Fixes access rights with multiple groups (#4482)

* Fixes access rights with multiple groups

* ADR

Author: ildyria

app/DTO/EffectiveAccessPermission.php

@@ -0,0 +1,46 @@
+<?php
+
+/**
+ * SPDX-License-Identifier: MIT
+ * Copyright (c) 2017-2018 Tobias Reich
+ * Copyright (c) 2018-2026 LycheeOrg.
+ */
+
+namespace App\DTO;
+
+use App\Models\AccessPermission;
+use Illuminate\Support\Collection;
+
+/**
+ * Read-only, non-persistable capability snapshot for the current user on an
+ * album: the union (logical OR) of every applicable AccessPermission row's
+ * grant flags, independent of row order or source (direct-user vs. group).
+ */
+final readonly class EffectiveAccessPermission
+{
+	public function __construct(
+		public bool $grants_full_photo_access = false,
+		public bool $grants_download = false,
+		public bool $grants_upload = false,
+		public bool $grants_edit = false,
+		public bool $grants_delete = false,
+	) {
+	}
+
+	/**
+	 * Merge every given AccessPermission row into a single snapshot: each
+	 * grant flag is true if it is true on at least one row.
+	 *
+	 * @param Collection<int,AccessPermission> $permissions
+	 */
+	public static function merge(Collection $permissions): self
+	{
+		return new self(
+			grants_full_photo_access: $permissions->contains(fn (AccessPermission $p) => $p->grants_full_photo_access),
+			grants_download: $permissions->contains(fn (AccessPermission $p) => $p->grants_download),
+			grants_upload: $permissions->contains(fn (AccessPermission $p) => $p->grants_upload),
+			grants_edit: $permissions->contains(fn (AccessPermission $p) => $p->grants_edit),
+			grants_delete: $permissions->contains(fn (AccessPermission $p) => $p->grants_delete),
+		);
+	}
+}

app/Models/Album.php

@@ -10,6 +10,7 @@
 
 use App\Actions\Album\Delete;
 use App\DTO\AlbumSortingCriterion;
+use App\DTO\EffectiveAccessPermission;
 use App\Enum\AlbumTitleColor;
 use App\Enum\AlbumTitlePosition;
 use App\Enum\AspectRatioType;
@@ -84,7 +85,7 @@
  *
  * @property Collection<int,AccessPermission> $access_permissions
  * @property int|null                         $access_permissions_count
- * @property AccessPermission|null            $current_user_permissions
+ * @property EffectiveAccessPermission|null   $current_user_permissions
  * @property AccessPermission|null            $public_permissions
  * @property Collection<int,User>             $shared_with
  * @property int|null                         $shared_with_count

app/Models/BaseAlbumImpl.php

@@ -11,6 +11,7 @@
 use App\Constants\AccessPermissionConstants as APC;
 use App\Constants\RandomID;
 use App\Contracts\Models\HasRandomID;
+use App\DTO\EffectiveAccessPermission;
 use App\DTO\PhotoSortingCriterion;
 use App\Enum\ColumnSortingType;
 use App\Enum\OrderSortingType;
@@ -256,18 +257,27 @@ public function access_permissions(): HasMany
 	}
 
 	/**
-	 * Returns the relationship between an album and its associated current user permissions.
+	 * Returns the merged, effective permissions of the current user on this album.
+	 *
+	 * Combines the direct-user AccessPermission row (if any) with every row for
+	 * a group the user belongs to: each grant flag is the logical OR across all
+	 * matching rows, independent of row order (there is no precedence between
+	 * a direct-user row and a group row — the most permissive grant wins).
 	 */
-	public function current_user_permissions(): AccessPermission|null
+	public function current_user_permissions(): EffectiveAccessPermission|null
 	{
 		if (Auth::guest()) {
 			return null; // No permissions for guests
 		}
 
 		$user = Auth::user();
+		$group_ids = $user->user_groups->map(fn ($g) => $g->id)->all();
+
+		$matching = $this->access_permissions->filter(
+			fn (AccessPermission $p) => $p->user_id === $user->id || in_array($p->user_group_id, $group_ids, true)
+		);
 
-		return $this->access_permissions->first(fn (AccessPermission $p) => $p->user_id === $user->id)
-			?? $this->access_permissions->first(fn (AccessPermission $p) => in_array($p->user_group_id, $user->user_groups->map(fn ($g) => $g->id)->all(), true));
+		return $matching->isEmpty() ? null : EffectiveAccessPermission::merge($matching);
 	}
 
 	/**

app/Models/Extensions/BaseAlbum.php

@@ -11,6 +11,7 @@
 use App\Constants\RandomID;
 use App\Contracts\Models\AbstractAlbum;
 use App\Contracts\Models\HasRandomID;
+use App\DTO\EffectiveAccessPermission;
 use App\DTO\PhotoSortingCriterion;
 use App\Enum\PhotoLayoutType;
 use App\Enum\TimelinePhotoGranularity;
@@ -115,7 +116,7 @@ public function access_permissions(): HasMany
 	/**
 	 * Returns the relationship between an album and its associated current user permissions.
 	 */
-	public function current_user_permissions(): AccessPermission|null
+	public function current_user_permissions(): EffectiveAccessPermission|null
 	{
 		return $this->base_class->current_user_permissions();
 	}

app/Models/PersonAlbum.php

@@ -9,6 +9,7 @@
 namespace App\Models;
 
 use App\Constants\PersonAlbumPersons;
+use App\DTO\EffectiveAccessPermission;
 use App\Exceptions\InvalidPropertyException;
 use App\ModelFunctions\HasAbstractAlbumProperties;
 use App\Models\Builders\PersonAlbumBuilder;
@@ -38,7 +39,7 @@
  * @property int|null                          $shared_with_count
  * @property Collection<int, AccessPermission> $access_permissions
  * @property int|null                          $access_permissions_count
- * @property AccessPermission|null             $current_user_permissions
+ * @property EffectiveAccessPermission|null    $current_user_permissions
  * @property AccessPermission|null             $public_permissions
  *
  * @method static PersonAlbumBuilder|PersonAlbum addSelect($column)

app/Models/TagAlbum.php

@@ -8,6 +8,7 @@
 
 namespace App\Models;
 
+use App\DTO\EffectiveAccessPermission;
 use App\Exceptions\InvalidPropertyException;
 use App\ModelFunctions\HasAbstractAlbumProperties;
 use App\Models\Builders\TagAlbumBuilder;
@@ -39,7 +40,7 @@
  * @property int|null                          $shared_with_count
  * @property Collection<int, AccessPermission> $access_permissions
  * @property int|null                          $access_permissions_count
- * @property AccessPermission|null             $current_user_permissions
+ * @property EffectiveAccessPermission|null    $current_user_permissions
  * @property AccessPermission|null             $public_permissions
  * @property Collection<int, User>             $shared_with
  *