Merge pull request #1149 from hargata/Hargata/565

allow for multiple households.

Controllers/APIController.cs

@@ -175,7 +175,7 @@ namespace CarCareTracker.Controllers
             List<Vehicle> vehicles = new List<Vehicle>();
             if (vehicleId != default)
             {
-                if (_userLogic.UserCanEditVehicle(GetUserID(), vehicleId))
+                if (_userLogic.UserCanEditVehicle(GetUserID(), vehicleId, HouseholdPermission.View))
                 {
                     vehicles.Add(_dataAccess.GetVehicleById(vehicleId));
                 } else
@@ -351,7 +351,7 @@ namespace CarCareTracker.Controllers
                 return Json(OperationResponse.Failed("Invalid Record Id"));
             }
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Delete))
             {
                 Response.StatusCode = 401;
                 return Json(OperationResponse.Failed("Access Denied, you don't have access to this vehicle."));
@@ -419,7 +419,7 @@ namespace CarCareTracker.Controllers
                 if (existingRecord != null && existingRecord.Id == int.Parse(input.Id))
                 {
                     //check if user has access to the vehicleId
-                    if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
+                    if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
                     {
                         Response.StatusCode = 401;
                         return Json(OperationResponse.Failed("Access Denied, you don't have access to this vehicle."));
@@ -567,7 +567,7 @@ namespace CarCareTracker.Controllers
                 return Json(OperationResponse.Failed("Invalid Record Id"));
             }
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Delete))
             {
                 Response.StatusCode = 401;
                 return Json(OperationResponse.Failed("Access Denied, you don't have access to this vehicle."));
@@ -616,7 +616,7 @@ namespace CarCareTracker.Controllers
                 if (existingRecord != null && existingRecord.Id == int.Parse(input.Id))
                 {
                     //check if user has access to the vehicleId
-                    if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
+                    if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
                     {
                         Response.StatusCode = 401;
                         return Json(OperationResponse.Failed("Access Denied, you don't have access to this vehicle."));
@@ -764,7 +764,7 @@ namespace CarCareTracker.Controllers
                 return Json(OperationResponse.Failed("Invalid Record Id"));
             }
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Delete))
             {
                 Response.StatusCode = 401;
                 return Json(OperationResponse.Failed("Access Denied, you don't have access to this vehicle."));
@@ -813,7 +813,7 @@ namespace CarCareTracker.Controllers
                 if (existingRecord != null && existingRecord.Id == int.Parse(input.Id))
                 {
                     //check if user has access to the vehicleId
-                    if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
+                    if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
                     {
                         Response.StatusCode = 401;
                         return Json(OperationResponse.Failed("Access Denied, you don't have access to this vehicle."));
@@ -961,7 +961,7 @@ namespace CarCareTracker.Controllers
                 return Json(OperationResponse.Failed("Invalid Record Id"));
             }
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Delete))
             {
                 Response.StatusCode = 401;
                 return Json(OperationResponse.Failed("Access Denied, you don't have access to this vehicle."));
@@ -1010,7 +1010,7 @@ namespace CarCareTracker.Controllers
                 if (existingRecord != null && existingRecord.Id == int.Parse(input.Id))
                 {
                     //check if user has access to the vehicleId
-                    if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
+                    if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
                     {
                         Response.StatusCode = 401;
                         return Json(OperationResponse.Failed("Access Denied, you don't have access to this vehicle."));
@@ -1180,7 +1180,7 @@ namespace CarCareTracker.Controllers
                 return Json(OperationResponse.Failed("Invalid Record Id"));
             }
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Delete))
             {
                 Response.StatusCode = 401;
                 return Json(OperationResponse.Failed("Access Denied, you don't have access to this vehicle."));
@@ -1223,7 +1223,7 @@ namespace CarCareTracker.Controllers
                 if (existingRecord != null && existingRecord.Id == int.Parse(input.Id))
                 {
                     //check if user has access to the vehicleId
-                    if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
+                    if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
                     {
                         Response.StatusCode = 401;
                         return Json(OperationResponse.Failed("Access Denied, you don't have access to this vehicle."));
@@ -1373,7 +1373,7 @@ namespace CarCareTracker.Controllers
                 return Json(OperationResponse.Failed("Invalid Record Id"));
             }
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Delete))
             {
                 Response.StatusCode = 401;
                 return Json(OperationResponse.Failed("Access Denied, you don't have access to this vehicle."));
@@ -1416,7 +1416,7 @@ namespace CarCareTracker.Controllers
                 if (existingRecord != null && existingRecord.Id == int.Parse(input.Id))
                 {
                     //check if user has access to the vehicleId
-                    if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
+                    if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
                     {
                         Response.StatusCode = 401;
                         return Json(OperationResponse.Failed("Access Denied, you don't have access to this vehicle."));
@@ -1583,7 +1583,7 @@ namespace CarCareTracker.Controllers
                 return Json(OperationResponse.Failed("Invalid Record Id"));
             }
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Delete))
             {
                 Response.StatusCode = 401;
                 return Json(OperationResponse.Failed("Access Denied, you don't have access to this vehicle."));
@@ -1629,7 +1629,7 @@ namespace CarCareTracker.Controllers
                 if (existingRecord != null && existingRecord.Id == int.Parse(input.Id))
                 {
                     //check if user has access to the vehicleId
-                    if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
+                    if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
                     {
                         Response.StatusCode = 401;
                         return Json(OperationResponse.Failed("Access Denied, you don't have access to this vehicle."));
@@ -1823,7 +1823,7 @@ namespace CarCareTracker.Controllers
                 if (existingRecord != null && existingRecord.Id == int.Parse(input.Id))
                 {
                     //check if user has access to the vehicleId
-                    if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
+                    if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
                     {
                         Response.StatusCode = 401;
                         return Json(OperationResponse.Failed("Access Denied, you don't have access to this vehicle."));
@@ -1861,7 +1861,7 @@ namespace CarCareTracker.Controllers
                 return Json(OperationResponse.Failed("Invalid Record Id"));
             }
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Delete))
             {
                 Response.StatusCode = 401;
                 return Json(OperationResponse.Failed("Access Denied, you don't have access to this vehicle."));

Controllers/AdminController.cs

@@ -104,5 +104,11 @@ namespace CarCareTracker.Controllers
             var result = _userLogic.AddUserToHousehold(parentUserId, username);
             return Json(result);
         }
+        [HttpPost]
+        public IActionResult ModifyUserHouseholdPermissions(int parentUserId, int childUserId, List<HouseholdPermission> permissions)
+        {
+            var result = _userLogic.UpdateUserHousehold(parentUserId, childUserId, permissions);
+            return Json(result);
+        }
     }
 }

Controllers/HomeController.cs

@@ -302,6 +302,12 @@ namespace CarCareTracker.Controllers
             return Json(result);
         }
         [HttpPost]
+        public IActionResult ModifyUserHouseholdPermissions(int userId, List<HouseholdPermission> permissions)
+        {
+            var result = _userLogic.UpdateUserHousehold(GetUserID(), userId, permissions);
+            return Json(result);
+        }
+        [HttpPost]
         public IActionResult AddUserToHousehold(string username)
         {
             var result = _userLogic.AddUserToHousehold(GetUserID(), username);

Controllers/MigrationController.cs

@@ -55,7 +55,7 @@ namespace CarCareTracker.Controllers
                 "CREATE TABLE IF NOT EXISTS app.extrafields (id INT primary key, data jsonb not null)",
                 "CREATE TABLE IF NOT EXISTS app.inspectionrecords (id INT GENERATED BY DEFAULT AS IDENTITY primary key, vehicleId INT not null, data jsonb not null)",
                 "CREATE TABLE IF NOT EXISTS app.inspectionrecordtemplates (id INT GENERATED BY DEFAULT AS IDENTITY primary key, vehicleId INT not null, data jsonb not null)",
-                "CREATE TABLE IF NOT EXISTS app.userhouseholdrecords (parentUserId INT, childUserId INT, PRIMARY KEY(parentUserId, childUserId))"
+                "CREATE TABLE IF NOT EXISTS app.userhouseholdrecords (parentUserId INT, childUserId INT, data jsonb not null, PRIMARY KEY(parentUserId, childUserId))"
             };
             foreach(string cmd in cmds)
             {
@@ -457,20 +457,13 @@ namespace CarCareTracker.Controllers
                         table.Upsert(record);
                     };
                 }
-                cmd = $"SELECT parentUserId, childUserId FROM app.userhouseholdrecords";
+                cmd = $"SELECT data FROM app.userhouseholdrecords";
                 using (var ctext = pgDataSource.CreateCommand(cmd))
                 {
                     using (NpgsqlDataReader reader = ctext.ExecuteReader())
                         while (reader.Read())
                         {
-                            UserHousehold result = new UserHousehold()
-                            {
-                                Id = new HouseholdAccess
-                                {
-                                    ParentUserId = int.Parse(reader["parentUserId"].ToString()),
-                                    ChildUserId = int.Parse(reader["childUserId"].ToString())
-                                }
-                            };
+                            UserHousehold result = JsonSerializer.Deserialize<UserHousehold>(reader["data"] as string);
                             userhouseholdrecords.Add(result);
                         }
                 }
@@ -853,11 +846,12 @@ namespace CarCareTracker.Controllers
                 ;
                 foreach (var record in userhouseholdrecords)
                 {
-                    string cmd = $"INSERT INTO app.userhouseholdrecords (parentUserId, childUserId) VALUES(@parentUserId, @childUserId)";
+                    string cmd = $"INSERT INTO app.userhouseholdrecords (parentUserId, childUserId, data) VALUES(@parentUserId, @childUserId, CAST(@data AS jsonb))";
                     using (var ctext = pgDataSource.CreateCommand(cmd))
                     {
                         ctext.Parameters.AddWithValue("parentUserId", record.Id.ParentUserId);
                         ctext.Parameters.AddWithValue("childUserId", record.Id.ChildUserId);
+                        ctext.Parameters.AddWithValue("data", JsonSerializer.Serialize(record));
                         ctext.ExecuteNonQuery();
                     }
                 }

Controllers/Vehicle/GasController.cs

@@ -36,9 +36,9 @@ namespace CarCareTracker.Controllers
         public IActionResult SaveGasRecordToVehicleId(GasRecordInput gasRecord)
         {
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), gasRecord.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), gasRecord.VehicleId, HouseholdPermission.Edit))
             {
-                return Json(false);
+                return Json(OperationResponse.Failed("Access Denied"));
             }
             gasRecord.Files = gasRecord.Files.Select(x => { return new UploadedFiles { Name = x.Name, Location = _fileHelper.MoveFileFromTemp(x.Location, "documents/") }; }).ToList();
             var convertedRecord = gasRecord.ToGasRecord();
@@ -58,7 +58,7 @@ namespace CarCareTracker.Controllers
                     Files = StaticHelper.CreateAttachmentFromRecord(ImportMode.GasRecord, convertedRecord.Id, $"Gas Record - {gasRecord.Mileage.ToString()}")
                 });
             }
-            return Json(result);
+            return Json(OperationResponse.Conditional(result, string.Empty, StaticHelper.GenericErrorMessage));
         }
         [TypeFilter(typeof(CollaboratorFilter))]
         [HttpGet]
@@ -74,7 +74,7 @@ namespace CarCareTracker.Controllers
         {
             var result = _gasRecordDataAccess.GetGasRecordById(gasRecordId);
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), result.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), result.VehicleId, HouseholdPermission.View))
             {
                 return Redirect("/Error/Unauthorized");
             }
@@ -104,20 +104,20 @@ namespace CarCareTracker.Controllers
             };
             return PartialView("Gas/_GasModal", viewModel);
         }
-        private bool DeleteGasRecordWithChecks(int gasRecordId)
+        private OperationResponse DeleteGasRecordWithChecks(int gasRecordId)
         {
             var existingRecord = _gasRecordDataAccess.GetGasRecordById(gasRecordId);
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Delete))
             {
-                return false;
+                return OperationResponse.Failed("Access Denied");
             }
             var result = _gasRecordDataAccess.DeleteGasRecordById(existingRecord.Id);
             if (result)
             {
                 StaticHelper.NotifyAsync(_config.GetWebHookUrl(), WebHookPayload.FromGasRecord(existingRecord, "gasrecord.delete", User.Identity.Name));
             }
-            return result;
+            return OperationResponse.Conditional(result, string.Empty, StaticHelper.GenericErrorMessage);
         }
         [HttpPost]
         public IActionResult DeleteGasRecordById(int gasRecordId)
@@ -163,6 +163,11 @@ namespace CarCareTracker.Controllers
             foreach (int recordId in editModel.RecordIds)
             {
                 var existingRecord = _gasRecordDataAccess.GetGasRecordById(recordId);
+                //security check
+                if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
+                {
+                    return Json(OperationResponse.Failed("Access Denied"));
+                }
                 if (dateIsEdited)
                 {
                     existingRecord.Date = editModel.EditRecord.Date;
@@ -205,7 +210,7 @@ namespace CarCareTracker.Controllers
                 }
                 result = _gasRecordDataAccess.SaveGasRecordToVehicle(existingRecord);
             }
-            return Json(result);
+            return Json(OperationResponse.Conditional(result, string.Empty, StaticHelper.GenericErrorMessage));
         }
     }
 }

Controllers/Vehicle/ImportController.cs

@@ -186,7 +186,7 @@ namespace CarCareTracker.Controllers
                 return Json(OperationResponse.Failed($"An error has occurred while generating CSV sample: {ex.Message}"));
             }
         }
-        [TypeFilter(typeof(CollaboratorFilter))]
+        [TypeFilter(typeof(CollaboratorFilter), Arguments = new object[] { false, true, HouseholdPermission.View })]
         [HttpGet]
         public IActionResult ExportFromVehicleToCsv(int vehicleId, ImportMode mode)
         {
@@ -408,9 +408,9 @@ namespace CarCareTracker.Controllers
                 }
                 return Json($"/{fileNameToExport}");
             }
-            return Json(false);
+            return Json(OperationResponse.Failed(StaticHelper.GenericErrorMessage));
         }
-        [TypeFilter(typeof(CollaboratorFilter))]
+        [TypeFilter(typeof(CollaboratorFilter), Arguments = new object[] { false, true, HouseholdPermission.Edit })]
         [HttpPost]
         public IActionResult ImportToVehicleIdFromCsv(int vehicleId, ImportMode mode, string fileName)
         {

Controllers/Vehicle/InspectionController.cs

@@ -40,7 +40,7 @@ namespace CarCareTracker.Controllers
         {
             var existingRecord = _inspectionRecordTemplateDataAccess.GetInspectionRecordTemplateById(inspectionRecordTemplateId);
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.View))
             {
                 return Redirect("/Error/Unauthorized");
             }
@@ -82,38 +82,38 @@ namespace CarCareTracker.Controllers
         public IActionResult SaveInspectionRecordTemplateToVehicleId(InspectionRecordInput inspectionRecordTemplate)
         {
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), inspectionRecordTemplate.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), inspectionRecordTemplate.VehicleId, HouseholdPermission.Edit))
             {
                 return Json(false);
             }
             var result = _inspectionRecordTemplateDataAccess.SaveInspectionReportTemplateToVehicle(inspectionRecordTemplate);
             return Json(result);
         }
-        private bool DeleteInspectionRecordTemplateWithChecks(int inspectionRecordTemplateId)
+        private OperationResponse DeleteInspectionRecordTemplateWithChecks(int inspectionRecordTemplateId)
         {
             var existingRecord = _inspectionRecordTemplateDataAccess.GetInspectionRecordTemplateById(inspectionRecordTemplateId);
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Delete))
             {
-                return false;
+                return OperationResponse.Failed("Access Denied");
             }
             var result = _inspectionRecordTemplateDataAccess.DeleteInspectionRecordTemplateById(existingRecord.Id);
-            return result;
+            return OperationResponse.Conditional(result, string.Empty, StaticHelper.GenericErrorMessage);
         }
-        private bool DeleteInspectionRecordWithChecks(int inspectionRecordId)
+        private OperationResponse DeleteInspectionRecordWithChecks(int inspectionRecordId)
         {
             var existingRecord = _inspectionRecordDataAccess.GetInspectionRecordById(inspectionRecordId);
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Delete))
             {
-                return false;
+                return OperationResponse.Failed("Access Denied");
             }
             var result = _inspectionRecordDataAccess.DeleteInspectionRecordById(existingRecord.Id);
             if (result)
             {
                 StaticHelper.NotifyAsync(_config.GetWebHookUrl(), WebHookPayload.FromInspectionRecord(existingRecord, "inspectionrecord.delete", User.Identity.Name));
             }
-            return result;
+            return OperationResponse.Conditional(result, string.Empty, StaticHelper.GenericErrorMessage);
         }
         [HttpPost]
         public IActionResult DeleteInspectionRecordTemplateById(int inspectionRecordTemplateId)
@@ -132,9 +132,9 @@ namespace CarCareTracker.Controllers
         {
             var existingRecord = _inspectionRecordTemplateDataAccess.GetInspectionRecordTemplateById(inspectionRecordTemplateId);
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
             {
-                return Redirect("/Error/Unauthorized");
+                return Json(OperationResponse.Failed("Access Denied"));
             }
             //populate date
             existingRecord.Date = DateTime.Now.ToShortDateString();
@@ -164,9 +164,9 @@ namespace CarCareTracker.Controllers
         {
             var result = _inspectionRecordDataAccess.GetInspectionRecordById(inspectionRecordId);
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), result.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), result.VehicleId, HouseholdPermission.View))
             {
-                return Redirect("/Error/Unauthorized");
+                return Json(OperationResponse.Failed("Access Denied"));
             }
             return PartialView("Inspection/_InspectionRecordViewModal", result);
         }
@@ -174,9 +174,9 @@ namespace CarCareTracker.Controllers
         public IActionResult SaveInspectionRecordToVehicleId(InspectionRecordInput inspectionRecord)
         {
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), inspectionRecord.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), inspectionRecord.VehicleId, HouseholdPermission.Edit))
             {
-                return Json(false);
+                return Json(OperationResponse.Failed("Access Denied"));
             }
             //move files from temp.
             inspectionRecord.Files = inspectionRecord.Files.Select(x => { return new UploadedFiles { Name = x.Name, Location = _fileHelper.MoveFileFromTemp(x.Location, "documents/") }; }).ToList();
@@ -246,16 +246,16 @@ namespace CarCareTracker.Controllers
                     }
                 }
             }
-            return Json(result);
+            return Json(OperationResponse.Conditional(result, string.Empty, StaticHelper.GenericErrorMessage));
         }
         [HttpPost]
         public IActionResult UpdateInspectionRecord(InspectionRecordInput inspectionRecord)
         {
             var existingRecord = _inspectionRecordDataAccess.GetInspectionRecordById(inspectionRecord.Id);
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
             {
-                return Json(false);
+                return Json(OperationResponse.Failed("Access Denied"));
             }
             existingRecord.Tags = inspectionRecord.Tags;
             existingRecord.Files = inspectionRecord.Files.Select(x => { return new UploadedFiles { Name = x.Name, Location = _fileHelper.MoveFileFromTemp(x.Location, "documents/") }; }).ToList();
@@ -264,7 +264,7 @@ namespace CarCareTracker.Controllers
             {
                 StaticHelper.NotifyAsync(_config.GetWebHookUrl(), WebHookPayload.FromInspectionRecord(existingRecord, "inspectionrecord.update", User.Identity.Name));
             }
-            return Json(result);
+            return Json(OperationResponse.Conditional(result, string.Empty, StaticHelper.GenericErrorMessage));
         }
     }
 }

Controllers/Vehicle/NoteController.cs

@@ -27,9 +27,9 @@ namespace CarCareTracker.Controllers
         public IActionResult SaveNoteToVehicleId(Note note)
         {
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), note.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), note.VehicleId, HouseholdPermission.Edit))
             {
-                return Json(false);
+                return Json(OperationResponse.Failed("Access Denied"));
             }
             note.Files = note.Files.Select(x => { return new UploadedFiles { Name = x.Name, Location = _fileHelper.MoveFileFromTemp(x.Location, "documents/") }; }).ToList();
             bool isCreate = note.Id == default; //needed here since Notes don't use an input object.
@@ -38,7 +38,7 @@ namespace CarCareTracker.Controllers
             {
                 StaticHelper.NotifyAsync(_config.GetWebHookUrl(), WebHookPayload.FromNoteRecord(note, isCreate ? "noterecord.add" : "noterecord.update", User.Identity.Name));
             }
-            return Json(result);
+            return Json(OperationResponse.Conditional(result, string.Empty, StaticHelper.GenericErrorMessage));
         }
         [HttpGet]
         public IActionResult GetAddNotePartialView()
@@ -52,26 +52,26 @@ namespace CarCareTracker.Controllers
             var result = _noteDataAccess.GetNoteById(noteId);
             result.ExtraFields = StaticHelper.AddExtraFields(result.ExtraFields, _extraFieldDataAccess.GetExtraFieldsById((int)ImportMode.NoteRecord).ExtraFields);
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), result.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), result.VehicleId, HouseholdPermission.View))
             {
                 return Redirect("/Error/Unauthorized");
             }
             return PartialView("Note/_NoteModal", result);
         }
-        private bool DeleteNoteWithChecks(int noteId)
+        private OperationResponse DeleteNoteWithChecks(int noteId)
         {
             var existingRecord = _noteDataAccess.GetNoteById(noteId);
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Delete))
             {
-                return false;
+                return OperationResponse.Failed("Access Denied");
             }
             var result = _noteDataAccess.DeleteNoteById(existingRecord.Id);
             if (result)
             {
                 StaticHelper.NotifyAsync(_config.GetWebHookUrl(), WebHookPayload.FromNoteRecord(existingRecord, "noterecord.delete", User.Identity.Name));
             }
-            return result;
+            return OperationResponse.Conditional(result, string.Empty, StaticHelper.GenericErrorMessage);
         }
         [HttpPost]
         public IActionResult DeleteNoteById(int noteId)
@@ -86,6 +86,10 @@ namespace CarCareTracker.Controllers
             foreach (int noteId in noteIds)
             {
                 var existingNote = _noteDataAccess.GetNoteById(noteId);
+                if (!_userLogic.UserCanEditVehicle(GetUserID(), existingNote.VehicleId, HouseholdPermission.Edit))
+                {
+                    return Json(OperationResponse.Failed("Access Denied"));
+                }
                 if (isToggle)
                 {
                     existingNote.Pinned = !existingNote.Pinned;
@@ -96,7 +100,7 @@ namespace CarCareTracker.Controllers
                 }
                 result = _noteDataAccess.SaveNoteToVehicle(existingNote);
             }
-            return Json(result);
+            return Json(OperationResponse.Conditional(result, string.Empty, StaticHelper.GenericErrorMessage));
         }
     }
 }

Controllers/Vehicle/OdometerController.cs

@@ -7,13 +7,17 @@ namespace CarCareTracker.Controllers
 {
     public partial class VehicleController
     {
-        [TypeFilter(typeof(CollaboratorFilter))]
         [HttpPost]
         public IActionResult ForceRecalculateDistanceByVehicleId(int vehicleId)
         {
+            //security check
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), vehicleId, HouseholdPermission.Edit))
+            {
+                return Json(OperationResponse.Failed("Access Denied"));
+            }
             var result = _odometerRecordDataAccess.GetOdometerRecordsByVehicleId(vehicleId);
             result = _odometerLogic.AutoConvertOdometerRecord(result);
-            return Json(result.Any());
+            return Json(OperationResponse.Conditional(result.Any(), string.Empty, StaticHelper.GenericErrorMessage));
         }
         [TypeFilter(typeof(CollaboratorFilter))]
         [HttpGet]
@@ -40,9 +44,9 @@ namespace CarCareTracker.Controllers
         public IActionResult SaveOdometerRecordToVehicleId(OdometerRecordInput odometerRecord)
         {
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), odometerRecord.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), odometerRecord.VehicleId, HouseholdPermission.Edit))
             {
-                return Json(false);
+                return Json(OperationResponse.Failed("Access Denied"));
             }
             //move files from temp.
             odometerRecord.Files = odometerRecord.Files.Select(x => { return new UploadedFiles { Name = x.Name, Location = _fileHelper.MoveFileFromTemp(x.Location, "documents/") }; }).ToList();
@@ -52,7 +56,7 @@ namespace CarCareTracker.Controllers
             {
                 StaticHelper.NotifyAsync(_config.GetWebHookUrl(), WebHookPayload.FromOdometerRecord(convertedRecord, odometerRecord.Id == default ? "odometerrecord.add" : "odometerrecord.update", User.Identity.Name));
             }
-            return Json(result);
+            return Json(OperationResponse.Conditional(result, string.Empty, StaticHelper.GenericErrorMessage));
         }
         [TypeFilter(typeof(CollaboratorFilter))]
         [HttpGet]
@@ -88,6 +92,11 @@ namespace CarCareTracker.Controllers
             foreach (int recordId in editModel.RecordIds)
             {
                 var existingRecord = _odometerRecordDataAccess.GetOdometerRecordById(recordId);
+                //security check
+                if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
+                {
+                    return Json(OperationResponse.Failed("Access Denied"));
+                }
                 if (dateIsEdited)
                 {
                     existingRecord.Date = editModel.EditRecord.Date;
@@ -126,14 +135,14 @@ namespace CarCareTracker.Controllers
                 }
                 result = _odometerRecordDataAccess.SaveOdometerRecordToVehicle(existingRecord);
             }
-            return Json(result);
+            return Json(OperationResponse.Conditional(result, string.Empty, StaticHelper.GenericErrorMessage));
         }
         [HttpGet]
         public IActionResult GetOdometerRecordForEditById(int odometerRecordId)
         {
             var result = _odometerRecordDataAccess.GetOdometerRecordById(odometerRecordId);
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), result.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), result.VehicleId, HouseholdPermission.View))
             {
                 return Redirect("/Error/Unauthorized");
             }
@@ -152,20 +161,20 @@ namespace CarCareTracker.Controllers
             };
             return PartialView("Odometer/_OdometerRecordModal", convertedResult);
         }
-        private bool DeleteOdometerRecordWithChecks(int odometerRecordId)
+        private OperationResponse DeleteOdometerRecordWithChecks(int odometerRecordId)
         {
             var existingRecord = _odometerRecordDataAccess.GetOdometerRecordById(odometerRecordId);
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Delete))
             {
-                return false;
+                return OperationResponse.Failed("Access Denied");
             }
             var result = _odometerRecordDataAccess.DeleteOdometerRecordById(existingRecord.Id);
             if (result)
             {
                 StaticHelper.NotifyAsync(_config.GetWebHookUrl(), WebHookPayload.FromOdometerRecord(existingRecord, "odometerrecord.delete", User.Identity.Name));
             }
-            return result;
+            return OperationResponse.Conditional(result, string.Empty, StaticHelper.GenericErrorMessage);
         }
         [HttpPost]
         public IActionResult DeleteOdometerRecordById(int odometerRecordId)

Controllers/Vehicle/PlanController.cs

@@ -18,9 +18,9 @@ namespace CarCareTracker.Controllers
         public IActionResult SavePlanRecordToVehicleId(PlanRecordInput planRecord)
         {
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), planRecord.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), planRecord.VehicleId, HouseholdPermission.Edit))
             {
-                return Json(false);
+                return Json(OperationResponse.Failed("Access Denied"));
             }
             //populate createdDate
             if (planRecord.Id == default)
@@ -47,13 +47,13 @@ namespace CarCareTracker.Controllers
             {
                 StaticHelper.NotifyAsync(_config.GetWebHookUrl(), WebHookPayload.FromPlanRecord(planRecord.ToPlanRecord(), planRecord.Id == default ? "planrecord.add" : "planrecord.update", User.Identity.Name));
             }
-            return Json(result);
+            return Json(OperationResponse.Conditional(result, string.Empty, StaticHelper.GenericErrorMessage));
         }
         [HttpPost]
         public IActionResult SavePlanRecordTemplateToVehicleId(PlanRecordInput planRecord)
         {
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), planRecord.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), planRecord.VehicleId, HouseholdPermission.Edit))
             {
                 return Json(OperationResponse.Failed("Access Denied"));
             }
@@ -65,7 +65,7 @@ namespace CarCareTracker.Controllers
             }
             planRecord.Files = planRecord.Files.Select(x => { return new UploadedFiles { Name = x.Name, Location = _fileHelper.MoveFileFromTemp(x.Location, "documents/") }; }).ToList();
             var result = _planRecordTemplateDataAccess.SavePlanRecordTemplateToVehicle(planRecord);
-            return Json(OperationResponse.Conditional(result, "Template Added", string.Empty));
+            return Json(OperationResponse.Conditional(result, string.Empty, StaticHelper.GenericErrorMessage));
         }
         [TypeFilter(typeof(CollaboratorFilter))]
         [HttpGet]
@@ -80,15 +80,15 @@ namespace CarCareTracker.Controllers
             var existingRecord = _planRecordTemplateDataAccess.GetPlanRecordTemplateById(planRecordTemplateId);
             if (existingRecord.Id == default)
             {
-                return Json(false);
+                return Json(OperationResponse.Failed(StaticHelper.GenericErrorMessage));
             }
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Delete))
             {
-                return Json(false);
+                return Json(OperationResponse.Failed("Access Denied"));
             }
             var result = _planRecordTemplateDataAccess.DeletePlanRecordTemplateById(planRecordTemplateId);
-            return Json(result);
+            return Json(OperationResponse.Conditional(result, string.Empty, StaticHelper.GenericErrorMessage));
         }
         [HttpGet]
         public IActionResult OrderPlanSupplies(int planRecordTemplateId)
@@ -99,7 +99,7 @@ namespace CarCareTracker.Controllers
                 return Json(OperationResponse.Failed("Unable to find template"));
             }
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.View))
             {
                 return Json(OperationResponse.Failed("Access Denied"));
             }
@@ -122,7 +122,7 @@ namespace CarCareTracker.Controllers
                 return Json(OperationResponse.Failed("Unable to find template"));
             }
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
             {
                 return Json(OperationResponse.Failed("Access Denied"));
             }
@@ -161,7 +161,7 @@ namespace CarCareTracker.Controllers
                 }
             }
             var result = _planRecordDataAccess.SavePlanRecordToVehicle(existingRecord.ToPlanRecord());
-            return Json(OperationResponse.Conditional(result, "Plan Record Added", string.Empty));
+            return Json(OperationResponse.Conditional(result, "Plan Record Added", StaticHelper.GenericErrorMessage));
         }
         [HttpGet]
         public IActionResult GetAddPlanRecordPartialView()
@@ -183,13 +183,13 @@ namespace CarCareTracker.Controllers
         {
             if (planRecordId == default)
             {
-                return Json(false);
+                return Json(OperationResponse.Failed(StaticHelper.GenericErrorMessage));
             }
             var existingRecord = _planRecordDataAccess.GetPlanRecordById(planRecordId);
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
             {
-                return Json(false);
+                return Json(OperationResponse.Failed("Access Denied"));
             }
             existingRecord.Progress = planProgress;
             existingRecord.DateModified = DateTime.Now;
@@ -267,12 +267,17 @@ namespace CarCareTracker.Controllers
                     PushbackRecurringReminderRecordWithChecks(existingRecord.ReminderRecordId, DateTime.Now, odometer);
                 }
             }
-            return Json(result);
+            return Json(OperationResponse.Conditional(result, string.Empty, StaticHelper.GenericErrorMessage));
         }
         [HttpGet]
         public IActionResult GetPlanRecordTemplateForEditById(int planRecordTemplateId)
         {
             var result = _planRecordTemplateDataAccess.GetPlanRecordTemplateById(planRecordTemplateId);
+            //security check.
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), result.VehicleId, HouseholdPermission.View))
+            {
+                return Redirect("/Error/Unauthorized");
+            }
             return PartialView("Plan/_PlanRecordTemplateEditModal", result);
         }
         [HttpGet]
@@ -280,7 +285,7 @@ namespace CarCareTracker.Controllers
         {
             var result = _planRecordDataAccess.GetPlanRecordById(planRecordId);
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), result.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), result.VehicleId, HouseholdPermission.View))
             {
                 return Redirect("/Error/Unauthorized");
             }
@@ -309,9 +314,9 @@ namespace CarCareTracker.Controllers
         {
             var existingRecord = _planRecordDataAccess.GetPlanRecordById(planRecordId);
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Delete))
             {
-                return Json(false);
+                return Json(OperationResponse.Failed("Access Denied"));
             }
             //restore any requisitioned supplies if it has not been converted to other record types.
             if (existingRecord.RequisitionHistory.Any() && existingRecord.Progress != PlanProgress.Done)
@@ -323,7 +328,7 @@ namespace CarCareTracker.Controllers
             {
                 StaticHelper.NotifyAsync(_config.GetWebHookUrl(), WebHookPayload.FromPlanRecord(existingRecord, "planrecord.delete", User.Identity.Name));
             }
-            return Json(result);
+            return Json(OperationResponse.Conditional(result, string.Empty, StaticHelper.GenericErrorMessage));
         }
     }
 }

Controllers/Vehicle/ReminderController.cs

@@ -18,7 +18,7 @@ namespace CarCareTracker.Controllers
         {
             var result = GetRemindersAndUrgency(vehicleId, DateTime.Now);
             //check if user wants auto-refresh past-due reminders
-            if (_config.GetUserConfig(User).EnableAutoReminderRefresh)
+            if (_config.GetUserConfig(User).EnableAutoReminderRefresh && _userLogic.UserCanEditVehicle(GetUserID(), vehicleId, HouseholdPermission.Edit))
             {
                 //check for past due reminders that are eligible for recurring.
                 var pastDueAndRecurring = result.Where(x => x.Urgency == ReminderUrgency.PastDue && x.IsRecurring);
@@ -75,7 +75,7 @@ namespace CarCareTracker.Controllers
             var result = PushbackRecurringReminderRecordWithChecks(reminderRecordId, null, null);
             return Json(result);
         }
-        private bool PushbackRecurringReminderRecordWithChecks(int reminderRecordId, DateTime? currentDate, int? currentMileage)
+        private OperationResponse PushbackRecurringReminderRecordWithChecks(int reminderRecordId, DateTime? currentDate, int? currentMileage)
         {
             try
             {
@@ -83,9 +83,9 @@ namespace CarCareTracker.Controllers
                 if (existingReminder is not null && existingReminder.Id != default && existingReminder.IsRecurring)
                 {
                     //security check
-                    if (!_userLogic.UserCanEditVehicle(GetUserID(), existingReminder.VehicleId))
+                    if (!_userLogic.UserCanEditVehicle(GetUserID(), existingReminder.VehicleId, HouseholdPermission.Edit))
                     {
-                        return false;
+                        return OperationResponse.Failed("Access Denied");
                     }
                     existingReminder = _reminderHelper.GetUpdatedRecurringReminderRecord(existingReminder, currentDate, currentMileage);
                     //save to db.
@@ -93,36 +93,36 @@ namespace CarCareTracker.Controllers
                     if (!reminderUpdateResult)
                     {
                         _logger.LogError("Unable to update reminder either because the reminder no longer exists or is no longer recurring");
-                        return false;
+                        return OperationResponse.Failed("Unable to update reminder either because the reminder no longer exists or is no longer recurring");
                     }
-                    return true;
+                    return OperationResponse.Succeed();
                 }
                 else
                 {
                     _logger.LogError("Unable to update reminder because it no longer exists.");
-                    return false;
+                    return OperationResponse.Failed("Unable to update reminder because it no longer exists.");
                 }
             }
             catch (Exception ex)
             {
                 _logger.LogError(ex.Message);
-                return false;
+                return OperationResponse.Failed(StaticHelper.GenericErrorMessage);
             }
         }
         [HttpPost]
         public IActionResult SaveReminderRecordToVehicleId(ReminderRecordInput reminderRecord)
         {
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), reminderRecord.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), reminderRecord.VehicleId, HouseholdPermission.Edit))
             {
-                return Json(false);
+                return Json(OperationResponse.Failed("Access Denied"));
             }
             var result = _reminderRecordDataAccess.SaveReminderRecordToVehicle(reminderRecord.ToReminderRecord());
             if (result)
             {
                 StaticHelper.NotifyAsync(_config.GetWebHookUrl(), WebHookPayload.FromReminderRecord(reminderRecord.ToReminderRecord(), reminderRecord.Id == default ? "reminderrecord.add" : "reminderrecord.update", User.Identity.Name));
             }
-            return Json(result);
+            return Json(OperationResponse.Conditional(result, string.Empty, StaticHelper.GenericErrorMessage));
         }
         [HttpPost]
         public IActionResult GetAddReminderRecordPartialView(ReminderRecordInput? reminderModel)
@@ -141,7 +141,7 @@ namespace CarCareTracker.Controllers
         {
             var result = _reminderRecordDataAccess.GetReminderRecordById(reminderRecordId);
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), result.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), result.VehicleId, HouseholdPermission.View))
             {
                 return Redirect("/Error/Unauthorized");
             }
@@ -168,20 +168,20 @@ namespace CarCareTracker.Controllers
             };
             return PartialView("Reminder/_ReminderRecordModal", convertedResult);
         }
-        private bool DeleteReminderRecordWithChecks(int reminderRecordId)
+        private OperationResponse DeleteReminderRecordWithChecks(int reminderRecordId)
         {
             var existingRecord = _reminderRecordDataAccess.GetReminderRecordById(reminderRecordId);
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Delete))
             {
-                return false;
+                return OperationResponse.Failed("Access Denied");
             }
             var result = _reminderRecordDataAccess.DeleteReminderRecordById(existingRecord.Id);
             if (result)
             {
                 StaticHelper.NotifyAsync(_config.GetWebHookUrl(), WebHookPayload.FromReminderRecord(existingRecord, "reminderrecord.delete", User.Identity.Name));
             }
-            return result;
+            return OperationResponse.Conditional(result, string.Empty, StaticHelper.GenericErrorMessage);
         }
         [HttpPost]
         public IActionResult DeleteReminderRecordById(int reminderRecordId)

Controllers/Vehicle/RepairController.cs

@@ -27,9 +27,9 @@ namespace CarCareTracker.Controllers
         public IActionResult SaveCollisionRecordToVehicleId(CollisionRecordInput collisionRecord)
         {
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), collisionRecord.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), collisionRecord.VehicleId, HouseholdPermission.Edit))
             {
-                return Json(false);
+                return Json(OperationResponse.Failed("Access Denied"));
             }
             //move files from temp.
             collisionRecord.Files = collisionRecord.Files.Select(x => { return new UploadedFiles { Name = x.Name, Location = _fileHelper.MoveFileFromTemp(x.Location, "documents/") }; }).ToList();
@@ -70,7 +70,7 @@ namespace CarCareTracker.Controllers
                     Files = StaticHelper.CreateAttachmentFromRecord(ImportMode.RepairRecord, convertedRecord.Id, convertedRecord.Description)
                 });
             }
-            return Json(result);
+            return Json(OperationResponse.Conditional(result, string.Empty, StaticHelper.GenericErrorMessage));
         }
         [HttpGet]
         public IActionResult GetAddCollisionRecordPartialView()
@@ -82,7 +82,7 @@ namespace CarCareTracker.Controllers
         {
             var result = _collisionRecordDataAccess.GetCollisionRecordById(collisionRecordId);
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), result.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), result.VehicleId, HouseholdPermission.View))
             {
                 return Redirect("/Error/Unauthorized");
             }
@@ -103,13 +103,13 @@ namespace CarCareTracker.Controllers
             };
             return PartialView("Collision/_CollisionRecordModal", convertedResult);
         }
-        private bool DeleteCollisionRecordWithChecks(int collisionRecordId)
+        private OperationResponse DeleteCollisionRecordWithChecks(int collisionRecordId)
         {
             var existingRecord = _collisionRecordDataAccess.GetCollisionRecordById(collisionRecordId);
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Delete))
             {
-                return false;
+                return OperationResponse.Failed("Access Denied");
             }
             //restore any requisitioned supplies.
             if (existingRecord.RequisitionHistory.Any())
@@ -121,7 +121,7 @@ namespace CarCareTracker.Controllers
             {
                 StaticHelper.NotifyAsync(_config.GetWebHookUrl(), WebHookPayload.FromGenericRecord(existingRecord, "repairrecord.delete", User.Identity.Name));
             }
-            return result;
+            return OperationResponse.Conditional(result, string.Empty, StaticHelper.GenericErrorMessage);
         }
         [HttpPost]
         public IActionResult DeleteCollisionRecordById(int collisionRecordId)

Controllers/Vehicle/ServiceController.cs

@@ -27,9 +27,9 @@ namespace CarCareTracker.Controllers
         public IActionResult SaveServiceRecordToVehicleId(ServiceRecordInput serviceRecord)
         {
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), serviceRecord.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), serviceRecord.VehicleId, HouseholdPermission.Edit))
             {
-                return Json(false);
+                return Json(OperationResponse.Failed("Access Denied"));
             }
             //move files from temp.
             serviceRecord.Files = serviceRecord.Files.Select(x => { return new UploadedFiles { Name = x.Name, Location = _fileHelper.MoveFileFromTemp(x.Location, "documents/") }; }).ToList();
@@ -70,7 +70,7 @@ namespace CarCareTracker.Controllers
                     Files = StaticHelper.CreateAttachmentFromRecord(ImportMode.ServiceRecord, convertedRecord.Id, convertedRecord.Description)
                 });
             }
-            return Json(result);
+            return Json(OperationResponse.Conditional(result, string.Empty, StaticHelper.GenericErrorMessage));
         }
         [HttpGet]
         public IActionResult GetAddServiceRecordPartialView()
@@ -82,7 +82,7 @@ namespace CarCareTracker.Controllers
         {
             var result = _serviceRecordDataAccess.GetServiceRecordById(serviceRecordId);
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), result.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), result.VehicleId, HouseholdPermission.View))
             {
                 return Redirect("/Error/Unauthorized");
             }
@@ -103,13 +103,13 @@ namespace CarCareTracker.Controllers
             };
             return PartialView("Service/_ServiceRecordModal", convertedResult);
         }
-        private bool DeleteServiceRecordWithChecks(int serviceRecordId)
+        private OperationResponse DeleteServiceRecordWithChecks(int serviceRecordId)
         {
             var existingRecord = _serviceRecordDataAccess.GetServiceRecordById(serviceRecordId);
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Delete))
             {
-                return false;
+                return OperationResponse.Failed("Access Denied");
             }
             //restore any requisitioned supplies.
             if (existingRecord.RequisitionHistory.Any())
@@ -121,7 +121,7 @@ namespace CarCareTracker.Controllers
             {
                 StaticHelper.NotifyAsync(_config.GetWebHookUrl(), WebHookPayload.FromGenericRecord(existingRecord, "servicerecord.delete", User.Identity.Name));
             }
-            return result;
+            return OperationResponse.Conditional(result, string.Empty, StaticHelper.GenericErrorMessage);
         }
         [HttpPost]
         public IActionResult DeleteServiceRecordById(int serviceRecordId)

Controllers/Vehicle/SupplyController.cs

@@ -145,6 +145,14 @@ namespace CarCareTracker.Controllers
         [HttpPost]
         public IActionResult SaveSupplyRecordToVehicleId(SupplyRecordInput supplyRecord)
         {
+            if (supplyRecord.VehicleId != default)
+            {
+                //security check only if not editing shop supply.
+                if (!_userLogic.UserCanEditVehicle(GetUserID(), supplyRecord.VehicleId, HouseholdPermission.Edit))
+                {
+                    return Json(OperationResponse.Failed("Access Denied"));
+                }
+            }
             //move files from temp.
             supplyRecord.Files = supplyRecord.Files.Select(x => { return new UploadedFiles { Name = x.Name, Location = _fileHelper.MoveFileFromTemp(x.Location, "documents/") }; }).ToList();
             var result = _supplyRecordDataAccess.SaveSupplyRecordToVehicle(supplyRecord.ToSupplyRecord());
@@ -152,7 +160,7 @@ namespace CarCareTracker.Controllers
             {
                 StaticHelper.NotifyAsync(_config.GetWebHookUrl(), WebHookPayload.FromSupplyRecord(supplyRecord.ToSupplyRecord(), supplyRecord.Id == default ? "supplyrecord.add" : "supplyrecord.update", User.Identity.Name));
             }
-            return Json(result);
+            return Json(OperationResponse.Conditional(result, string.Empty, StaticHelper.GenericErrorMessage));
         }
         [HttpGet]
         public IActionResult GetAddSupplyRecordPartialView()
@@ -163,6 +171,14 @@ namespace CarCareTracker.Controllers
         public IActionResult GetSupplyRecordForEditById(int supplyRecordId)
         {
             var result = _supplyRecordDataAccess.GetSupplyRecordById(supplyRecordId);
+            if (result.VehicleId != default)
+            {
+                //security check only if not editing shop supply.
+                if (!_userLogic.UserCanEditVehicle(GetUserID(), result.VehicleId, HouseholdPermission.View))
+                {
+                    return Redirect("/Error/Unauthorized");
+                }
+            }
             if (result.RequisitionHistory.Any())
             {
                 //requisition history when viewed through the supply is always immutable.
@@ -187,15 +203,15 @@ namespace CarCareTracker.Controllers
             };
             return PartialView("Supply/_SupplyRecordModal", convertedResult);
         }
-        private bool DeleteSupplyRecordWithChecks(int supplyRecordId)
+        private OperationResponse DeleteSupplyRecordWithChecks(int supplyRecordId)
         {
             var existingRecord = _supplyRecordDataAccess.GetSupplyRecordById(supplyRecordId);
             if (existingRecord.VehicleId != default)
             {
                 //security check only if not editing shop supply.
-                if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
+                if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Delete))
                 {
-                    return false;
+                    return OperationResponse.Failed("Access Denied");
                 }
             }
             var result = _supplyRecordDataAccess.DeleteSupplyRecordById(existingRecord.Id);
@@ -203,7 +219,7 @@ namespace CarCareTracker.Controllers
             {
                 StaticHelper.NotifyAsync(_config.GetWebHookUrl(), WebHookPayload.FromSupplyRecord(existingRecord, "supplyrecord.delete", User.Identity.Name));
             }
-            return result;
+            return OperationResponse.Conditional(result, string.Empty, StaticHelper.GenericErrorMessage);
         }
         [HttpPost]
         public IActionResult DeleteSupplyRecordById(int supplyRecordId)

Controllers/Vehicle/TaxController.cs

@@ -42,9 +42,9 @@ namespace CarCareTracker.Controllers
         public IActionResult SaveTaxRecordToVehicleId(TaxRecordInput taxRecord)
         {
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), taxRecord.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), taxRecord.VehicleId, HouseholdPermission.Edit))
             {
-                return Json(false);
+                return Json(OperationResponse.Failed("Access Denied"));
             }
             //move files from temp.
             taxRecord.Files = taxRecord.Files.Select(x => { return new UploadedFiles { Name = x.Name, Location = _fileHelper.MoveFileFromTemp(x.Location, "documents/") }; }).ToList();
@@ -62,7 +62,7 @@ namespace CarCareTracker.Controllers
             {
                 StaticHelper.NotifyAsync(_config.GetWebHookUrl(), WebHookPayload.FromTaxRecord(taxRecord.ToTaxRecord(), taxRecord.Id == default ? "taxrecord.add" : "taxrecord.update", User.Identity.Name));
             }
-            return Json(result);
+            return Json(OperationResponse.Conditional(result, string.Empty, StaticHelper.GenericErrorMessage));
         }
         [HttpGet]
         public IActionResult GetAddTaxRecordPartialView()
@@ -74,7 +74,7 @@ namespace CarCareTracker.Controllers
         {
             var result = _taxRecordDataAccess.GetTaxRecordById(taxRecordId);
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), result.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), result.VehicleId, HouseholdPermission.View))
             {
                 return Redirect("/Error/Unauthorized");
             }
@@ -97,20 +97,20 @@ namespace CarCareTracker.Controllers
             };
             return PartialView("Tax/_TaxRecordModal", convertedResult);
         }
-        private bool DeleteTaxRecordWithChecks(int taxRecordId)
+        private OperationResponse DeleteTaxRecordWithChecks(int taxRecordId)
         {
             var existingRecord = _taxRecordDataAccess.GetTaxRecordById(taxRecordId);
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Delete))
             {
-                return false;
+                return OperationResponse.Failed("Access Denied");
             }
             var result = _taxRecordDataAccess.DeleteTaxRecordById(existingRecord.Id);
             if (result)
             {
                 StaticHelper.NotifyAsync(_config.GetWebHookUrl(), WebHookPayload.FromTaxRecord(existingRecord, "taxrecord.delete", User.Identity.Name));
             }
-            return result;
+            return OperationResponse.Conditional(result, string.Empty, StaticHelper.GenericErrorMessage);
         }
         [HttpPost]
         public IActionResult DeleteTaxRecordById(int taxRecordId)

Controllers/Vehicle/UpgradeController.cs

@@ -27,9 +27,9 @@ namespace CarCareTracker.Controllers
         public IActionResult SaveUpgradeRecordToVehicleId(UpgradeRecordInput upgradeRecord)
         {
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), upgradeRecord.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), upgradeRecord.VehicleId, HouseholdPermission.Edit))
             {
-                return Json(false);
+                return Json(OperationResponse.Failed("Access Denied"));
             }
             //move files from temp.
             upgradeRecord.Files = upgradeRecord.Files.Select(x => { return new UploadedFiles { Name = x.Name, Location = _fileHelper.MoveFileFromTemp(x.Location, "documents/") }; }).ToList();
@@ -70,7 +70,7 @@ namespace CarCareTracker.Controllers
                     Files = StaticHelper.CreateAttachmentFromRecord(ImportMode.UpgradeRecord, convertedRecord.Id, convertedRecord.Description)
                 });
             }
-            return Json(result);
+            return Json(OperationResponse.Conditional(result, string.Empty, StaticHelper.GenericErrorMessage));
         }
         [HttpGet]
         public IActionResult GetAddUpgradeRecordPartialView()
@@ -82,7 +82,7 @@ namespace CarCareTracker.Controllers
         {
             var result = _upgradeRecordDataAccess.GetUpgradeRecordById(upgradeRecordId);
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), result.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), result.VehicleId, HouseholdPermission.View))
             {
                 return Redirect("/Error/Unauthorized");
             }
@@ -103,13 +103,13 @@ namespace CarCareTracker.Controllers
             };
             return PartialView("Upgrade/_UpgradeRecordModal", convertedResult);
         }
-        private bool DeleteUpgradeRecordWithChecks(int upgradeRecordId)
+        private OperationResponse DeleteUpgradeRecordWithChecks(int upgradeRecordId)
         {
             var existingRecord = _upgradeRecordDataAccess.GetUpgradeRecordById(upgradeRecordId);
             //security check.
-            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Delete))
             {
-                return false;
+                return OperationResponse.Failed("Access Denied");
             }
             //restore any requisitioned supplies.
             if (existingRecord.RequisitionHistory.Any())
@@ -121,7 +121,7 @@ namespace CarCareTracker.Controllers
             {
                 StaticHelper.NotifyAsync(_config.GetWebHookUrl(), WebHookPayload.FromGenericRecord(existingRecord, "upgraderecord.delete", User.Identity.Name));
             }
-            return result;
+            return OperationResponse.Conditional(result, string.Empty, StaticHelper.GenericErrorMessage);
         }
         [HttpPost]
         public IActionResult DeleteUpgradeRecordById(int upgradeRecordId)

Controllers/VehicleController.cs

@@ -124,9 +124,9 @@ namespace CarCareTracker.Controllers
                 bool isNewAddition = vehicleInput.Id == default;
                 if (!isNewAddition)
                 {
-                    if (!_userLogic.UserCanEditVehicle(GetUserID(), vehicleInput.Id))
+                    if (!_userLogic.UserCanEditVehicle(GetUserID(), vehicleInput.Id, HouseholdPermission.Edit))
                     {
-                        return View("401");
+                        return Json(OperationResponse.Failed("Access Denied"));
                     }
                 }
                 //move image from temp folder to images folder.
@@ -143,12 +143,12 @@ namespace CarCareTracker.Controllers
                 {
                     StaticHelper.NotifyAsync(_config.GetWebHookUrl(), WebHookPayload.Generic($"Updated Vehicle {vehicleInput.Year} {vehicleInput.Make} {vehicleInput.Model}({StaticHelper.GetVehicleIdentifier(vehicleInput)})", "vehicle.update", User.Identity.Name, vehicleInput.Id.ToString()));
                 }
-                return Json(result);
+                return Json(OperationResponse.Conditional(result, string.Empty, StaticHelper.GenericErrorMessage));
             }
             catch (Exception ex)
             {
                 _logger.LogError(ex, "Error Saving Vehicle");
-                return Json(false);
+                return Json(OperationResponse.Failed(StaticHelper.GenericErrorMessage));
             }
         }
         [HttpPost]
@@ -206,7 +206,7 @@ namespace CarCareTracker.Controllers
                 }
                 results.Add(result);
             }
-            return Json(OperationResponse.Conditional(results.Any() && results.All(x => x), "", StaticHelper.GenericErrorMessage));
+            return Json(OperationResponse.Conditional(results.Any() && results.All(x => x), string.Empty, StaticHelper.GenericErrorMessage));
         }
         [HttpPost]
         [TypeFilter(typeof(StrictCollaboratorFilter), Arguments = new object[] { true, true })]
@@ -216,7 +216,7 @@ namespace CarCareTracker.Controllers
             if (vehicleIds.Count() == 1)
             {
                 //only one vehicle to manage
-                if (_userLogic.UserCanEditVehicle(GetUserID(), vehicleIds.First()))
+                if (_userLogic.UserCanEditVehicle(GetUserID(), vehicleIds.First(), HouseholdPermission.View))
                 {
                     viewModel.CommonCollaborators = _userLogic.GetCollaboratorsForVehicle(vehicleIds.First()).Select(x => x.UserName).ToList();
                     viewModel.VehicleIds.Add(vehicleIds.First());
@@ -227,7 +227,7 @@ namespace CarCareTracker.Controllers
                 List<UserCollaborator> allCollaborators = new List<UserCollaborator>();
                 foreach (int vehicleId in vehicleIds)
                 {
-                    if (_userLogic.UserCanEditVehicle(GetUserID(), vehicleId))
+                    if (_userLogic.UserCanEditVehicle(GetUserID(), vehicleId, HouseholdPermission.View))
                     {
                         var vehicleCollaborators = _userLogic.GetCollaboratorsForVehicle(vehicleId);
                         allCollaborators.AddRange(vehicleCollaborators);
@@ -631,6 +631,11 @@ namespace CarCareTracker.Controllers
                     genericRecord = _upgradeRecordDataAccess.GetUpgradeRecordById(recordId);
                     break;
             }
+            //security check
+            if (!_userLogic.UserCanEditVehicle(GetUserID(), genericRecord.VehicleId, HouseholdPermission.Edit))
+            {
+                return Json(OperationResponse.Failed("Access Denied"));
+            }
             //save
             switch (destination)
             {
@@ -681,6 +686,11 @@ namespace CarCareTracker.Controllers
                         genericRecord = _upgradeRecordDataAccess.GetUpgradeRecordById(recordId);
                         break;
                 }
+                //security check
+                if (!_userLogic.UserCanEditVehicle(GetUserID(), genericRecord.VehicleId, HouseholdPermission.Edit))
+                {
+                    return Json(OperationResponse.Failed("Access Denied"));
+                }
                 //save
                 switch (destination)
                 {
@@ -715,11 +725,11 @@ namespace CarCareTracker.Controllers
             {
                 StaticHelper.NotifyAsync(_config.GetWebHookUrl(), WebHookPayload.Generic($"Moved multiple {source.ToString()} to {destination.ToString()} - Ids: {string.Join(",", recordIds)}", "bulk.move", User.Identity.Name, string.Empty));
             }
-            return Json(result);
+            return Json(OperationResponse.Conditional(result, string.Empty, StaticHelper.GenericErrorMessage));
         }
         public IActionResult DeleteRecords(List<int> recordIds, ImportMode importMode)
         {
-            bool result = false;
+            OperationResponse result = OperationResponse.Failed(StaticHelper.GenericErrorMessage);
             foreach (int recordId in recordIds)
             {
                 switch (importMode)
@@ -756,14 +766,14 @@ namespace CarCareTracker.Controllers
                         break;
                 }
             }
-            if (result)
+            if (result.Success)
             {
                 StaticHelper.NotifyAsync(_config.GetWebHookUrl(), WebHookPayload.Generic($"Deleted multiple {importMode.ToString()} - Ids: {string.Join(", ", recordIds)}", "bulk.delete", User.Identity.Name, string.Empty));
             }
             return Json(result);
         }
-        [TypeFilter(typeof(CollaboratorFilter))]
         [HttpPost]
+        [TypeFilter(typeof(CollaboratorFilter), Arguments = new object[] {false, true, HouseholdPermission.Edit})]
         public IActionResult AdjustRecordsOdometer(List<int> recordIds, int vehicleId, ImportMode importMode)
         {
             bool result = false;
@@ -819,7 +829,7 @@ namespace CarCareTracker.Controllers
             {
                 StaticHelper.NotifyAsync(_config.GetWebHookUrl(), WebHookPayload.Generic($"Adjusted odometer for multiple {importMode.ToString()} - Ids: {string.Join(",", recordIds)}", "bulk.odometer.adjust", User.Identity.Name, string.Empty));
             }
-            return Json(result);
+            return Json(OperationResponse.Conditional(result, string.Empty, StaticHelper.GenericErrorMessage));
         }
         [HttpPost]
         public IActionResult DuplicateRecords(List<int> recordIds, ImportMode importMode)
@@ -832,6 +842,11 @@ namespace CarCareTracker.Controllers
                     case ImportMode.ServiceRecord:
                         {
                             var existingRecord = _serviceRecordDataAccess.GetServiceRecordById(recordId);
+                            //security check
+                            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
+                            {
+                                return Json(OperationResponse.Failed("Access Denied"));
+                            }
                             existingRecord.Id = default;
                             existingRecord.RequisitionHistory = new List<SupplyUsageHistory>();
                             result = _serviceRecordDataAccess.SaveServiceRecordToVehicle(existingRecord);
@@ -840,6 +855,11 @@ namespace CarCareTracker.Controllers
                     case ImportMode.RepairRecord:
                         {
                             var existingRecord = _collisionRecordDataAccess.GetCollisionRecordById(recordId);
+                            //security check
+                            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
+                            {
+                                return Json(OperationResponse.Failed("Access Denied"));
+                            }
                             existingRecord.Id = default;
                             existingRecord.RequisitionHistory = new List<SupplyUsageHistory>();
                             result = _collisionRecordDataAccess.SaveCollisionRecordToVehicle(existingRecord);
@@ -848,6 +868,11 @@ namespace CarCareTracker.Controllers
                     case ImportMode.UpgradeRecord:
                         {
                             var existingRecord = _upgradeRecordDataAccess.GetUpgradeRecordById(recordId);
+                            //security check
+                            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
+                            {
+                                return Json(OperationResponse.Failed("Access Denied"));
+                            }
                             existingRecord.Id = default;
                             existingRecord.RequisitionHistory = new List<SupplyUsageHistory>();
                             result = _upgradeRecordDataAccess.SaveUpgradeRecordToVehicle(existingRecord);
@@ -856,6 +881,11 @@ namespace CarCareTracker.Controllers
                     case ImportMode.GasRecord:
                         {
                             var existingRecord = _gasRecordDataAccess.GetGasRecordById(recordId);
+                            //security check
+                            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
+                            {
+                                return Json(OperationResponse.Failed("Access Denied"));
+                            }
                             existingRecord.Id = default;
                             result = _gasRecordDataAccess.SaveGasRecordToVehicle(existingRecord);
                         }
@@ -863,6 +893,11 @@ namespace CarCareTracker.Controllers
                     case ImportMode.TaxRecord:
                         {
                             var existingRecord = _taxRecordDataAccess.GetTaxRecordById(recordId);
+                            //security check
+                            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
+                            {
+                                return Json(OperationResponse.Failed("Access Denied"));
+                            }
                             existingRecord.Id = default;
                             result = _taxRecordDataAccess.SaveTaxRecordToVehicle(existingRecord);
                         }
@@ -870,6 +905,11 @@ namespace CarCareTracker.Controllers
                     case ImportMode.SupplyRecord:
                         {
                             var existingRecord = _supplyRecordDataAccess.GetSupplyRecordById(recordId);
+                            //security check if not shop supply
+                            if (existingRecord.VehicleId != default && !_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
+                            {
+                                return Json(OperationResponse.Failed("Access Denied"));
+                            }
                             existingRecord.Id = default;
                             existingRecord.RequisitionHistory = new List<SupplyUsageHistory>();
                             result = _supplyRecordDataAccess.SaveSupplyRecordToVehicle(existingRecord);
@@ -878,6 +918,11 @@ namespace CarCareTracker.Controllers
                     case ImportMode.NoteRecord:
                         {
                             var existingRecord = _noteDataAccess.GetNoteById(recordId);
+                            //security check
+                            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
+                            {
+                                return Json(OperationResponse.Failed("Access Denied"));
+                            }
                             existingRecord.Id = default;
                             result = _noteDataAccess.SaveNoteToVehicle(existingRecord);
                         }
@@ -885,6 +930,11 @@ namespace CarCareTracker.Controllers
                     case ImportMode.OdometerRecord:
                         {
                             var existingRecord = _odometerRecordDataAccess.GetOdometerRecordById(recordId);
+                            //security check
+                            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
+                            {
+                                return Json(OperationResponse.Failed("Access Denied"));
+                            }
                             existingRecord.Id = default;
                             result = _odometerRecordDataAccess.SaveOdometerRecordToVehicle(existingRecord);
                         }
@@ -892,6 +942,11 @@ namespace CarCareTracker.Controllers
                     case ImportMode.ReminderRecord:
                         {
                             var existingRecord = _reminderRecordDataAccess.GetReminderRecordById(recordId);
+                            //security check
+                            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
+                            {
+                                return Json(OperationResponse.Failed("Access Denied"));
+                            }
                             existingRecord.Id = default;
                             result = _reminderRecordDataAccess.SaveReminderRecordToVehicle(existingRecord);
                         }
@@ -899,6 +954,11 @@ namespace CarCareTracker.Controllers
                     case ImportMode.PlanRecord:
                         {
                             var existingRecord = _planRecordDataAccess.GetPlanRecordById(recordId);
+                            //security check
+                            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
+                            {
+                                return Json(OperationResponse.Failed("Access Denied"));
+                            }
                             existingRecord.Id = default;
                             existingRecord.ReminderRecordId = default;
                             existingRecord.RequisitionHistory = new List<SupplyUsageHistory>();
@@ -908,6 +968,11 @@ namespace CarCareTracker.Controllers
                     case ImportMode.InspectionRecord:
                         {
                             var existingRecord = _inspectionRecordTemplateDataAccess.GetInspectionRecordTemplateById(recordId);
+                            //security check
+                            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
+                            {
+                                return Json(OperationResponse.Failed("Access Denied"));
+                            }
                             existingRecord.Id = default;
                             existingRecord.ReminderRecordId = new List<int>();
                             result = _inspectionRecordTemplateDataAccess.SaveInspectionReportTemplateToVehicle(existingRecord);
@@ -919,9 +984,10 @@ namespace CarCareTracker.Controllers
             {
                 StaticHelper.NotifyAsync(_config.GetWebHookUrl(), WebHookPayload.Generic($"Duplicated multiple {importMode.ToString()} - Ids: {string.Join(",", recordIds)}", "bulk.duplicate", User.Identity.Name, string.Empty));
             }
-            return Json(result);
+            return Json(OperationResponse.Conditional(result, string.Empty, StaticHelper.GenericErrorMessage));
         }
         [HttpPost]
+        [TypeFilter(typeof(CollaboratorFilter), Arguments = new object[] { true, true, HouseholdPermission.Edit })]
         public IActionResult DuplicateRecordsToOtherVehicles(List<int> recordIds, List<int> vehicleIds, ImportMode importMode)
         {
             bool result = false;
@@ -1066,7 +1132,7 @@ namespace CarCareTracker.Controllers
             {
                 StaticHelper.NotifyAsync(_config.GetWebHookUrl(), WebHookPayload.Generic($"Duplicated multiple {importMode.ToString()} - Ids: {string.Join(",", recordIds)} - to Vehicle Ids: {string.Join(",", vehicleIds)}", "bulk.duplicate.to.vehicles", User.Identity.Name, string.Join(",", vehicleIds)));
             }
-            return Json(result);
+            return Json(OperationResponse.Conditional(result, string.Empty, StaticHelper.GenericErrorMessage));
         }
         [HttpPost]
         public IActionResult BulkCreateOdometerRecords(List<int> recordIds, ImportMode importMode)
@@ -1079,6 +1145,11 @@ namespace CarCareTracker.Controllers
                     case ImportMode.ServiceRecord:
                         {
                             var existingRecord = _serviceRecordDataAccess.GetServiceRecordById(recordId);
+                            //security check
+                            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
+                            {
+                                return Json(OperationResponse.Failed("Access Denied"));
+                            }
                             result = _odometerLogic.AutoInsertOdometerRecord(new OdometerRecord
                             {
                                 Date = existingRecord.Date,
@@ -1092,6 +1163,11 @@ namespace CarCareTracker.Controllers
                     case ImportMode.RepairRecord:
                         {
                             var existingRecord = _collisionRecordDataAccess.GetCollisionRecordById(recordId);
+                            //security check
+                            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
+                            {
+                                return Json(OperationResponse.Failed("Access Denied"));
+                            }
                             result = _odometerLogic.AutoInsertOdometerRecord(new OdometerRecord
                             {
                                 Date = existingRecord.Date,
@@ -1105,6 +1181,11 @@ namespace CarCareTracker.Controllers
                     case ImportMode.UpgradeRecord:
                         {
                             var existingRecord = _upgradeRecordDataAccess.GetUpgradeRecordById(recordId);
+                            //security check
+                            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
+                            {
+                                return Json(OperationResponse.Failed("Access Denied"));
+                            }
                             result = _odometerLogic.AutoInsertOdometerRecord(new OdometerRecord
                             {
                                 Date = existingRecord.Date,
@@ -1118,6 +1199,11 @@ namespace CarCareTracker.Controllers
                     case ImportMode.GasRecord:
                         {
                             var existingRecord = _gasRecordDataAccess.GetGasRecordById(recordId);
+                            //security check
+                            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
+                            {
+                                return Json(OperationResponse.Failed("Access Denied"));
+                            }
                             result = _odometerLogic.AutoInsertOdometerRecord(new OdometerRecord
                             {
                                 Date = existingRecord.Date,
@@ -1134,7 +1220,7 @@ namespace CarCareTracker.Controllers
             {
                 StaticHelper.NotifyAsync(_config.GetWebHookUrl(), WebHookPayload.Generic($"Created Odometer Records based on {importMode.ToString()} - Ids: {string.Join(",", recordIds)}", "bulk.odometer.insert", User.Identity.Name, string.Empty));
             }
-            return Json(result);
+            return Json(OperationResponse.Conditional(result, string.Empty, StaticHelper.GenericErrorMessage));
         }
         [HttpPost]
         public IActionResult GetGenericRecordModal(List<int> recordIds, ImportMode dataType)
@@ -1169,6 +1255,11 @@ namespace CarCareTracker.Controllers
                     case ImportMode.ServiceRecord:
                         {
                             var existingRecord = _serviceRecordDataAccess.GetServiceRecordById(recordId);
+                            //security check
+                            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
+                            {
+                                return Json(OperationResponse.Failed("Access Denied"));
+                            }
                             if (dateIsEdited)
                             {
                                 existingRecord.Date = genericRecordEditModel.EditRecord.Date;
@@ -1215,6 +1306,11 @@ namespace CarCareTracker.Controllers
                     case ImportMode.RepairRecord:
                         {
                             var existingRecord = _collisionRecordDataAccess.GetCollisionRecordById(recordId);
+                            //security check
+                            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
+                            {
+                                return Json(OperationResponse.Failed("Access Denied"));
+                            }
                             if (dateIsEdited)
                             {
                                 existingRecord.Date = genericRecordEditModel.EditRecord.Date;
@@ -1261,6 +1357,11 @@ namespace CarCareTracker.Controllers
                     case ImportMode.UpgradeRecord:
                         {
                             var existingRecord = _upgradeRecordDataAccess.GetUpgradeRecordById(recordId);
+                            //security check
+                            if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
+                            {
+                                return Json(OperationResponse.Failed("Access Denied"));
+                            }
                             if (dateIsEdited)
                             {
                                 existingRecord.Date = genericRecordEditModel.EditRecord.Date;
@@ -1306,9 +1407,10 @@ namespace CarCareTracker.Controllers
                         break;
                 }
             }
-            return Json(result);
+            return Json(OperationResponse.Conditional(result, string.Empty, StaticHelper.GenericErrorMessage));
         }
         [HttpPost]
+        [TypeFilter(typeof(CollaboratorFilter), Arguments = new object[] { false, true, HouseholdPermission.View })]
         public IActionResult PrintRecordStickers(int vehicleId, List<int> recordIds, ImportMode importMode)
         {
             bool result = false;
@@ -1475,7 +1577,7 @@ namespace CarCareTracker.Controllers
             {
                 return PartialView("_Stickers", stickerViewModel);
             }
-            return Json(result);
+            return Json(OperationResponse.Failed(StaticHelper.GenericErrorMessage));
         }
         [HttpPost]
         public IActionResult SaveUserColumnPreferences(UserColumnPreference columnPreference)

Enum/HouseholdPermission.cs

@@ -0,0 +1,9 @@
+namespace CarCareTracker.Models
+{
+    public enum HouseholdPermission
+    {
+        View = 0,
+        Edit = 1,
+        Delete = 2
+    }
+}

External/Implementations/Postgres/UserHouseholdDataAccess.cs

@@ -1,6 +1,7 @@
 using CarCareTracker.External.Interfaces;
 using CarCareTracker.Models;
 using Npgsql;
+using System.Text.Json;
 
 namespace CarCareTracker.External.Implementations
 {
@@ -16,7 +17,7 @@ namespace CarCareTracker.External.Implementations
             try
             {
                 //create table if not exist.
-                string initCMD = $"CREATE SCHEMA IF NOT EXISTS app; CREATE TABLE IF NOT EXISTS app.{tableName} (parentUserId INT, childUserId INT, PRIMARY KEY(parentUserId, childUserId))";
+                string initCMD = $"CREATE SCHEMA IF NOT EXISTS app; CREATE TABLE IF NOT EXISTS app.{tableName} (parentUserId INT, childUserId INT, data jsonb not null, PRIMARY KEY(parentUserId, childUserId))";
                 using (var ctext = pgDataSource.CreateCommand(initCMD))
                 {
                     ctext.ExecuteNonQuery();
@@ -31,7 +32,7 @@ namespace CarCareTracker.External.Implementations
         {
             try
             {
-                string cmd = $"SELECT parentUserId, childUserId FROM app.{tableName} WHERE parentUserId = @parentUserId";
+                string cmd = $"SELECT data FROM app.{tableName} WHERE parentUserId = @parentUserId";
                 var results = new List<UserHousehold>();
                 using (var ctext = pgDataSource.CreateCommand(cmd))
                 {
@@ -39,14 +40,7 @@ namespace CarCareTracker.External.Implementations
                     using (NpgsqlDataReader reader = ctext.ExecuteReader())
                         while (reader.Read())
                         {
-                            UserHousehold result = new UserHousehold()
-                            {
-                                Id = new HouseholdAccess
-                                {
-                                    ParentUserId = int.Parse(reader["parentUserId"].ToString()),
-                                    ChildUserId = int.Parse(reader["childUserId"].ToString())
-                                }
-                            };
+                            UserHousehold result = JsonSerializer.Deserialize<UserHousehold>(reader["data"] as string);
                             results.Add(result);
                         }
                 }
@@ -62,7 +56,7 @@ namespace CarCareTracker.External.Implementations
         {
             try
             {
-                string cmd = $"SELECT parentUserId, childUserId FROM app.{tableName} WHERE childUserId = @childUserId";
+                string cmd = $"SELECT data FROM app.{tableName} WHERE childUserId = @childUserId";
                 var results = new List<UserHousehold>();
                 using (var ctext = pgDataSource.CreateCommand(cmd))
                 {
@@ -70,14 +64,7 @@ namespace CarCareTracker.External.Implementations
                     using (NpgsqlDataReader reader = ctext.ExecuteReader())
                         while (reader.Read())
                         {
-                            UserHousehold result = new UserHousehold()
-                            {
-                                Id = new HouseholdAccess
-                                {
-                                    ParentUserId = int.Parse(reader["parentUserId"].ToString()),
-                                    ChildUserId = int.Parse(reader["childUserId"].ToString())
-                                }
-                            };
+                            UserHousehold result = JsonSerializer.Deserialize<UserHousehold>(reader["data"] as string);
                             results.Add(result);
                         }
                 }
@@ -93,7 +80,7 @@ namespace CarCareTracker.External.Implementations
         {
             try
             {
-                string cmd = $"SELECT parentUserId, childUserId FROM app.{tableName} WHERE parentUserId = @parentUserId AND childUserId = @childUserId";
+                string cmd = $"SELECT data FROM app.{tableName} WHERE parentUserId = @parentUserId AND childUserId = @childUserId";
                 UserHousehold result = null;
                 using (var ctext = pgDataSource.CreateCommand(cmd))
                 {
@@ -102,14 +89,7 @@ namespace CarCareTracker.External.Implementations
                     using (NpgsqlDataReader reader = ctext.ExecuteReader())
                         while (reader.Read())
                         {
-                            result = new UserHousehold()
-                            {
-                                Id = new HouseholdAccess
-                                {
-                                    ParentUserId = int.Parse(reader["parentUserId"].ToString()),
-                                    ChildUserId = int.Parse(reader["childUserId"].ToString())
-                                }
-                            };
+                            result = JsonSerializer.Deserialize<UserHousehold>(reader["data"] as string);
                             return result;
                         }
                 }
@@ -125,11 +105,13 @@ namespace CarCareTracker.External.Implementations
         {
             try
             {
-                string cmd = $"INSERT INTO app.{tableName} (parentUserId, childUserId) VALUES(@parentUserId, @childUserId)";
+                string cmd = $"INSERT INTO app.{tableName} (parentUserId, childUserId, data) VALUES(@parentUserId, @childUserId, CAST(@data AS jsonb)) ON CONFLICT(parentUserId, childUserId) DO UPDATE SET data = CAST(@data AS jsonb)";
                 using (var ctext = pgDataSource.CreateCommand(cmd))
                 {
+                    var serializedData = JsonSerializer.Serialize(userHousehold);
                     ctext.Parameters.AddWithValue("parentUserId", userHousehold.Id.ParentUserId);
                     ctext.Parameters.AddWithValue("childUserId", userHousehold.Id.ChildUserId);
+                    ctext.Parameters.AddWithValue("data", serializedData);
                     return ctext.ExecuteNonQuery() > 0;
                 }
             }

Filter/CollaboratorFilter.cs

@@ -11,42 +11,58 @@ namespace CarCareTracker.Filter
     {
         private readonly IUserLogic _userLogic;
         private readonly IConfigHelper _config;
-        public CollaboratorFilter(IUserLogic userLogic, IConfigHelper config) {
+        private readonly bool _multiple;
+        private readonly bool _jsonResponse;
+        private readonly HouseholdPermission _permission;
+        public CollaboratorFilter(IUserLogic userLogic, IConfigHelper config, bool? multiple = false, bool? jsonResponse = false, HouseholdPermission? permission = HouseholdPermission.View) {
             _userLogic = userLogic;
             _config = config;
+            _multiple = multiple ?? false; ;
+            _jsonResponse = jsonResponse ?? false;
+            _permission = permission ?? HouseholdPermission.View;
         }
         public override void OnActionExecuting(ActionExecutingContext filterContext)
         {
             if (!filterContext.HttpContext.User.IsInRole(nameof(UserData.IsRootUser)))
             {
-                if (filterContext.ActionArguments.ContainsKey("vehicleId"))
+                List<int> vehicleIds = new List<int>();
+                if (!_multiple && filterContext.ActionArguments.ContainsKey("vehicleId"))
                 {
-                    var vehicleId = int.Parse(filterContext.ActionArguments["vehicleId"].ToString());
-                    if (vehicleId != default)
+                    vehicleIds.Add(int.Parse(filterContext.ActionArguments["vehicleId"].ToString()));
+                }
+                else if (_multiple && filterContext.ActionArguments.ContainsKey("vehicleIds"))
+                {
+                    vehicleIds.AddRange(filterContext.ActionArguments["vehicleIds"] as List<int>);
+                }
+                if (vehicleIds.Any())
+                {
+                    foreach(int vehicleId in vehicleIds)
                     {
-                        var userId = int.Parse(filterContext.HttpContext.User.FindFirstValue(ClaimTypes.NameIdentifier));
-                        if (!_userLogic.UserCanEditVehicle(userId, vehicleId))
+                        if (vehicleId != default)
                         {
-                            filterContext.Result = new RedirectResult("/Error/Unauthorized");
+                            var userId = int.Parse(filterContext.HttpContext.User.FindFirstValue(ClaimTypes.NameIdentifier));
+                            if (!_userLogic.UserCanEditVehicle(userId, vehicleId, _permission))
+                            {
+                                filterContext.Result = _jsonResponse ? new JsonResult(OperationResponse.Failed("Access Denied")) : new RedirectResult("/Error/Unauthorized");
+                            }
                         }
-                    }
-                    else
-                    {
-                        var shopSupplyEndpoints = new List<string> { "ImportToVehicleIdFromCsv", "GetSupplyRecordsByVehicleId", "ExportFromVehicleToCsv" };
-                        if (shopSupplyEndpoints.Contains(filterContext.RouteData.Values["action"].ToString()) && !_config.GetServerEnableShopSupplies())
+                        else
                         {
-                            //user trying to access shop supplies but shop supplies is not enabled by root user.
-                            filterContext.Result = new RedirectResult("/Error/Unauthorized");
-                        }
-                        else if (!shopSupplyEndpoints.Contains(filterContext.RouteData.Values["action"].ToString()))
-                        {
-                            //user trying to access any other endpoints using 0 as vehicle id.
-                            filterContext.Result = new RedirectResult("/Error/Unauthorized");
+                            if (StaticHelper.IsShopSupplyEndpoint(filterContext.RouteData.Values["action"].ToString()) && !_config.GetServerEnableShopSupplies())
+                            {
+                                //user trying to access shop supplies but shop supplies is not enabled by root user.
+                                filterContext.Result = _jsonResponse ? new JsonResult(OperationResponse.Failed("Access Denied")) : new RedirectResult("/Error/Unauthorized");
+                            }
+                            else if (!StaticHelper.IsShopSupplyEndpoint(filterContext.RouteData.Values["action"].ToString()))
+                            {
+                                //user trying to access any other endpoints using 0 as vehicle id.
+                                filterContext.Result = _jsonResponse ? new JsonResult(OperationResponse.Failed("Access Denied")) : new RedirectResult("/Error/Unauthorized");
+                            }
                         }
                     }
                 } else
                 {
-                    filterContext.Result = new RedirectResult("/Error/Unauthorized");
+                    filterContext.Result = _jsonResponse ? new JsonResult(OperationResponse.Failed("Access Denied")) : new RedirectResult("/Error/Unauthorized");
                 }
             }
         }

Filter/StrictCollaboratorFilter.cs

@@ -47,13 +47,12 @@ namespace CarCareTracker.Filter
                         }
                         else
                         {
-                            var shopSupplyEndpoints = new List<string> { "ImportToVehicleIdFromCsv", "GetSupplyRecordsByVehicleId", "ExportFromVehicleToCsv" };
-                            if (shopSupplyEndpoints.Contains(filterContext.RouteData.Values["action"].ToString()) && !_config.GetServerEnableShopSupplies())
+                            if (StaticHelper.IsShopSupplyEndpoint(filterContext.RouteData.Values["action"].ToString()) && !_config.GetServerEnableShopSupplies())
                             {
                                 //user trying to access shop supplies but shop supplies is not enabled by root user.
                                 filterContext.Result = _jsonResponse ? new JsonResult(OperationResponse.Failed("Access Denied")) : new RedirectResult("/Error/Unauthorized");
                             }
-                            else if (!shopSupplyEndpoints.Contains(filterContext.RouteData.Values["action"].ToString()))
+                            else if (!StaticHelper.IsShopSupplyEndpoint(filterContext.RouteData.Values["action"].ToString()))
                             {
                                 //user trying to access any other endpoints using 0 as vehicle id.
                                 filterContext.Result = _jsonResponse ? new JsonResult(OperationResponse.Failed("Access Denied")) : new RedirectResult("/Error/Unauthorized");

Helper/StaticHelper.cs

@@ -935,5 +935,10 @@ namespace CarCareTracker.Helper
 
             return Convert.ToDecimal(goodNormalizedStep * stepPower);
         }
+        public static bool IsShopSupplyEndpoint(string endpoint)
+        {
+            var shopSupplyEndpoints = new List<string> { "ImportToVehicleIdFromCsv", "GetSupplyRecordsByVehicleId", "ExportFromVehicleToCsv", "DuplicateRecordsToOtherVehicles", "PrintRecordStickers" };
+            return shopSupplyEndpoints.Contains(endpoint);
+        }
     }
 }

Logic/UserLogic.cs

@@ -11,12 +11,13 @@ namespace CarCareTracker.Logic
         OperationResponse DeleteCollaboratorFromVehicle(int vehicleId, string username);
         OperationResponse AddCollaboratorToVehicle(int vehicleId, string username);
         List<Vehicle> FilterUserVehicles(List<Vehicle> results, int userId);
-        bool UserCanEditVehicle(int userId, int vehicleId);
+        bool UserCanEditVehicle(int userId, int vehicleId, HouseholdPermission permission);
         bool UserCanDirectlyEditVehicle(int userId, int vehicleId);
         bool DeleteAllAccessToVehicle(int vehicleId);
         bool DeleteAllAccessToUser(int userId);
         List<UserHouseholdViewModel> GetHouseholdForParentUserId(int parentUserId);
         OperationResponse AddUserToHousehold(int parentUserId, string childUsername);
+        bool UpdateUserHousehold(int parentUserId, int childUserId, List<HouseholdPermission> permissions);
         bool DeleteUserFromHousehold(int parentUserId, int childUserId);
         bool DeleteAllHouseholdByParentUserId(int parentUserId);
         bool DeleteAllHouseholdByChildUserId(int childUserId);
@@ -141,25 +142,27 @@ namespace CarCareTracker.Logic
                 return new List<Vehicle>();
             }
         }
-        public bool UserCanEditVehicle(int userId, int vehicleId)
+        public bool UserCanEditVehicle(int userId, int vehicleId, HouseholdPermission permission)
         {
-            if (userId == -1)
+            //check if user is full collaborator or root user
+            if (UserCanDirectlyEditVehicle(userId, vehicleId))
             {
                 return true;
             }
-            List<int> userIds = new List<int> { userId };
+            //user is not a full collaborator, check households
+            List<int> userIds = new List<int>();
             var userHouseholds = _userHouseholdData.GetUserHouseholdByChildUserId(userId);
-            if (userHouseholds.Any())
+            foreach (UserHousehold userHousehold in userHouseholds)
             {
-                //add parent's user ids
-                userIds.AddRange(userHouseholds.Select(x => x.Id.ParentUserId));
-            }
-            foreach (int userIdToCheck in userIds)
-            {
-                var userAccess = _userAccess.GetUserAccessByVehicleAndUserId(userIdToCheck, vehicleId);
-                if (userAccess != null && userAccess.Id.UserId == userIdToCheck && userAccess.Id.VehicleId == vehicleId)
+                //check if the direct parents have access to the vehicle
+                var userAccess = _userAccess.GetUserAccessByVehicleAndUserId(userHousehold.Id.ParentUserId, vehicleId);
+                if (userAccess != null && userAccess.Id.UserId == userHousehold.Id.ParentUserId && userAccess.Id.VehicleId == vehicleId)
                 {
-                    return true;
+                    //every member in a household has permission to view vehicles
+                    if (permission == HouseholdPermission.View || userHousehold.Permissions.Contains(permission))
+                    {
+                        return true;
+                    }
                 }
             }
             return false;
@@ -197,7 +200,7 @@ namespace CarCareTracker.Logic
                 var userCollaborator = new UserHouseholdViewModel
                 {
                     UserName = _userData.GetUserRecordById(userHouseholdAccess.Id.ChildUserId).UserName,
-                    UserHousehold = userHouseholdAccess.Id
+                    UserHousehold = userHouseholdAccess
                 };
                 convertedResult.Add(userCollaborator);
             }
@@ -241,6 +244,17 @@ namespace CarCareTracker.Logic
             }
             return OperationResponse.Failed($"Unable to find user {childUsername} in the system");
         }
+        public bool UpdateUserHousehold(int parentUserId, int childUserId, List<HouseholdPermission> permissions)
+        {
+            var existingHousehold = _userHouseholdData.GetUserHouseholdByParentAndChildUserId(parentUserId, childUserId);
+            if (existingHousehold != null && existingHousehold.Id.ChildUserId == childUserId && existingHousehold.Id.ParentUserId == parentUserId)
+            {
+                existingHousehold.Permissions = permissions;
+                var result = _userHouseholdData.SaveUserHousehold(existingHousehold);
+                return result;
+            }
+            return false;
+        }
         public bool DeleteUserFromHousehold(int parentUserId, int childUserId)
         {
             var result = _userHouseholdData.DeleteUserHousehold(parentUserId, childUserId);

Models/User/UserHousehold.cs

@@ -8,5 +8,6 @@
     public class UserHousehold
     {
         public HouseholdAccess Id { get; set; }
+        public List<HouseholdPermission> Permissions { get; set; } = new List<HouseholdPermission>();
     }
 }

Models/User/UserHouseholdViewModel.cs

@@ -3,6 +3,6 @@
     public class UserHouseholdViewModel
     {
         public string UserName { get; set; }
-        public HouseholdAccess UserHousehold { get; set; }
+        public UserHousehold UserHousehold { get; set; }
     }
 }

Views/Admin/Index.cshtml

@@ -209,6 +209,20 @@
         }
         });
     }
+    function adminUpdateUserHousehold(parentUserId, childUserId, e){
+        let selectedChecks = $(e).closest('tr').find(':checked');
+        let permissions = selectedChecks.map((y, x) => {
+            return x.value;
+        });
+        $.post('/Admin/ModifyUserHouseholdPermissions', {parentUserId: parentUserId, childUserId: childUserId, permissions: permissions.toArray()}, function(data){
+            if (data) {
+            successToast('Household Updated');
+            loadUserHousehold(parentUserId);
+        } else {
+            errorToast(genericErrorMessage())
+        }
+        })
+    }
     function adminAddUserToHousehold(parentUserId){
          Swal.fire({
         title: 'Add User',

Views/Admin/_AdminUserHouseholdModal.cshtml

@@ -21,17 +21,21 @@
     <table class="table table-hover">
         <thead class="sticky-top">
             <tr class="d-flex">
-                <th scope="col" class="col-10">@translator.Translate(userLanguage, "Username")</th>
+                <th scope="col" class="col-6">@translator.Translate(userLanguage, "Username")</th>
+                <th scope="col" class="col-2">@translator.Translate(userLanguage, "Edit")</th>
                 <th scope="col" class="col-2">@translator.Translate(userLanguage, "Delete")</th>
+                <th scope="col" class="col-2">@translator.Translate(userLanguage, "Remove")</th>
             </tr>
         </thead>
         <tbody id="tokenTable">
             @foreach(UserHouseholdViewModel viewModel in Model.Households)
             {
                 <tr class="d-flex">
-                    <td class="col-10">@viewModel.UserName</td>
+                    <td class="col-6">@viewModel.UserName</td>
+                    <td class="col-2 d-flex align-items-center"><input class="form-check-input" type="checkbox" value="Edit" onchange="adminUpdateUserHousehold(@viewModel.UserHousehold.Id.ParentUserId, @viewModel.UserHousehold.Id.ChildUserId, this)" @(viewModel.UserHousehold.Permissions.Contains(HouseholdPermission.Edit) ? "checked" : "") /></td>
+                    <td class="col-2 d-flex align-items-center"><input class="form-check-input" type="checkbox" value="Delete" onchange="adminUpdateUserHousehold(@viewModel.UserHousehold.Id.ParentUserId, @viewModel.UserHousehold.Id.ChildUserId, this)" @(viewModel.UserHousehold.Permissions.Contains(HouseholdPermission.Delete) ? "checked" : "") /></td>
                     <td class="col-2">
-                        <button type="button" class="btn btn-danger" onclick="adminRemoveUserFromHousehold(@viewModel.UserHousehold.ParentUserId, @viewModel.UserHousehold.ChildUserId)"><i class="bi bi-trash"></i></button>
+                        <button type="button" class="btn btn-danger" onclick="adminRemoveUserFromHousehold(@viewModel.UserHousehold.Id.ParentUserId, @viewModel.UserHousehold.Id.ChildUserId)"><i class="bi bi-trash"></i></button>
                     </td>
                 </tr>
             }

Views/Home/_UserHouseholdModal.cshtml

@@ -21,17 +21,21 @@
     <table class="table table-hover">
         <thead class="sticky-top">
             <tr class="d-flex">
-                <th scope="col" class="col-10">@translator.Translate(userLanguage, "Username")</th>
+                <th scope="col" class="col-6">@translator.Translate(userLanguage, "Username")</th>
+                <th scope="col" class="col-2">@translator.Translate(userLanguage, "Edit")</th>
                 <th scope="col" class="col-2">@translator.Translate(userLanguage, "Delete")</th>
+                <th scope="col" class="col-2">@translator.Translate(userLanguage, "Remove")</th>
             </tr>
         </thead>
         <tbody id="tokenTable">
             @foreach(UserHouseholdViewModel viewModel in Model)
             {
                 <tr class="d-flex">
-                    <td class="col-10">@viewModel.UserName</td>
+                    <td class="col-6">@viewModel.UserName</td>
+                    <td class="col-2 d-flex align-items-center"><input class="form-check-input" type="checkbox" value="Edit" onchange="modifyUserHousehold(@viewModel.UserHousehold.Id.ChildUserId, this)" @(viewModel.UserHousehold.Permissions.Contains(HouseholdPermission.Edit) ? "checked" : "") /></td>
+                    <td class="col-2 d-flex align-items-center"><input class="form-check-input" type="checkbox" value="Delete" onchange="modifyUserHousehold(@viewModel.UserHousehold.Id.ChildUserId, this)" @(viewModel.UserHousehold.Permissions.Contains(HouseholdPermission.Delete) ? "checked" : "") /></td>
                     <td class="col-2">
-                        <button type="button" class="btn btn-danger" onclick="removeUserFromHousehold(@viewModel.UserHousehold.ChildUserId, this)"><i class="bi bi-trash"></i></button>
+                        <button type="button" class="btn btn-danger" onclick="removeUserFromHousehold(@viewModel.UserHousehold.Id.ChildUserId, this)"><i class="bi bi-trash"></i></button>
                     </td>
                 </tr>
             }

Views/Vehicle/_BulkDataImporter.cshtml

@@ -45,7 +45,10 @@
         sloader.show();
         $.post('/Vehicle/ImportToVehicleIdFromCsv', { vehicleId: vehicleId, mode: mode, fileName: uploadedFile }, function (data) {
             sloader.hide();
-            if (data) {
+            if (isOperationResponse(data)) {
+                return;
+            }
+            else if (data) {
                 successToast("Data Imported Successfully");
                 hideBulkImportModal();
                 if (mode == "GasRecord") {

appsettings.json

@@ -32,7 +32,7 @@
   "UseUnitForFuelCost": false,
   "PreferredGasUnit": "",
   "UserLanguage": "en_US",
-  "VisibleTabs": [ 0, 1, 4, 2, 3, 6, 5, 8 ],
+  "VisibleTabs": [ 8 ],
   "TabOrder": [ 8, 9, 10, 0, 1, 4, 2, 7, 3, 6, 12, 5 ],
   "DefaultTab": 8,
   "UserNameHash": "",

wwwroot/js/collisionrecord.js

@@ -52,13 +52,14 @@ function deleteCollisionRecord(collisionRecordId) {
     }).then((result) => {
         if (result.isConfirmed) {
             $.post(`/Vehicle/DeleteCollisionRecordById?collisionRecordId=${collisionRecordId}`, function (data) {
-                if (data) {
+                if (data.success) {
                     hideAddCollisionRecordModal();
                     successToast("Repair Record Deleted");
                     var vehicleId = GetVehicleId().vehicleId;
                     getVehicleCollisionRecords(vehicleId);
                 } else {
-                    errorToast(genericErrorMessage());
+                    errorToast(data.message);
+                    $("#workAroundInput").hide();
                 }
             });
         } else {
@@ -76,7 +77,7 @@ function saveCollisionRecordToVehicle(isEdit) {
     }
     //save to db.
     $.post('/Vehicle/SaveCollisionRecordToVehicleId', { collisionRecord: formValues }, function (data) {
-        if (data) {
+        if (data.success) {
             successToast(isEdit ? "Repair Record Updated" : "Repair Record Added.");
             hideAddCollisionRecordModal();
             saveScrollPosition();
@@ -85,7 +86,7 @@ function saveCollisionRecordToVehicle(isEdit) {
                 setTimeout(function () { showAddReminderModal(formValues); }, 500);
             }
         } else {
-            errorToast(genericErrorMessage());
+            errorToast(data.message);
         }
     })
 }

wwwroot/js/garage.js

@@ -116,12 +116,12 @@ function generateReminderItem(id, urgency, description) {
 function markDoneCalendarReminderRecord(reminderRecordId, e) {
     event.stopPropagation();
     $.post(`/Vehicle/PushbackRecurringReminderRecord?reminderRecordId=${reminderRecordId}`, function (data) {
-        if (data) {
+        if (data.success) {
             hideCalendarReminderModal();
             successToast("Reminder Updated");
             getVehicleCalendarEvents();
         } else {
-            errorToast(genericErrorMessage());
+            errorToast(data.message);
         }
     });
 }
@@ -139,12 +139,13 @@ function deleteCalendarReminderRecord(reminderRecordId, e) {
     }).then((result) => {
         if (result.isConfirmed) {
             $.post(`/Vehicle/DeleteReminderRecordById?reminderRecordId=${reminderRecordId}`, function (data) {
-                if (data) {
+                if (data.success) {
                     hideCalendarReminderModal();
                     successToast("Reminder Deleted");
                     getVehicleCalendarEvents();
                 } else {
-                    errorToast(genericErrorMessage());
+                    errorToast(data.message);
+                    $("#workAroundInput").hide();
                 }
             });
         } else {
@@ -600,6 +601,20 @@ function removeUserFromHousehold(userId) {
         }
     })
 }
+function modifyUserHousehold(userId, e) {
+    let selectedChecks = $(e).closest('tr').find(':checked');
+    let permissions = selectedChecks.map((y, x) => {
+        return x.value;
+    });
+    $.post('/Home/ModifyUserHouseholdPermissions', { userId: userId, permissions: permissions.toArray() }, function (data) {
+        if (data) {
+            successToast('Household Updated');
+            showHouseholdModal();
+        } else {
+            errorToast(genericErrorMessage())
+        }
+    })
+}
 function addUserToHousehold() {
     Swal.fire({
         title: 'Add User',

wwwroot/js/gasrecord.js

@@ -52,13 +52,14 @@ function deleteGasRecord(gasRecordId) {
     }).then((result) => {
         if (result.isConfirmed) {
             $.post(`/Vehicle/DeleteGasRecordById?gasRecordId=${gasRecordId}`, function (data) {
-                if (data) {
+                if (data.success) {
                     hideAddGasRecordModal();
                     successToast("Gas Record deleted");
                     var vehicleId = GetVehicleId().vehicleId;
                     getVehicleGasRecords(vehicleId);
                 } else {
-                    errorToast(genericErrorMessage());
+                    errorToast(data.message);
+                    $("#workAroundInput").hide();
                 }
             });
         } else {
@@ -76,13 +77,13 @@ function saveGasRecordToVehicle(isEdit) {
     }
     //save to db.
     $.post('/Vehicle/SaveGasRecordToVehicleId', { gasRecord: formValues }, function (data) {
-        if (data) {
+        if (data.success) {
             successToast(isEdit ? "Gas Record Updated" : "Gas Record Added.");
             hideAddGasRecordModal();
             saveScrollPosition();
             getVehicleGasRecords(formValues.vehicleId);
         } else {
-            errorToast(genericErrorMessage());
+            errorToast(data.message);
         }
     })
 }
@@ -486,13 +487,13 @@ function saveMultipleGasRecordsToVehicle() {
         }
     }
     $.post('/Vehicle/SaveMultipleGasRecords', { editModel: formValues }, function (data) {
-        if (data) {
+        if (data.success) {
             successToast("Gas Records Updated");
             hideAddGasRecordModal();
             saveScrollPosition();
             getVehicleGasRecords(GetVehicleId().vehicleId);
         } else {
-            errorToast(genericErrorMessage());
+            errorToast(data.message);
         }
     })
 }

wwwroot/js/inspectionrecord.js

@@ -201,11 +201,12 @@ function deleteInspectionRecordTemplate(inspectionRecordTemplateId) {
         if (result.isConfirmed) {
             $.post(`/Vehicle/DeleteInspectionRecordTemplateById?inspectionRecordTemplateId=${inspectionRecordTemplateId}`, function (data) {
                 $("#workAroundInput").hide();
-                if (data) {
+                if (data.success) {
                     successToast("Inspection Template Deleted");
                     hideInspectionRecordTemplateModal();
                 } else {
-                    errorToast(genericErrorMessage());
+                    errorToast(data.message);
+                    $("#workAroundInput").hide();
                 }
             });
         } else {
@@ -215,7 +216,10 @@ function deleteInspectionRecordTemplate(inspectionRecordTemplateId) {
 }
 function useInspectionRecordTemplate(inspectionRecordTemplateId) {
     $.get(`/Vehicle/GetAddInspectionRecordPartialView?inspectionRecordTemplateId=${inspectionRecordTemplateId}`, function (data) {
-        if (data) {
+        if (isOperationResponse(data)) {
+            return;
+        }
+        else if (data) {
             $("#inspectionRecordModalContent").html(data);
             hideInspectionRecordTemplateSelectorModal();
             //initiate datepicker
@@ -359,7 +363,7 @@ function saveinspectionRecordToVehicle() {
         return;
     }
     $.post('/Vehicle/SaveInspectionRecordToVehicleId', { inspectionRecord: formValues }, function (data) {
-        if (data) {
+        if (data.success) {
             successToast("Inspection Record Added.");
             hideAddInspectionRecordModal();
             saveScrollPosition();
@@ -368,7 +372,7 @@ function saveinspectionRecordToVehicle() {
                 setTimeout(function () { showAddReminderModal(formValues); }, 500);
             }
         } else {
-            errorToast(genericErrorMessage());
+            errorToast(data.message);
         }
     })
 }
@@ -381,19 +385,22 @@ function updateInspectionRecord(recordId) {
     }
     let vehicleId = GetVehicleId().vehicleId;
     $.post('/Vehicle/UpdateInspectionRecord', { inspectionRecord: inspectionRecord }, function (data) {
-        if (data) {
+        if (data.success) {
             successToast("Inspection Record Updated.");
             hideAddInspectionRecordModal();
             saveScrollPosition();
             getVehicleInspectionRecords(vehicleId);
         } else {
-            errorToast(genericErrorMessage());
+            errorToast(data.message);
         }
     })
 }
 function showEditInspectionRecordModal(inspectionRecordId) {
     $.get(`/Vehicle/GetViewInspectionRecordPartialView?inspectionRecordId=${inspectionRecordId}`, function (data) {
-        if (data) {
+        if (isOperationResponse(data)) {
+            return;
+        }
+        else if (data) {
             $("#inspectionRecordModalContent").html(data);
             //initiate tag selector
             initTagSelector($("#inspectionRecordTag"));
@@ -415,13 +422,14 @@ function deleteInspectionRecord(inspectionRecordId) {
     }).then((result) => {
         if (result.isConfirmed) {
             $.post(`/Vehicle/DeleteInspectionRecordById?inspectionRecordId=${inspectionRecordId}`, function (data) {
-                if (data) {
+                if (data.success) {
                     hideAddInspectionRecordModal();
                     successToast("Inspection Record Deleted");
                     var vehicleId = GetVehicleId().vehicleId;
                     getVehicleInspectionRecords(vehicleId);
                 } else {
-                    errorToast(genericErrorMessage());
+                    errorToast(data.message);
+                    $("#workAroundInput").hide();
                 }
             });
         } else {

wwwroot/js/note.js

@@ -48,13 +48,14 @@ function deleteNote(noteId) {
     }).then((result) => {
         if (result.isConfirmed) {
             $.post(`/Vehicle/DeleteNoteById?noteId=${noteId}`, function (data) {
-                if (data) {
+                if (data.success) {
                     hideAddNoteModal();
                     successToast("Note Deleted");
                     var vehicleId = GetVehicleId().vehicleId;
                     getVehicleNotes(vehicleId);
                 } else {
-                    errorToast(genericErrorMessage());
+                    errorToast(data.message);
+                    $("#workAroundInput").hide();
                 }
             });
         } else {
@@ -72,13 +73,13 @@ function saveNoteToVehicle(isEdit) {
     }
     //save to db.
     $.post('/Vehicle/SaveNoteToVehicleId', { note: formValues }, function (data) {
-        if (data) {
+        if (data.success) {
             successToast(isEdit ? "Note Updated" : "Note Added.");
             hideAddNoteModal();
             saveScrollPosition();
             getVehicleNotes(formValues.vehicleId);
         } else {
-            errorToast(genericErrorMessage());
+            errorToast(data.message);
         }
     })
 }
@@ -121,9 +122,11 @@ function getAndValidateNoteValues() {
 }
 function pinNotes(ids, toggle, pinStatus) {
     $.post('/Vehicle/PinNotes', { noteIds: ids, isToggle: toggle, pinStatus: pinStatus  }, function (data) {
-        if (data) {
+        if (data.success) {
             successToast(ids.length > 1 ? `${ids.length} Notes Updated` : "Note Updated.");
             getVehicleNotes(GetVehicleId().vehicleId);
+        } else {
+            errorToast(data.message);
         }
     })
 }

wwwroot/js/odometerrecord.js

@@ -52,13 +52,14 @@ function deleteOdometerRecord(odometerRecordId) {
     }).then((result) => {
         if (result.isConfirmed) {
             $.post(`/Vehicle/DeleteOdometerRecordById?odometerRecordId=${odometerRecordId}`, function (data) {
-                if (data) {
+                if (data.success) {
                     hideAddOdometerRecordModal();
                     successToast("Odometer Record Deleted");
                     var vehicleId = GetVehicleId().vehicleId;
                     getVehicleOdometerRecords(vehicleId);
                 } else {
-                    errorToast(genericErrorMessage());
+                    errorToast(data.message);
+                    $("#workAroundInput").hide();
                 }
             });
         } else {
@@ -76,7 +77,7 @@ function saveOdometerRecordToVehicle(isEdit) {
     }
     //save to db.
     $.post('/Vehicle/SaveOdometerRecordToVehicleId', { odometerRecord: formValues }, function (data) {
-        if (data) {
+        if (data.success) {
             successToast(isEdit ? "Odometer Record Updated" : "Odometer Record Added.");
             hideAddOdometerRecordModal();
             saveScrollPosition();
@@ -85,7 +86,7 @@ function saveOdometerRecordToVehicle(isEdit) {
                 setTimeout(function () { showAddReminderModal(formValues); }, 500);
             }
         } else {
-            errorToast(genericErrorMessage());
+            errorToast(data.message);
         }
     })
 }
@@ -142,11 +143,11 @@ function recalculateDistance() {
     //reserved for when data is incoherent with negative distances due to non-chronological order of odometer records.
     var vehicleId = GetVehicleId().vehicleId
     $.post(`/Vehicle/ForceRecalculateDistanceByVehicleId?vehicleId=${vehicleId}`, function (data) {
-        if (data) {
+        if (data.success) {
             successToast("Odometer Records Updated")
             getVehicleOdometerRecords(vehicleId);
         } else {
-            errorToast(genericErrorMessage());
+            errorToast(data.message);
         }
     });
 }
@@ -204,13 +205,13 @@ function saveMultipleOdometerRecordsToVehicle() {
         }
     }
     $.post('/Vehicle/SaveMultipleOdometerRecords', { editModel: formValues }, function (data) {
-        if (data) {
+        if (data.success) {
             successToast("Odometer Records Updated");
             hideAddOdometerRecordModal();
             saveScrollPosition();
             getVehicleOdometerRecords(GetVehicleId().vehicleId);
         } else {
-            errorToast(genericErrorMessage());
+            errorToast(data.message);
         }
     })
 }

wwwroot/js/planrecord.js

@@ -88,7 +88,7 @@ function deletePlanRecord(planRecordId, noModal) {
     }).then((result) => {
         if (result.isConfirmed) {
             $.post(`/Vehicle/DeletePlanRecordById?planRecordId=${planRecordId}`, function (data) {
-                if (data) {
+                if (data.success) {
                     if (!noModal) {
                         hideAddPlanRecordModal();
                     }
@@ -96,7 +96,8 @@ function deletePlanRecord(planRecordId, noModal) {
                     var vehicleId = GetVehicleId().vehicleId;
                     getVehiclePlanRecords(vehicleId);
                 } else {
-                    errorToast(genericErrorMessage());
+                    errorToast(data.message);
+                    $("#workAroundInput").hide();
                 }
             });
         } else {
@@ -114,7 +115,7 @@ function savePlanRecordToVehicle(isEdit) {
     }
     //save to db.
     $.post('/Vehicle/SavePlanRecordToVehicleId', { planRecord: formValues }, function (data) {
-        if (data) {
+        if (data.success) {
             successToast(isEdit ? "Plan Record Updated" : "Plan Record Added.");
             hideAddPlanRecordModal();
             if (!getPlanRecordModelData().createdFromReminder) {
@@ -125,7 +126,7 @@ function savePlanRecordToVehicle(isEdit) {
                 }
             }
         } else {
-            errorToast(genericErrorMessage());
+            errorToast(data.message);
         }
     })
 }
@@ -170,11 +171,12 @@ function deletePlannerRecordTemplate(planRecordTemplateId) {
         if (result.isConfirmed) {
             $.post(`/Vehicle/DeletePlanRecordTemplateById?planRecordTemplateId=${planRecordTemplateId}`, function (data) {
                 $("#workAroundInput").hide();
-                if (data) {
+                if (data.success) {
                     successToast("Plan Template Deleted");
                     hideAddPlanRecordModal();
                 } else {
-                    errorToast(genericErrorMessage());
+                    errorToast(data.message);
+                    $("#workAroundInput").hide();
                 }
             });
         } else {
@@ -309,12 +311,12 @@ function updatePlanRecordProgress(newProgress) {
                     //Odometer Adjustments
                     var adjustedOdometer = GetAdjustedOdometer(0, result.value.odometer);
                     $.post('/Vehicle/UpdatePlanRecordProgress', { planRecordId: draggedId, planProgress: newProgress, odometer: adjustedOdometer }, function (data) {
-                        if (data) {
+                        if (data.success) {
                             successToast("Plan Progress Updated");
                             var vehicleId = GetVehicleId().vehicleId;
                             getVehiclePlanRecords(vehicleId);
                         } else {
-                            errorToast(genericErrorMessage());
+                            errorToast(data.message);
                         }
                     });
                 }
@@ -322,12 +324,12 @@ function updatePlanRecordProgress(newProgress) {
             });
         } else {
             $.post('/Vehicle/UpdatePlanRecordProgress', { planRecordId: draggedId, planProgress: newProgress }, function (data) {
-                if (data) {
+                if (data.success) {
                     successToast("Plan Progress Updated");
                     var vehicleId = GetVehicleId().vehicleId;
                     getVehiclePlanRecords(vehicleId);
                 } else {
-                    errorToast(genericErrorMessage());
+                    errorToast(data.message);
                 }
             });
             draggedId = 0;

wwwroot/js/reminderrecord.js

@@ -94,13 +94,14 @@ function deleteReminderRecord(reminderRecordId, e) {
     }).then((result) => {
         if (result.isConfirmed) {
             $.post(`/Vehicle/DeleteReminderRecordById?reminderRecordId=${reminderRecordId}`, function (data) {
-                if (data) {
+                if (data.success) {
                     hideAddReminderRecordModal();
                     successToast("Reminder Deleted");
                     var vehicleId = GetVehicleId().vehicleId;
                     getVehicleReminders(vehicleId);
                 } else {
-                    errorToast(genericErrorMessage());
+                    errorToast(data.message);
+                    $("#workAroundInput").hide();
                 }
             });
         } else {
@@ -126,7 +127,7 @@ function saveReminderRecordToVehicle(isEdit) {
     }
     //save to db.
     $.post('/Vehicle/SaveReminderRecordToVehicleId', { reminderRecord: formValues }, function (data) {
-        if (data) {
+        if (data.success) {
             successToast(isEdit ? "Reminder Updated" : "Reminder Added.");
             hideAddReminderRecordModal();
             if (!getReminderRecordModelData().createdFromRecord) {
@@ -136,7 +137,7 @@ function saveReminderRecordToVehicle(isEdit) {
                 getVehicleHaveImportantReminders(formValues.vehicleId);
             }
         } else {
-            errorToast(genericErrorMessage());
+            errorToast(data.message);
         }
     })
 }
@@ -181,11 +182,11 @@ function markDoneReminderRecord(reminderRecordId, e) {
     event.stopPropagation();
     var vehicleId = GetVehicleId().vehicleId;
     $.post(`/Vehicle/PushbackRecurringReminderRecord?reminderRecordId=${reminderRecordId}`, function (data) {
-        if (data) {
+        if (data.success) {
             successToast("Reminder Updated");
             getVehicleReminders(vehicleId);
         } else {
-            errorToast(genericErrorMessage());
+            errorToast(data.message);
         }
     });
 }

wwwroot/js/servicerecord.js

@@ -52,13 +52,14 @@ function deleteServiceRecord(serviceRecordId) {
     }).then((result) => {
         if (result.isConfirmed) {
             $.post(`/Vehicle/DeleteServiceRecordById?serviceRecordId=${serviceRecordId}`, function (data) {
-                if (data) {
+                if (data.success) {
                     hideAddServiceRecordModal();
                     successToast("Service Record Deleted");
                     var vehicleId = GetVehicleId().vehicleId;
                     getVehicleServiceRecords(vehicleId);
                 } else {
-                    errorToast(genericErrorMessage());
+                    errorToast(data.message);
+                    $("#workAroundInput").hide();
                 }
             });
         } else {
@@ -76,7 +77,7 @@ function saveServiceRecordToVehicle(isEdit) {
     }
     //save to db.
     $.post('/Vehicle/SaveServiceRecordToVehicleId', { serviceRecord: formValues }, function (data) {
-        if (data) {
+        if (data.success) {
             successToast(isEdit ? "Service Record Updated" : "Service Record Added.");
             hideAddServiceRecordModal();
             saveScrollPosition();
@@ -85,7 +86,7 @@ function saveServiceRecordToVehicle(isEdit) {
                 setTimeout(function () { showAddReminderModal(formValues); }, 500);
             }
         } else {
-            errorToast(genericErrorMessage());
+            errorToast(data.message);
         }
     })
 }

wwwroot/js/shared.js

@@ -178,7 +178,7 @@ function saveVehicle(isEdit) {
         dashboardMetrics: vehicleDashboardMetrics,
         vehicleIdentifier: vehicleIdentifier
     }, function (data) {
-        if (data) {
+        if (data.success) {
             if (!isEdit) {
                 successToast("Vehicle Added");
                 hideAddVehicleModal();
@@ -190,7 +190,7 @@ function saveVehicle(isEdit) {
                 viewVehicle(vehicleId);
             }
         } else {
-            errorToast(genericErrorMessage());
+            errorToast(data.message);
         }
     });
 }
@@ -756,7 +756,10 @@ function printTabStickers(ids, source) {
         recordIds: ids,
         importMode: source
     }, function (data) {
-        if (data) {
+        if (isOperationResponse(data)) {
+            return;
+        }
+        else if (data) {
             printContainer(data);
         }
     })
@@ -764,9 +767,10 @@ function printTabStickers(ids, source) {
 function exportVehicleData(mode) {
     var vehicleId = GetVehicleId().vehicleId;
     $.get('/Vehicle/ExportFromVehicleToCsv', { vehicleId: vehicleId, mode: mode }, function (data) {
-        if (!data) {
-            errorToast(genericErrorMessage());
-        } else {
+        if (isOperationResponse(data)) {
+            return;
+        }
+        else if (data) {
             window.location.href = data;
         }
     });
@@ -857,12 +861,13 @@ function moveRecords(ids, source, dest) {
     }).then((result) => {
         if (result.isConfirmed) {
             $.post('/Vehicle/MoveRecords', { recordIds: ids, source: source, destination: dest }, function (data) {
-                if (data) {
+                if (data.success) {
                     successToast(`${ids.length} Record(s) Moved`);
                     var vehicleId = GetVehicleId().vehicleId;
                     refreshDataCallBack(vehicleId);
                 } else {
-                    errorToast(genericErrorMessage());
+                    errorToast(data.message);
+                    $("#workAroundInput").hide();
                 }
             });
         } else {
@@ -929,12 +934,13 @@ function deleteRecords(ids, source) {
     }).then((result) => {
         if (result.isConfirmed) {
             $.post('/Vehicle/DeleteRecords', { recordIds: ids, importMode: source }, function (data) {
-                if (data) {
+                if (data.success) {
                     successToast(`${ids.length} Record(s) Deleted`);
                     var vehicleId = GetVehicleId().vehicleId;
                     refreshDataCallBack(vehicleId);
                 } else {
-                    errorToast(genericErrorMessage());
+                    errorToast(data.message);
+                    $("#workAroundInput").hide();
                 }
             });
         } else {
@@ -1005,12 +1011,13 @@ function duplicateRecords(ids, source) {
     }).then((result) => {
         if (result.isConfirmed) {
             $.post('/Vehicle/DuplicateRecords', { recordIds: ids, importMode: source }, function (data) {
-                if (data) {
+                if (data.success) {
                     successToast(`${ids.length} Record(s) Duplicated`);
                     var vehicleId = GetVehicleId().vehicleId;
                     refreshDataCallBack(vehicleId);
                 } else {
-                    errorToast(genericErrorMessage());
+                    errorToast(data.message);
+                    $("#workAroundInput").hide();
                 }
             });
         } else {
@@ -1091,10 +1098,10 @@ function duplicateRecordsToOtherVehicles(ids, source) {
             }).then(function (result) {
                 if (result.isConfirmed) {
                     $.post('/Vehicle/DuplicateRecordsToOtherVehicles', { recordIds: ids, vehicleIds: result.value.selectedVehicleData.ids, importMode: source}, function (data) {
-                        if (data) {
+                        if (data.success) {
                             successToast(`${ids.length} Record(s) Duplicated`);
                         } else {
-                            errorToast(genericErrorMessage());
+                            errorToast(data.message);
                         }
                     });
                 }
@@ -1140,12 +1147,13 @@ function insertOdometer(ids, source) {
     }).then((result) => {
         if (result.isConfirmed) {
             $.post('/Vehicle/BulkCreateOdometerRecords', { recordIds: ids, importMode: source }, function (data) {
-                if (data) {
+                if (data.success) {
                     successToast(`${ids.length} Odometer Record(s) Created`);
                     var vehicleId = GetVehicleId().vehicleId;
                     refreshDataCallBack(vehicleId);
                 } else {
-                    errorToast(genericErrorMessage());
+                    errorToast(data.message);
+                    $("#workAroundInput").hide();
                 }
             });
         } else {

wwwroot/js/supplyrecord.js

@@ -52,13 +52,14 @@ function deleteSupplyRecord(supplyRecordId) {
     }).then((result) => {
         if (result.isConfirmed) {
             $.post(`/Vehicle/DeleteSupplyRecordById?supplyRecordId=${supplyRecordId}`, function (data) {
-                if (data) {
+                if (data.success) {
                     hideAddSupplyRecordModal();
                     successToast("Supply Record Deleted");
                     var vehicleId = GetVehicleId().vehicleId;
                     getVehicleSupplyRecords(vehicleId);
                 } else {
-                    errorToast(genericErrorMessage());
+                    errorToast(data.message);
+                    $("#workAroundInput").hide();
                 }
             });
         } else {
@@ -76,7 +77,7 @@ function saveSupplyRecordToVehicle(isEdit) {
     }
     //save to db.
     $.post('/Vehicle/SaveSupplyRecordToVehicleId', { supplyRecord: formValues }, function (data) {
-        if (data) {
+        if (data.success) {
             successToast(isEdit ? "Supply Record Updated" : "Supply Record Added.");
             hideAddSupplyRecordModal();
             saveScrollPosition();
@@ -85,7 +86,7 @@ function saveSupplyRecordToVehicle(isEdit) {
                 setTimeout(function () { showAddReminderModal(formValues); }, 500);
             }
         } else {
-            errorToast(genericErrorMessage());
+            errorToast(data.message);
         }
     })
 }

wwwroot/js/taxrecord.js

@@ -60,13 +60,14 @@ function deleteTaxRecord(taxRecordId) {
     }).then((result) => {
         if (result.isConfirmed) {
             $.post(`/Vehicle/DeleteTaxRecordById?taxRecordId=${taxRecordId}`, function (data) {
-                if (data) {
+                if (data.success) {
                     hideAddTaxRecordModal();
                     successToast("Tax Record Deleted");
                     var vehicleId = GetVehicleId().vehicleId;
                     getVehicleTaxRecords(vehicleId);
                 } else {
-                    errorToast(genericErrorMessage());
+                    errorToast(data.message);
+                    $("#workAroundInput").hide();
                 }
             });
         } else {
@@ -84,7 +85,7 @@ function saveTaxRecordToVehicle(isEdit) {
     }
     //save to db.
     $.post('/Vehicle/SaveTaxRecordToVehicleId', { taxRecord: formValues }, function (data) {
-        if (data) {
+        if (data.success) {
             successToast(isEdit ? "Tax Record Updated" : "Tax Record Added.");
             hideAddTaxRecordModal();
             saveScrollPosition();
@@ -93,7 +94,7 @@ function saveTaxRecordToVehicle(isEdit) {
                 setTimeout(function () { showAddReminderModal(formValues); }, 500);
             }
         } else {
-            errorToast(genericErrorMessage());
+            errorToast(data.message);
         }
     })
 }

wwwroot/js/upgraderecord.js

@@ -52,13 +52,14 @@ function deleteUpgradeRecord(upgradeRecordId) {
     }).then((result) => {
         if (result.isConfirmed) {
             $.post(`/Vehicle/DeleteUpgradeRecordById?upgradeRecordId=${upgradeRecordId}`, function (data) {
-                if (data) {
+                if (data.success) {
                     hideAddUpgradeRecordModal();
                     successToast("Upgrade Record Deleted");
                     var vehicleId = GetVehicleId().vehicleId;
                     getVehicleUpgradeRecords(vehicleId);
                 } else {
-                    errorToast(genericErrorMessage());
+                    errorToast(data.message);
+                    $("#workAroundInput").hide();
                 }
             });
         } else {
@@ -76,7 +77,7 @@ function saveUpgradeRecordToVehicle(isEdit) {
     }
     //save to db.
     $.post('/Vehicle/SaveUpgradeRecordToVehicleId', { upgradeRecord: formValues }, function (data) {
-        if (data) {
+        if (data.success) {
             successToast(isEdit ? "Upgrade Record Updated" : "Upgrade Record Added.");
             hideAddUpgradeRecordModal();
             saveScrollPosition();
@@ -85,7 +86,7 @@ function saveUpgradeRecordToVehicle(isEdit) {
                 setTimeout(function () { showAddReminderModal(formValues); }, 500);
             }
         } else {
-            errorToast(genericErrorMessage());
+            errorToast(data.message);
         }
     })
 }

wwwroot/js/vehicle.js

@@ -306,13 +306,14 @@ function moveRecord(recordId, source, dest) {
     }).then((result) => {
         if (result.isConfirmed) {
             $.post('/Vehicle/MoveRecord', { recordId: recordId, source: source, destination: dest }, function (data) {
-                if (data) {
+                if (data.success) {
                     hideModalCallBack();
                     successToast("Record Moved");
                     var vehicleId = GetVehicleId().vehicleId;
                     refreshDataCallBack(vehicleId);
                 } else {
-                    errorToast(genericErrorMessage());
+                    errorToast(data.message);
+                    $("#workAroundInput").hide();
                 }
             });
         } else {
@@ -414,12 +415,12 @@ function saveGenericRecord() {
     }
     //save to db.
     $.post('/Vehicle/EditMultipleRecords', { genericRecordEditModel: formValues }, function (data) {
-        if (data) {
+        if (data.success) {
             successToast(formValues.recordIds.length > 1 ? "Records Updated" : "Record Updated.");
             hideGenericRecordModal();
             refreshDataCallBack(GetVehicleId().vehicleId);
         } else {
-            errorToast(genericErrorMessage());
+            errorToast(data.message);
         }
     })
 }
@@ -563,12 +564,13 @@ function adjustRecordsOdometer(ids, source) {
         if (result.isConfirmed) {
             saveScrollPosition();
             $.post('/Vehicle/AdjustRecordsOdometer', { recordIds: ids, vehicleId: GetVehicleId().vehicleId, importMode: source }, function (data) {
-                if (data) {
+                if (data.success) {
                     successToast(`${ids.length} Record(s) Updated`);
                     var vehicleId = GetVehicleId().vehicleId;
                     refreshDataCallBack(vehicleId);
                 } else {
-                    errorToast(genericErrorMessage());
+                    errorToast(data.message);
+                    $("#workAroundInput").hide();
                 }
             });
         } else {