From 5dc52911e67ab6995e2511b62eff1fa738170f71 Mon Sep 17 00:00:00 2001
From: Theo <36564257+theoholl@users.noreply.github.com>
Date: Sun, 4 Jan 2026 18:09:08 +0000
Subject: [PATCH] When undeleting a board (and force-deleting), pass the
 `allowDeleted` parameter through to BoardMapper::find() to find the relevant
 board.

Signed-off-by: Theo <36564257+theoholl@users.noreply.github.com>
---
 lib/Service/BoardService.php      |  4 ++--
 lib/Service/PermissionService.php | 18 +++++++++---------
 2 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/lib/Service/BoardService.php b/lib/Service/BoardService.php
index 45f439d2c1..d2189fd942 100644
--- a/lib/Service/BoardService.php
+++ b/lib/Service/BoardService.php
@@ -246,7 +246,7 @@ public function delete(int $id): Board {
 	public function deleteUndo(int $id): Board {
 		$this->boardServiceValidator->check(compact('id'));
 
-		$this->permissionService->checkPermission($this->boardMapper, $id, Acl::PERMISSION_MANAGE);
+		$this->permissionService->checkPermission($this->boardMapper, $id, Acl::PERMISSION_MANAGE, allowDeletedBoard: true);
 		$board = $this->find($id, allowDeleted: true);
 		$board->setDeletedAt(0);
 		$board = $this->boardMapper->update($board);
@@ -265,7 +265,7 @@ public function deleteUndo(int $id): Board {
 	public function deleteForce(int $id): Board {
 		$this->boardServiceValidator->check(compact('id'));
 
-		$this->permissionService->checkPermission($this->boardMapper, $id, Acl::PERMISSION_MANAGE);
+		$this->permissionService->checkPermission($this->boardMapper, $id, Acl::PERMISSION_MANAGE, allowDeletedBoard: true);
 		$board = $this->find($id, allowDeleted: true);
 		$delete = $this->boardMapper->delete($board);
 
diff --git a/lib/Service/PermissionService.php b/lib/Service/PermissionService.php
index 0f8831daaa..1c5ef10b09 100644
--- a/lib/Service/PermissionService.php
+++ b/lib/Service/PermissionService.php
@@ -52,7 +52,7 @@ public function __construct(
 	 *
 	 * @return array<Acl::PERMISSION_*, bool>
 	 */
-	public function getPermissions(int $boardId, ?string $userId = null): array {
+	public function getPermissions(int $boardId, ?string $userId = null, bool $allowDeleted = false): array {
 		if ($userId === null) {
 			$userId = $this->userId;
 		}
@@ -64,8 +64,8 @@ public function getPermissions(int $boardId, ?string $userId = null): array {
 		}
 
 		try {
-			$board = $this->getBoard($boardId);
-			$owner = $this->userIsBoardOwner($boardId, $userId);
+			$board = $this->getBoard($boardId, $allowDeleted);
+			$owner = $this->userIsBoardOwner($boardId, $userId, $allowDeleted);
 			$acls = $board->getDeletedAt() === 0 ? $this->aclMapper->findAll($boardId) : [];
 		} catch (MultipleObjectsReturnedException|DoesNotExistException $e) {
 			$owner = false;
@@ -107,7 +107,7 @@ public function matchPermissions(Board $board) {
 	 *
 	 * @throws NoPermissionException
 	 */
-	public function checkPermission(?IPermissionMapper $mapper, $id, int $permission, $userId = null, bool $allowDeletedCard = false): bool {
+	public function checkPermission(?IPermissionMapper $mapper, $id, int $permission, $userId = null, bool $allowDeletedCard = false, bool $allowDeletedBoard = false): bool {
 		$boardId = (int)$id;
 		if ($mapper instanceof IPermissionMapper && !($mapper instanceof BoardMapper)) {
 			$boardId = $mapper->findBoardId($id);
@@ -117,7 +117,7 @@ public function checkPermission(?IPermissionMapper $mapper, $id, int $permission
 			throw new NoPermissionException('Permission denied');
 		}
 
-		$permissions = $this->getPermissions($boardId, $userId);
+		$permissions = $this->getPermissions($boardId, $userId, $allowDeletedBoard);
 		if ($permissions[$permission] === true) {
 
 			if (!$allowDeletedCard && $mapper instanceof CardMapper) {
@@ -142,12 +142,12 @@ public function checkPermission(?IPermissionMapper $mapper, $id, int $permission
 	 * @param $boardId
 	 * @return bool
 	 */
-	public function userIsBoardOwner($boardId, $userId = null) {
+	public function userIsBoardOwner($boardId, $userId = null, bool $allowDeleted = false) {
 		if ($userId === null) {
 			$userId = $this->userId;
 		}
 		try {
-			$board = $this->getBoard($boardId);
+			$board = $this->getBoard($boardId, $allowDeleted);
 			return $userId === $board->getOwner();
 		} catch (DoesNotExistException|MultipleObjectsReturnedException $e) {
 		}
@@ -158,9 +158,9 @@ public function userIsBoardOwner($boardId, $userId = null) {
 	 * @throws MultipleObjectsReturnedException
 	 * @throws DoesNotExistException
 	 */
-	private function getBoard(int $boardId): Board {
+	private function getBoard(int $boardId, bool $allowDeleted = false): Board {
 		if (!isset($this->boardCache[(string)$boardId])) {
-			$this->boardCache[(string)$boardId] = $this->boardMapper->find($boardId, false, true);
+			$this->boardCache[(string)$boardId] = $this->boardMapper->find($boardId, false, true, $allowDeleted);
 		}
 		return $this->boardCache[(string)$boardId];
 	}