server/AyaNova/Controllers/SearchController.cs

@@ -64,7 +64,13 @@ namespace AyaNova.Api.Controllers
             }
 
             //Do the search
-            var SearchResults = await Search.DoSearchAsync(ct, UserTranslationIdFromContext.Id(HttpContext.Items), UserRolesFromContext.Roles(HttpContext.Items), searchParams);
+            var SearchResults = await Search.DoSearchAsync(
+                ct,
+                UserTranslationIdFromContext.Id(HttpContext.Items),
+                UserRolesFromContext.Roles(HttpContext.Items),
+                UserIdFromContext.Id(HttpContext.Items),
+                searchParams
+            );
 
             return Ok(ApiOkResponse.Response(SearchResults));
         }
@@ -120,7 +126,7 @@ namespace AyaNova.Api.Controllers
             if (!ModelState.IsValid)
                 return BadRequest(new ApiErrorResponse(ModelState));
             if (id == 0)
-               return BadRequest(new ApiErrorResponse(ApiErrorCode.VALIDATION_INVALID_VALUE, null, "id can't be zero"));
+                return BadRequest(new ApiErrorResponse(ApiErrorCode.VALIDATION_INVALID_VALUE, null, "id can't be zero"));
 
             switch (ayaType)
             {

server/AyaNova/biz/Search.cs

@@ -69,7 +69,7 @@ namespace AyaNova.Biz
         }
 
 
-        public static async Task<SearchReturnObject> DoSearchAsync(AyContext ct, long translationId, AuthorizationRoles currentUserRoles, SearchRequestParameters searchParameters)
+        public static async Task<SearchReturnObject> DoSearchAsync(AyContext ct, long translationId, AuthorizationRoles currentUserRoles, long currentUserId, SearchRequestParameters searchParameters)
         {
             var ReturnObject = new SearchReturnObject();
 
@@ -185,6 +185,12 @@ namespace AyaNova.Biz
                         CanReadMatchingObjects.Add(new AyaTypeId(f.AttachToObjectType, f.AttachToObjectId));
                     }
                 }
+                else if (t.ObjectType == AyaType.Memo)
+                {
+                    //Users are only permitted to search their own memo's
+                    if (await ct.Memo.AsNoTracking().AnyAsync(z => z.Id == t.ObjectId && z.ToId == currentUserId))
+                        CanReadMatchingObjects.Add(t);
+                }
                 else
                 {
                     if (AyaNova.Api.ControllerHelpers.Authorized.HasReadFullRole(currentUserRoles, t.ObjectType))