fix: Improved support for group authorization for Album delete & edit (#4317)

Author: ildyria

app/Policies/AlbumPolicy.php

@@ -285,9 +285,11 @@ public function canDelete(User $user, ?AbstractAlbum $abstract_album = null): bo
 		if (
 			AccessPermission::query()
 			->where(APC::BASE_ALBUM_ID, '=', $abstract_album->parent_id)
-			->where(APC::USER_ID, '=', $user->id)
+			->where(fn ($query) => $query->where(APC::USER_ID, '=', $user->id)
+					->orWhereIn(APC::USER_GROUP_ID, $user->user_groups->pluck('id'))
+			)
 			->where(APC::GRANTS_DELETE, '=', true)
-			->count() === 1
+			->count() >= 1
 		) {
 			return true;
 		}
@@ -379,9 +381,13 @@ public function canEditById(User $user, array $album_ids): bool
 
 		if (
 			AccessPermission::query()
+			->select(APC::BASE_ALBUM_ID)
 			->whereIn(APC::BASE_ALBUM_ID, $album_ids)
-			->where(APC::USER_ID, '=', $user->id)
+			->where(fn ($query) => $query->where(APC::USER_ID, '=', $user->id)
+					->orWhereIn(APC::USER_GROUP_ID, $user->user_groups->pluck('id'))
+			)
 			->where(APC::GRANTS_EDIT, '=', true)
+			->distinct()
 			->count() === $num_albums
 		) {
 			return true;
@@ -430,9 +436,13 @@ public function canDeleteById(User $user, array $album_ids): bool
 
 		if (
 			AccessPermission::query()
+			->select(APC::BASE_ALBUM_ID)
 			->whereIn(APC::BASE_ALBUM_ID, $album_ids)
-			->where(APC::USER_ID, '=', $user->id)
+			->where(fn ($query) => $query->where(APC::USER_ID, '=', $user->id)
+					->orWhereIn(APC::USER_GROUP_ID, $user->user_groups->pluck('id'))
+			)
 			->where(APC::GRANTS_DELETE, '=', true)
+			->distinct()
 			->count() === $num_albums
 		) {
 			return true;