From 77091b0107d4a318dbd5f357610b58de829d923f Mon Sep 17 00:00:00 2001
From: Daniel Dietzler <36593685+danieldietzler@users.noreply.github.com>
Date: Tue, 21 Jul 2026 02:08:42 +0200
Subject: [PATCH] fix: search statistics locked folder permissions (#30063)

fix; search statistics locked folder permissions
---
 server/src/services/search.service.ts            |  2 +-
 .../medium/specs/services/search.service.spec.ts | 16 ++++++++++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/server/src/services/search.service.ts b/server/src/services/search.service.ts
index bef85fee58..c99b340dae 100644
--- a/server/src/services/search.service.ts
+++ b/server/src/services/search.service.ts
@@ -100,7 +100,7 @@ export class SearchService extends BaseService {
   }
 
   async searchStatistics(auth: AuthDto, dto: StatisticsSearchDto): Promise<SearchStatisticsResponseDto> {
-    const userIds = await this.getUserIdsToSearch(auth);
+    const userIds = await this.getUserIdsToSearch(auth, dto.visibility);
     if (dto.visibility === AssetVisibility.Locked) {
       requireElevatedPermission(auth);
     }
diff --git a/server/test/medium/specs/services/search.service.spec.ts b/server/test/medium/specs/services/search.service.spec.ts
index a92042e40a..044cd8d4f5 100644
--- a/server/test/medium/specs/services/search.service.spec.ts
+++ b/server/test/medium/specs/services/search.service.spec.ts
@@ -89,6 +89,22 @@ describe(SearchService.name, () => {
 
       expect(result).toEqual({ total: 0 });
     });
+
+    it('should not return locked assets of partner in elevated session', async () => {
+      const { sut, ctx } = setup();
+      const { user } = await ctx.newUser();
+      const { user: partner } = await ctx.newUser();
+
+      await ctx.newPartner({ sharedById: partner.id, sharedWithId: user.id });
+
+      await ctx.newAsset({ ownerId: partner.id, visibility: AssetVisibility.Locked });
+
+      const auth = factory.auth({ user: { id: user.id }, session: { hasElevatedPermission: true } });
+
+      const result = await sut.searchStatistics(auth, { visibility: AssetVisibility.Locked });
+
+      expect(result).toEqual({ total: 0 });
+    });
   });
 
   describe('withStacked option', () => {