acl changes

application/Espo/Acl/Email.php

@@ -62,20 +62,16 @@ class Email extends \Espo\Core\Acl\Base
 
     public function checkIsOwner(User $user, Entity $entity)
     {
-        if ($entity->has('assignedUserId')) {
-            if ($user->id === $entity->get('assignedUserId')) {
-                return true;
-            }
+        if ($user->id === $entity->get('assignedUserId')) {
+            return true;
         }
 
         if ($user->id === $entity->get('createdById')) {
             return true;
         }
 
-        if ($entity->hasField('assignedUsersIds') && $entity->hasRelation('assignedUsers')) {
-            if ($entity->hasLinkMultipleId('assignedUsers', $user->id)) {
-                return true;
-            }
+        if ($entity->hasLinkMultipleId('assignedUsers', $user->id)) {
+            return true;
         }
 
         return false;

application/Espo/Core/Acl/Base.php

@@ -184,6 +184,13 @@ class Base implements Injectable
                 }
             }
         }
+
+        if ($entity->hasField('assignedUsersIds') && $entity->hasRelation('assignedUsers')) {
+            if ($entity->hasLinkMultipleId('assignedUsers', $user->id)) {
+                return true;
+            }
+        }
+
         return false;
     }
 
@@ -219,27 +226,28 @@ class Base implements Injectable
             return true;
         }
 
-        $result = $this->checkEntity($user, $entity, $data, 'delete');
-        if (!$result) {
-            if (is_array($data)) {
-                if ($data['edit'] != 'no') {
-                    if ($entity->has('createdById') && $entity->get('createdById') == $user->id) {
-                        if (!$entity->has('assignedUserId')) {
+        if ($this->checkEntity($user, $entity, $data, 'delete')) {
+            return true;
+        }
+
+        if (is_array($data)) {
+            if ($data['edit'] != 'no') {
+                if ($entity->has('createdById') && $entity->get('createdById') == $user->id) {
+                    if (!$entity->has('assignedUserId')) {
+                        return true;
+                    } else {
+                        if (!$entity->get('assignedUserId')) {
+                            return true;
+                        }
+                        if ($entity->get('assignedUserId') == $entity->get('createdById')) {
                             return true;
-                        } else {
-                            if (!$entity->get('assignedUserId')) {
-                                return true;
-                            }
-                            if ($entity->get('assignedUserId') == $entity->get('createdById')) {
-                                return true;
-                            }
                         }
                     }
                 }
             }
         }
 
-        return $result;
+        return false;
     }
 }
 

application/Espo/Core/Mail/Importer.php

@@ -127,13 +127,13 @@ class Importer
             }
 
             if ($duplicate = $this->findDuplicate($email)) {
-                if ($userId) {
+                if ($assignedUserId) {
                     $duplicate->addLinkMultipleId('users', $assignedUserId);
                     $duplicate->addLinkMultipleId('assignedUsers', $assignedUserId);
                 }
                 if (!empty($userIdList)) {
-                    foreach ($userIdList as $additionalUserId) {
-                        $duplicate->addLinkMultipleId('users', $additionalUserId);
+                    foreach ($userIdList as $uId) {
+                        $duplicate->addLinkMultipleId('users', $uId);
                     }
                 }
 

frontend/client/src/acl.js

@@ -74,11 +74,11 @@ Espo.define('acl', [], function () {
                 if (action in data) {
                     var value = data[action];
 
-                    if (value === 'all' || value === true) {
+                    if (value === 'all') {
                         return true;
                     }
 
-                    if (action != 'delete' && (value == 'no' || value === false)) {
+                    if (value == 'no') {
                         return false;
                     }
 
@@ -86,11 +86,7 @@ Espo.define('acl', [], function () {
                         return true;
                     }
 
-                    if (isOwner && action == 'delete' && value === 'no') {
-                        return this.checkScope(data, 'edit', precise, isOwner);
-                    }
-
-                    if (!value || value === 'no') {
+                    if (value === 'no') {
                         return false;
                     }
 
@@ -130,14 +126,64 @@ Espo.define('acl', [], function () {
             return this.checkScope(data, action, precise, this.checkIsOwner(model), this.checkInTeam(model));
         },
 
+        checkModelDelete: function (model, data, precise) {
+            var result = this.checkModel(model, data, 'delete', precise);
+
+            if (result) {
+                return true;
+            }
+
+            if (data === false) {
+                return false;
+            }
+
+            var d = data || {};
+            if (d.read === 'no') {
+                return false;
+            }
+
+            if (model.has('createdById')) {
+                if (model.get('createdById') === this.getUser().id) {
+                    if (!model.has('assignedUserId')) {
+                        return true;
+                    } else {
+                        if (!model.get('assignedUserId')) {
+                            return true;
+                        }
+                        if (model.get('assignedUserId') === this.getUser().id) {
+                            return true;
+                        }
+                    }
+                }
+            }
+
+            return result;
+        },
+
         checkIsOwner: function (model) {
-            var result = this.getUser().id === model.get('assignedUserId') || this.getUser().id === model.get('createdById');
-            if (!result) {
-                if (!model.hasField('assignedUser') && !model.hasField('createdBy')) {
+            if (model.hasField('assignedUser')) {
+                if (this.getUser().id === model.get('assignedUserId')) {
+                    return true;
+                }
+            } else {
+                if (model.hasField('createdBy')) {
+                    if (this.getUser().id === model.get('createdById')) {
+                        return true;
+                    }
+                }
+            }
+
+            if (model.hasField('assignedUsers')) {
+                if (!model.has('assignedUsersIds')) {
+                    return null;
+                }
+
+                if (~(model.get('assignedUsersIds') || []).indexOf(this.getUser().id)) {
                     return true;
                 }
             }
-            return result;
+
+            return false;
         },
 
         checkInTeam: function (model) {

frontend/client/src/acl/email.js

@@ -31,7 +31,9 @@ Espo.define('acl/email', 'acl', function (Dep) {
     return Dep.extend({
 
         checkModelRead: function (model, data, precise) {
-            if (this.checkModel(model, data, 'read', precise)) {
+            var result = this.checkModel(model, data, 'read', precise);
+
+            if (result) {
                 return true;
             }
 
@@ -40,7 +42,7 @@ Espo.define('acl/email', 'acl', function (Dep) {
             }
 
             var d = data || {};
-            if (d.read === false || d.read === 'no') {
+            if (d.read === 'no') {
                 return false;
             }
 
@@ -54,11 +56,11 @@ Espo.define('acl/email', 'acl', function (Dep) {
                 }
             }
 
-            return false;
+            return result;
         },
 
         checkIsOwner: function (model) {
-            if (Dep.prototype.checkIsOwner.call(this, model)) {
+            if (this.getUser().id === model.get('assignedUserId') || this.getUser().id === model.get('createdById')) {
                 return true;
             }
 

frontend/client/src/model.js

@@ -69,6 +69,11 @@ Espo.define('model', [], function () {
             return Dep.prototype.get.call(this, key);
         },
 
+        has: function (key) {
+            var value = this.get(key);
+            return (typeof value !== 'undefined');
+        },
+
         isNew: function () {
             return !this.id;
         },