permission: CollectionPermission.ReadWrite,
     });
     await CollectionGroup.create({
       createdById: user.id,
       collectionId: collection.id,
       groupId: group2.id,
-      permission: "read_write",
+      permission: CollectionPermission.ReadWrite,
     });
     const res = await server.post("/api/collections.group_memberships", {
       body: {
@@ -812,25 +771,25 @@ describe("#collections.group_memberships", () => {
       createdById: user.id,
       collectionId: collection.id,
       userId: user.id,
-      permission: "read_write",
+      permission: CollectionPermission.ReadWrite,
     });
     await CollectionGroup.create({
       createdById: user.id,
       collectionId: collection.id,
       groupId: group.id,
-      permission: "read_write",
+      permission: CollectionPermission.ReadWrite,
     });
     await CollectionGroup.create({
       createdById: user.id,
       collectionId: collection.id,
       groupId: group2.id,
-      permission: "maintainer",
+      permission: CollectionPermission.Read,
     });
     const res = await server.post("/api/collections.group_memberships", {
       body: {
         token: user.getJwtToken(),
         id: collection.id,
-        permission: "maintainer",
+        permission: CollectionPermission.Read,
       },
     });
     const body = await res.json();
@@ -871,7 +830,7 @@ describe("#collections.memberships", () => {
       createdById: user.id,
       collectionId: collection.id,
       userId: user.id,
-      permission: "read_write",
+      permission: CollectionPermission.ReadWrite,
     });
     const res = await server.post("/api/collections.memberships", {
       body: {
@@ -884,7 +843,9 @@ describe("#collections.memberships", () => {
     expect(body.data.users.length).toEqual(1);
     expect(body.data.users[0].id).toEqual(user.id);
     expect(body.data.memberships.length).toEqual(1);
-    expect(body.data.memberships[0].permission).toEqual("read_write");
+    expect(body.data.memberships[0].permission).toEqual(
+      CollectionPermission.ReadWrite
+    );
   });
 
   it("should allow filtering members in collection by name", async () => {
@@ -896,13 +857,13 @@ describe("#collections.memberships", () => {
       createdById: user.id,
       collectionId: collection.id,
       userId: user.id,
-      permission: "read_write",
+      permission: CollectionPermission.ReadWrite,
     });
     await CollectionUser.create({
       createdById: user2.id,
       collectionId: collection.id,
       userId: user2.id,
-      permission: "read_write",
+      permission: CollectionPermission.ReadWrite,
     });
     const res = await server.post("/api/collections.memberships", {
       body: {
@@ -924,19 +885,19 @@ describe("#collections.memberships", () => {
       createdById: user.id,
       collectionId: collection.id,
       userId: user.id,
-      permission: "read_write",
+      permission: CollectionPermission.ReadWrite,
     });
     await CollectionUser.create({
       createdById: user2.id,
       collectionId: collection.id,
       userId: user2.id,
-      permission: "maintainer",
+      permission: CollectionPermission.Read,
     });
     const res = await server.post("/api/collections.memberships", {
       body: {
         token: user.getJwtToken(),
         id: collection.id,
-        permission: "maintainer",
+        permission: CollectionPermission.Read,
       },
     });
     const body = await res.json();
@@ -1000,7 +961,7 @@ describe("#collections.info", () => {
       collectionId: collection.id,
       userId: user.id,
       createdById: user.id,
-      permission: "read",
+      permission: CollectionPermission.Read,
     });
     const res = await server.post("/api/collections.info", {
       body: {
@@ -1282,20 +1243,20 @@ describe("#collections.update", () => {
       collectionId: collection.id,
       userId: user.id,
       createdById: user.id,
-      permission: "read_write",
+      permission: CollectionPermission.ReadWrite,
     });
     const res = await server.post("/api/collections.update", {
       body: {
         token: user.getJwtToken(),
         id: collection.id,
-        permission: "read_write",
+        permission: CollectionPermission.ReadWrite,
         name: "Test",
       },
     });
     const body = await res.json();
     expect(res.status).toEqual(200);
     expect(body.data.name).toBe("Test");
-    expect(body.data.permission).toBe("read_write");
+    expect(body.data.permission).toBe(CollectionPermission.ReadWrite);
     // ensure we return with a write level policy
     expect(body.policies.length).toBe(1);
     expect(body.policies[0].abilities.update).toBe(true);
@@ -1309,7 +1270,7 @@ describe("#collections.update", () => {
       collectionId: collection.id,
       userId: user.id,
       createdById: user.id,
-      permission: "read_write",
+      permission: CollectionPermission.ReadWrite,
     });
     const res = await server.post("/api/collections.update", {
       body: {
@@ -1340,7 +1301,7 @@ describe("#collections.update", () => {
     });
     await collection.$add("group", group, {
       through: {
-        permission: "read_write",
+        permission: CollectionPermission.ReadWrite,
         createdById: user.id,
       },
     });
@@ -1365,7 +1326,7 @@ describe("#collections.update", () => {
       collectionId: collection.id,
       userId: user.id,
       createdById: user.id,
-      permission: "read",
+      permission: CollectionPermission.Read,
     });
     const res = await server.post("/api/collections.update", {
       body: {
@@ -1508,7 +1469,7 @@ describe("#collections.delete", () => {
     });
     await collection.$add("group", group, {
       through: {
-        permission: "read_write",
+        permission: CollectionPermission.ReadWrite,
         createdById: user.id,
       },
     });
diff --git a/server/routes/api/collections.ts b/server/routes/api/collections.ts
index 1d44de836..684d51683 100644
--- a/server/routes/api/collections.ts
+++ b/server/routes/api/collections.ts
@@ -3,6 +3,7 @@ import invariant from "invariant";
 import Router from "koa-router";
 import { Sequelize, Op, WhereOptions } from "sequelize";
 import { randomElement } from "@shared/random";
+import { CollectionPermission } from "@shared/types";
 import { colorPalette } from "@shared/utils/collections";
 import { RateLimiterStrategy } from "@server/RateLimiter";
 import collectionExporter from "@server/commands/collectionExporter";
@@ -45,6 +46,7 @@ import {
   assertPresent,
   assertHexColor,
   assertIndexCharacters,
+  assertCollectionPermission,
 } from "@server/validation";
 import pagination from "./middlewares/pagination";
 
@@ -199,9 +201,10 @@ router.post(
 );
 
 router.post("collections.add_group", auth(), async (ctx) => {
-  const { id, groupId, permission = "read_write" } = ctx.body;
+  const { id, groupId, permission = CollectionPermission.ReadWrite } = ctx.body;
   assertUuid(id, "id is required");
   assertUuid(groupId, "groupId is required");
+  assertCollectionPermission(permission);
 
   const collection = await Collection.scope({
     method: ["withMembership", ctx.state.user.id],
@@ -340,7 +343,7 @@ router.post(
 );
 
 router.post("collections.add_user", auth(), async (ctx) => {
-  const { id, userId, permission = "read_write" } = ctx.body;
+  const { id, userId, permission } = ctx.body;
   assertUuid(id, "id is required");
   assertUuid(userId, "userId is required");
 
@@ -359,11 +362,15 @@ router.post("collections.add_user", auth(), async (ctx) => {
     },
   });
 
+  if (permission) {
+    assertCollectionPermission(permission);
+  }
+
   if (!membership) {
     membership = await CollectionUser.create({
       collectionId: id,
       userId,
-      permission,
+      permission: permission || user.defaultCollectionPermission,
       createdById: ctx.state.user.id,
     });
   } else if (permission) {
@@ -422,24 +429,6 @@ router.post("collections.remove_user", auth(), async (ctx) => {
   };
 });
 
-// DEPRECATED: Use collection.memberships which has pagination, filtering and permissions
-router.post("collections.users", auth(), async (ctx) => {
-  const { id } = ctx.body;
-  assertUuid(id, "id is required");
-  const { user } = ctx.state;
-
-  const collection = await Collection.scope({
-    method: ["withMembership", user.id],
-  }).findByPk(id);
-  authorize(user, "read", collection);
-
-  const users = await collection.$get("users");
-
-  ctx.body = {
-    data: users.map((user) => presentUser(user)),
-  };
-});
-
 router.post("collections.memberships", auth(), pagination(), async (ctx) => {
   const { id, query, permission } = ctx.body;
   assertUuid(id, "id is required");
@@ -464,6 +453,7 @@ router.post("collections.memberships", auth(), pagination(), async (ctx) => {
   }
 
   if (permission) {
+    assertCollectionPermission(permission);
     where = { ...where, permission };
   }
 
@@ -575,16 +565,19 @@ router.post("collections.update", auth(), async (ctx) => {
   }).findByPk(id);
   authorize(user, "update", collection);
 
-  // we're making this collection have no default access, ensure that the current
-  // user has a read-write membership so that at least they can edit it
-  if (permission !== "read_write" && collection.permission === "read_write") {
+  // we're making this collection have no default access, ensure that the
+  // current user has a read-write membership so that at least they can edit it
+  if (
+    permission !== CollectionPermission.ReadWrite &&
+    collection.permission === CollectionPermission.ReadWrite
+  ) {
     await CollectionUser.findOrCreate({
       where: {
         collectionId: collection.id,
         userId: user.id,
       },
       defaults: {
-        permission: "read_write",
+        permission: CollectionPermission.ReadWrite,
         createdById: user.id,
       },
     });
@@ -610,12 +603,9 @@ router.post("collections.update", auth(), async (ctx) => {
   }
 
   if (permission !== undefined) {
-    // frontend sends empty string
-    assertIn(
-      permission,
-      ["read_write", "read", "", null],
-      "Invalid permission"
-    );
+    if (permission) {
+      assertCollectionPermission(permission);
+    }
     privacyChanged = permission !== collection.permission;
     collection.permission = permission ? permission : null;
   }
diff --git a/server/routes/api/documents.test.ts b/server/routes/api/documents.test.ts
index 4dfe8648e..b87eafb43 100644
--- a/server/routes/api/documents.test.ts
+++ b/server/routes/api/documents.test.ts
@@ -1,3 +1,4 @@
+import { CollectionPermission } from "@shared/types";
 import {
   Document,
   View,
@@ -800,7 +801,7 @@ describe("#documents.list", () => {
       createdById: user.id,
       collectionId: collection.id,
       userId: user.id,
-      permission: "read",
+      permission: CollectionPermission.Read,
     });
     const res = await server.post("/api/documents.list", {
       body: {
@@ -1244,7 +1245,7 @@ describe("#documents.search", () => {
       createdById: user.id,
       collectionId: collection.id,
       userId: user.id,
-      permission: "read",
+      permission: CollectionPermission.Read,
     });
     const document = await buildDocument({
       title: "search term",
@@ -2005,7 +2006,7 @@ describe("#documents.update", () => {
       createdById: user.id,
       collectionId: collection.id,
       userId: user.id,
-      permission: "read_write",
+      permission: CollectionPermission.ReadWrite,
     });
     const res = await server.post("/api/documents.update", {
       body: {
@@ -2094,7 +2095,7 @@ describe("#documents.update", () => {
       collectionId: collection.id,
       userId: admin.id,
       createdById: admin.id,
-      permission: "read_write",
+      permission: CollectionPermission.ReadWrite,
     });
     const res = await server.post("/api/documents.update", {
       body: {
@@ -2118,7 +2119,7 @@ describe("#documents.update", () => {
       collectionId: collection.id,
       userId: user.id,
       createdById: user.id,
-      permission: "read",
+      permission: CollectionPermission.Read,
     });
     const res = await server.post("/api/documents.update", {
       body: {
@@ -2133,7 +2134,7 @@ describe("#documents.update", () => {
 
   it("does not allow editing in read-only collection", async () => {
     const { user, document, collection } = await seed();
-    collection.permission = "read";
+    collection.permission = CollectionPermission.Read;
     await collection.save();
     const res = await server.post("/api/documents.update", {
       body: {
diff --git a/server/routes/api/documents.ts b/server/routes/api/documents.ts
index 8a11dadf1..1973808c3 100644
--- a/server/routes/api/documents.ts
+++ b/server/routes/api/documents.ts
@@ -326,76 +326,71 @@ router.post("documents.viewed", auth(), pagination(), async (ctx) => {
   };
 });
 
-router.post(
-  "documents.drafts",
-  auth({ member: true }),
-  pagination(),
-  async (ctx) => {
-    let { direction } = ctx.body;
-    const { collectionId, dateFilter, sort = "updatedAt" } = ctx.body;
+router.post("documents.drafts", auth(), pagination(), async (ctx) => {
+  let { direction } = ctx.body;
+  const { collectionId, dateFilter, sort = "updatedAt" } = ctx.body;
 
-    assertSort(sort, Document);
-    if (direction !== "ASC") {
-      direction = "DESC";
-    }
-    const { user } = ctx.state;
-
-    if (collectionId) {
-      assertUuid(collectionId, "collectionId must be a UUID");
-      const collection = await Collection.scope({
-        method: ["withMembership", user.id],
-      }).findByPk(collectionId);
-      authorize(user, "read", collection);
-    }
-
-    const collectionIds = collectionId
-      ? [collectionId]
-      : await user.collectionIds();
-    const where: WhereOptions<Document> = {
-      createdById: user.id,
-      collectionId: collectionIds,
-      publishedAt: {
-        [Op.is]: null,
-      },
-    };
-
-    if (dateFilter) {
-      assertIn(
-        dateFilter,
-        ["day", "week", "month", "year"],
-        "dateFilter must be one of day,week,month,year"
-      );
-      where.updatedAt = {
-        [Op.gte]: subtractDate(new Date(), dateFilter),
-      };
-    } else {
-      delete where.updatedAt;
-    }
-
-    const collectionScope: Readonly<ScopeOptions> = {
-      method: ["withCollectionPermissions", user.id],
-    };
-    const documents = await Document.scope([
-      "defaultScope",
-      collectionScope,
-    ]).findAll({
-      where,
-      order: [[sort, direction]],
-      offset: ctx.state.pagination.offset,
-      limit: ctx.state.pagination.limit,
-    });
-    const data = await Promise.all(
-      documents.map((document) => presentDocument(document))
-    );
-    const policies = presentPolicies(user, documents);
-
-    ctx.body = {
-      pagination: ctx.state.pagination,
-      data,
-      policies,
-    };
+  assertSort(sort, Document);
+  if (direction !== "ASC") {
+    direction = "DESC";
   }
-);
+  const { user } = ctx.state;
+
+  if (collectionId) {
+    assertUuid(collectionId, "collectionId must be a UUID");
+    const collection = await Collection.scope({
+      method: ["withMembership", user.id],
+    }).findByPk(collectionId);
+    authorize(user, "read", collection);
+  }
+
+  const collectionIds = collectionId
+    ? [collectionId]
+    : await user.collectionIds();
+  const where: WhereOptions<Document> = {
+    createdById: user.id,
+    collectionId: collectionIds,
+    publishedAt: {
+      [Op.is]: null,
+    },
+  };
+
+  if (dateFilter) {
+    assertIn(
+      dateFilter,
+      ["day", "week", "month", "year"],
+      "dateFilter must be one of day,week,month,year"
+    );
+    where.updatedAt = {
+      [Op.gte]: subtractDate(new Date(), dateFilter),
+    };
+  } else {
+    delete where.updatedAt;
+  }
+
+  const collectionScope: Readonly<ScopeOptions> = {
+    method: ["withCollectionPermissions", user.id],
+  };
+  const documents = await Document.scope([
+    "defaultScope",
+    collectionScope,
+  ]).findAll({
+    where,
+    order: [[sort, direction]],
+    offset: ctx.state.pagination.offset,
+    limit: ctx.state.pagination.limit,
+  });
+  const data = await Promise.all(
+    documents.map((document) => presentDocument(document))
+  );
+  const policies = presentPolicies(user, documents);
+
+  ctx.body = {
+    pagination: ctx.state.pagination,
+    data,
+    policies,
+  };
+});
 
 router.post(
   "documents.info",
@@ -777,7 +772,7 @@ router.post("documents.templatize", auth({ member: true }), async (ctx) => {
   };
 });
 
-router.post("documents.update", auth({ member: true }), async (ctx) => {
+router.post("documents.update", auth(), async (ctx) => {
   const {
     id,
     title,
@@ -837,7 +832,7 @@ router.post("documents.update", auth({ member: true }), async (ctx) => {
   };
 });
 
-router.post("documents.move", auth({ member: true }), async (ctx) => {
+router.post("documents.move", auth(), async (ctx) => {
   const { id, collectionId, parentDocumentId, index } = ctx.body;
   assertUuid(id, "id must be a uuid");
   assertUuid(collectionId, "collectionId must be a uuid");
@@ -903,7 +898,7 @@ router.post("documents.move", auth({ member: true }), async (ctx) => {
   };
 });
 
-router.post("documents.archive", auth({ member: true }), async (ctx) => {
+router.post("documents.archive", auth(), async (ctx) => {
   const { id } = ctx.body;
   assertPresent(id, "id is required");
   const { user } = ctx.state;
@@ -932,7 +927,7 @@ router.post("documents.archive", auth({ member: true }), async (ctx) => {
   };
 });
 
-router.post("documents.delete", auth({ member: true }), async (ctx) => {
+router.post("documents.delete", auth(), async (ctx) => {
   const { id, permanent } = ctx.body;
   assertPresent(id, "id is required");
   const { user } = ctx.state;
@@ -993,7 +988,7 @@ router.post("documents.delete", auth({ member: true }), async (ctx) => {
   };
 });
 
-router.post("documents.unpublish", auth({ member: true }), async (ctx) => {
+router.post("documents.unpublish", auth(), async (ctx) => {
   const { id } = ctx.body;
   assertPresent(id, "id is required");
   const { user } = ctx.state;
@@ -1027,7 +1022,7 @@ router.post("documents.unpublish", auth({ member: true }), async (ctx) => {
   };
 });
 
-router.post("documents.import", auth({ member: true }), async (ctx) => {
+router.post("documents.import", auth(), async (ctx) => {
   const { publish, collectionId, parentDocumentId, index } = ctx.body;
 
   if (!ctx.is("multipart/form-data")) {
@@ -1052,7 +1047,6 @@ router.post("documents.import", auth({ member: true }), async (ctx) => {
     assertPositiveInteger(index, "index must be an integer (>=0)");
   }
   const { user } = ctx.state;
-  authorize(user, "createDocument", user.team);
 
   const collection = await Collection.scope({
     method: ["withMembership", user.id],
@@ -1110,7 +1104,7 @@ router.post("documents.import", auth({ member: true }), async (ctx) => {
   });
 });
 
-router.post("documents.create", auth({ member: true }), async (ctx) => {
+router.post("documents.create", auth(), async (ctx) => {
   const {
     title = "",
     text = "",
@@ -1132,7 +1126,6 @@ router.post("documents.create", auth({ member: true }), async (ctx) => {
     assertPositiveInteger(index, "index must be an integer (>=0)");
   }
   const { user } = ctx.state;
-  authorize(user, "createDocument", user.team);
 
   const collection = await Collection.scope({
     method: ["withMembership", user.id],
diff --git a/server/routes/api/shares.test.ts b/server/routes/api/shares.test.ts
index 0f5c6324c..747003bdf 100644
--- a/server/routes/api/shares.test.ts
+++ b/server/routes/api/shares.test.ts
@@ -1,3 +1,4 @@
+import { CollectionPermission } from "@shared/types";
 import { CollectionUser } from "@server/models";
 import {
   buildUser,
@@ -164,7 +165,7 @@ describe("#shares.create", () => {
       createdById: user.id,
       collectionId: collection.id,
       userId: user.id,
-      permission: "read",
+      permission: CollectionPermission.Read,
     });
     const res = await server.post("/api/shares.create", {
       body: {
diff --git a/server/routes/api/views.test.ts b/server/routes/api/views.test.ts
index 7c0e32a70..bed41ebcb 100644
--- a/server/routes/api/views.test.ts
+++ b/server/routes/api/views.test.ts
@@ -1,3 +1,4 @@
+import { CollectionPermission } from "@shared/types";
 import { View, CollectionUser } from "@server/models";
 import { buildUser } from "@server/test/factories";
 import { seed, getTestDatabase, getTestServer } from "@server/test/support";
@@ -56,7 +57,7 @@ describe("#views.list", () => {
       createdById: user.id,
       collectionId: collection.id,
       userId: user.id,
-      permission: "read",
+      permission: CollectionPermission.Read,
     });
     await View.incrementOrCreate({
       documentId: document.id,
@@ -121,7 +122,7 @@ describe("#views.create", () => {
       createdById: user.id,
       collectionId: collection.id,
       userId: user.id,
-      permission: "read",
+      permission: CollectionPermission.Read,
     });
     const res = await server.post("/api/views.create", {
       body: {
diff --git a/server/test/factories.ts b/server/test/factories.ts
index b04ae4b3a..a38c7af59 100644
--- a/server/test/factories.ts
+++ b/server/test/factories.ts
@@ -1,4 +1,5 @@
 import { v4 as uuidv4 } from "uuid";
+import { CollectionPermission } from "@shared/types";
 import {
   Share,
   Team,
@@ -271,7 +272,7 @@ export async function buildCollection(
     name: `Test Collection ${count}`,
     description: "Test collection description",
     createdById: overrides.userId,
-    permission: "read_write",
+    permission: CollectionPermission.ReadWrite,
     ...overrides,
   });
 }
diff --git a/server/test/support.ts b/server/test/support.ts
index 3b10629bb..e75dcfdb0 100644
--- a/server/test/support.ts
+++ b/server/test/support.ts
@@ -1,5 +1,6 @@
 import TestServer from "fetch-test-server";
 import { v4 as uuidv4 } from "uuid";
+import { CollectionPermission } from "@shared/types";
 import { sequelize as db } from "@server/database/sequelize";
 import { User, Document, Collection, Team } from "@server/models";
 import webService from "@server/services/web";
@@ -68,7 +69,7 @@ export const seed = async () => {
         urlId: "collection",
         teamId: team.id,
         createdById: user.id,
-        permission: "read_write",
+        permission: CollectionPermission.ReadWrite,
       },
       {
         transaction,
diff --git a/server/types.ts b/server/types.ts
index c8aa27db3..08d7431ce 100644
--- a/server/types.ts
+++ b/server/types.ts
@@ -1,7 +1,7 @@
 import { Context } from "koa";
 import { FileOperation, Team, User } from "./models";
 
-export enum AuthenticationTypes {
+export enum AuthenticationType {
   API = "api",
   APP = "app",
 }
@@ -10,7 +10,7 @@ export type ContextWithState = Context & {
   state: {
     user: User;
     token: string;
-    authType: AuthenticationTypes;
+    authType: AuthenticationType;
   };
 };
 
diff --git a/server/validation.ts b/server/validation.ts
index b3b916121..86cb71572 100644
--- a/server/validation.ts
+++ b/server/validation.ts
@@ -1,5 +1,6 @@
 import { isArrayLike } from "lodash";
 import validator from "validator";
+import { CollectionPermission } from "../shared/types";
 import { validateColorHex } from "../shared/utils/color";
 import { validateIndexCharacters } from "../shared/utils/indexCharacters";
 import { ParamRequiredError, ValidationError } from "./errors";
@@ -104,3 +105,10 @@ export const assertIndexCharacters = (
     throw ValidationError(message);
   }
 };
+
+export const assertCollectionPermission = (
+  value: string,
+  message = "Invalid permission"
+) => {
+  assertIn(value, [...Object.values(CollectionPermission), null], message);
+};
diff --git a/shared/i18n/locales/en_US/translation.json b/shared/i18n/locales/en_US/translation.json
index e65a2f84e..6bb792195 100644
--- a/shared/i18n/locales/en_US/translation.json
+++ b/shared/i18n/locales/en_US/translation.json
@@ -389,8 +389,8 @@
   "Public document sharing permissions were updated": "Public document sharing permissions were updated",
   "Could not update public document sharing": "Could not update public document sharing",
   "The <em>{{ collectionName }}</em> collection is private. Team members have no access to it by default.": "The <em>{{ collectionName }}</em> collection is private. Team members have no access to it by default.",
-  "Team members can view documents in the <em>{{ collectionName }}</em> collection by default.": "Team members can view documents in the <em>{{ collectionName }}</em> collection by default.",
   "Team members can view and edit documents in the <em>{{ collectionName }}</em> collection by\n          default.": "Team members can view and edit documents in the <em>{{ collectionName }}</em> collection by\n          default.",
+  "Team members can view documents in the <em>{{ collectionName }}</em> collection by default.": "Team members can view documents in the <em>{{ collectionName }}</em> collection by default.",
   "When enabled, documents can be shared publicly on the internet.": "When enabled, documents can be shared publicly on the internet.",
   "Public sharing is currently disabled in the team security settings.": "Public sharing is currently disabled in the team security settings.",
   "Additional access": "Additional access",
diff --git a/shared/types.ts b/shared/types.ts
index 0b68ed2c0..131fe0b6b 100644
--- a/shared/types.ts
+++ b/shared/types.ts
@@ -28,6 +28,11 @@ export enum IntegrationType {
   Embed = "embed",
 }
 
+export enum CollectionPermission {
+  Read = "read",
+  ReadWrite = "read_write",
+}
+
 export type IntegrationSettings<T> = T extends IntegrationType.Embed
   ? { url: string }
   : T extends IntegrationType.Post