Bulk operations skip permission checks

[adelowo]

correctly check for permissions and does not allow users without the right permissions to not delete/revoke

 deleteTrustCenterNDARequest(id: $deleteTrustCenterNdaRequestId) {
    deletedID
  }

but bulk access checks does not. So if the request failed, you just need to use bulk delete

 deleteBulkTrustCenterNDARequest(ids: $ids) {
  deletedIDs
 }

{
  "deleteTrustCenterNdaRequestId": "01KKMBWAD65SVN29MYPQ5Z9ZST", // fails
  "ids": ["01KKMBWAD65SVN29MYPQ5Z9ZST"] // succeeds ( same id )
}

this is because privacy.Allow is returned if objectID not found ( id field )
but when dealing with bulk operations, id does not exist instead ids.

so this makes sure to check both

[adelowo]

applies to the edit path too. adding that

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud