fix: Admins cannot query permissions on private collections (#7145)

* fix: Admins have permission to see existence of all collections (in settings)

* fix: Current user filtered from suggestions. As an admin managing other collections this is limiting

* test
This commit is contained in:
Tom Moor
2024-06-25 08:28:32 -04:00
committed by GitHub
parent beabd32e6a
commit 29a653aaeb
4 changed files with 19 additions and 4 deletions

View File

@@ -138,7 +138,7 @@ allow(User, "createChildDocument", Document, (actor, document) =>
can(actor, "update", document),
or(
includesMembership(document, [DocumentPermission.Admin]),
can(actor, "read", document?.collection)
can(actor, "readDocument", document?.collection)
),
!document?.isDraft,
!document?.template