I'm not 100% sure about having the mapper do the access level filtering. @Fastwind what is your opinion here?
No check for deleted, which should be admin only.
Additionally passing a bool breaks convention, rather accept the enum value of user role
Not sure this is correct either. Persons are visible depending from their visibility, maintainers get a free pass, but only for the persons they are a maintainer of. Currently the code seems to allow maitainers to see all persons regardless of them being a maintainer of them or not
As said before, the same error happens here. Maintainers shoudl be able to see all assets of the people they are a maintainer of.
Stats repository should return also a protected assets stats.
Maintainer should be able to see the visibility if it's an asset assigned to a cosplayer they maintain
Maintainer of a person should also get this value
Visibility field is missing?
Filtering by access level? As the other search query methods do? Maybe? Not sure.
Maintainer OF that cosplayer can get all assets, otherwise it's like an user.
Yes they can, if they are a maintainer of the cosplayer related to the album.
Maintainer is missing here.
if we are just trying to access media, and we will have to check user being able to access the asset, this includes the user being a maintainer of the cosplayer the asset is assigned to... do we need the media repository to also get the visibility level?
This query needs a double check.
Should default to private
PageSize in search should default to PagedSearchDto.MaxPageSize.
1b444dab93
feat(auth): complete Maintainer role — add PersonMaintainer checks, update controller authz, pass uploadedBy search param