diff --git a/server/AyaNova/Controllers/SearchController.cs b/server/AyaNova/Controllers/SearchController.cs index 02e795b5..206e3f89 100644 --- a/server/AyaNova/Controllers/SearchController.cs +++ b/server/AyaNova/Controllers/SearchController.cs @@ -64,7 +64,13 @@ namespace AyaNova.Api.Controllers } //Do the search - var SearchResults = await Search.DoSearchAsync(ct, UserTranslationIdFromContext.Id(HttpContext.Items), UserRolesFromContext.Roles(HttpContext.Items), searchParams); + var SearchResults = await Search.DoSearchAsync( + ct, + UserTranslationIdFromContext.Id(HttpContext.Items), + UserRolesFromContext.Roles(HttpContext.Items), + UserIdFromContext.Id(HttpContext.Items), + searchParams + ); return Ok(ApiOkResponse.Response(SearchResults)); } @@ -88,9 +94,9 @@ namespace AyaNova.Api.Controllers if (!ModelState.IsValid) return BadRequest(new ApiErrorResponse(ModelState)); - if (id == 0) + if (id == 0) return BadRequest(new ApiErrorResponse(ApiErrorCode.VALIDATION_INVALID_VALUE, "id", "id can't be zero")); - + var res = await Search.GetInfoAsync(UserTranslationIdFromContext.Id(HttpContext.Items), UserRolesFromContext.Roles(HttpContext.Items), UserIdFromContext.Id(HttpContext.Items), phrase, max, ayaType, id, ct); @@ -120,8 +126,8 @@ namespace AyaNova.Api.Controllers if (!ModelState.IsValid) return BadRequest(new ApiErrorResponse(ModelState)); if (id == 0) - return BadRequest(new ApiErrorResponse(ApiErrorCode.VALIDATION_INVALID_VALUE, null, "id can't be zero")); - + return BadRequest(new ApiErrorResponse(ApiErrorCode.VALIDATION_INVALID_VALUE, null, "id can't be zero")); + switch (ayaType) { case AyaType.WorkOrderItem: diff --git a/server/AyaNova/biz/Search.cs b/server/AyaNova/biz/Search.cs index 64476bf4..edc47edb 100644 --- a/server/AyaNova/biz/Search.cs +++ b/server/AyaNova/biz/Search.cs @@ -69,7 +69,7 @@ namespace AyaNova.Biz } - public static async Task DoSearchAsync(AyContext ct, long translationId, AuthorizationRoles currentUserRoles, SearchRequestParameters searchParameters) + public static async Task DoSearchAsync(AyContext ct, long translationId, AuthorizationRoles currentUserRoles, long currentUserId, SearchRequestParameters searchParameters) { var ReturnObject = new SearchReturnObject(); @@ -185,6 +185,12 @@ namespace AyaNova.Biz CanReadMatchingObjects.Add(new AyaTypeId(f.AttachToObjectType, f.AttachToObjectId)); } } + else if (t.ObjectType == AyaType.Memo) + { + //Users are only permitted to search their own memo's + if (await ct.Memo.AsNoTracking().AnyAsync(z => z.Id == t.ObjectId && z.ToId == currentUserId)) + CanReadMatchingObjects.Add(t); + } else { if (AyaNova.Api.ControllerHelpers.Authorized.HasReadFullRole(currentUserRoles, t.ObjectType))