From 450cdec288638acc58ecfc2b62ae8da3be440d61 Mon Sep 17 00:00:00 2001
From: Alexander Onnikov <Alexander.Onnikov@gmail.com>
Date: Wed, 20 Sep 2023 23:28:09 +0700
Subject: [PATCH] UBER-887 Space security: allow system account see all spaces
 (#3722)

Signed-off-by: Alexander Onnikov <alexander.onnikov@xored.com>
---
 plugins/support-resources/src/support.ts |  2 +-
 server/middleware/src/spaceSecurity.ts   | 16 +++++++++-------
 server/middleware/src/utils.ts           |  4 ++++
 3 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/plugins/support-resources/src/support.ts b/plugins/support-resources/src/support.ts
index 972ffa4674..484c3d3e19 100644
--- a/plugins/support-resources/src/support.ts
+++ b/plugins/support-resources/src/support.ts
@@ -57,7 +57,7 @@ class SupportClientImpl implements SupportClient {
       query.query(
         support.class.SupportConversation,
         {
-          account: this.config.account._id
+          createdBy: this.config.account._id
         },
         (res) => {
           this.hasUnreadMessages = res.some((p) => p.hasUnreadMessages)
diff --git a/server/middleware/src/spaceSecurity.ts b/server/middleware/src/spaceSecurity.ts
index 6eed69ffcc..79ab16fbc5 100644
--- a/server/middleware/src/spaceSecurity.ts
+++ b/server/middleware/src/spaceSecurity.ts
@@ -43,7 +43,7 @@ import core, {
 import platform, { PlatformError, Severity, Status } from '@hcengineering/platform'
 import { BroadcastFunc, Middleware, SessionContext, TxMiddlewareResult } from '@hcengineering/server-core'
 import { BaseMiddleware } from './base'
-import { getUser, isOwner, mergeTargets } from './utils'
+import { getUser, isOwner, isSystem, mergeTargets } from './utils'
 
 /**
  * @public
@@ -377,12 +377,14 @@ export class SpaceSecurityMiddleware extends BaseMiddleware implements Middlewar
     const account = await getUser(this.storage, ctx)
     const field = this.getKey(_class)
 
-    if (!isOwner(account) || !this.storage.hierarchy.isDerived(_class, core.class.Space)) {
-      if (query[field] !== undefined) {
-        ;(newQuery as any)[field] = await this.mergeQuery(account, query[field])
-      } else {
-        const spaces = await this.getAllAllowedSpaces(account)
-        ;(newQuery as any)[field] = { $in: spaces }
+    if (!isSystem(account)) {
+      if (!isOwner(account) || !this.storage.hierarchy.isDerived(_class, core.class.Space)) {
+        if (query[field] !== undefined) {
+          ;(newQuery as any)[field] = await this.mergeQuery(account, query[field])
+        } else {
+          const spaces = await this.getAllAllowedSpaces(account)
+          ;(newQuery as any)[field] = { $in: spaces }
+        }
       }
     }
     const findResult = await this.provideFindAll(ctx, _class, newQuery, options)
diff --git a/server/middleware/src/utils.ts b/server/middleware/src/utils.ts
index e628e1d3de..76d1e21c4b 100644
--- a/server/middleware/src/utils.ts
+++ b/server/middleware/src/utils.ts
@@ -54,3 +54,7 @@ export async function getUser (storage: ServerStorage, ctx: SessionContext): Pro
 export function isOwner (account: Account): boolean {
   return account.role === AccountRole.Owner || account._id === core.account.System
 }
+
+export function isSystem (account: Account): boolean {
+  return account._id === core.account.System
+}