feature: flag permissions

2025-07-20 10:45:55 +10:00
parent 7deead494b
commit be7ee4cae8
72 changed files with 5590 additions and 2109 deletions
@@ -8,7 +8,7 @@ namespace Disco.Services.Users.UserFlags
 {
    internal class Cache
    {
-        private ConcurrentDictionary<int, UserFlag> _Cache;
+        private ConcurrentDictionary<int, (UserFlag flag, FlagPermission permission)> cache;

        public Cache(DiscoDataContext Database)
        {
@@ -26,36 +26,30 @@ namespace Disco.Services.Users.UserFlags
            var flags = Database.UserFlags.ToList();

            // Add Queues to In-Memory Cache
-            _Cache = new ConcurrentDictionary<int, UserFlag>(flags.Select(f => new KeyValuePair<int, UserFlag>(f.Id, f)));
+            cache = new ConcurrentDictionary<int, (UserFlag, FlagPermission)>(flags.Select(f => new KeyValuePair<int, (UserFlag, FlagPermission)>(f.Id, (f, f.Permissions))));
        }

-        public UserFlag GetUserFlag(int UserFlagId)
+        public (UserFlag flag, FlagPermission permission) GetUserFlag(int UserFlagId)
        {
-            if (_Cache.TryGetValue(UserFlagId, out var item))
+            if (cache.TryGetValue(UserFlagId, out var item))
                return item;
            else
-                return null;
+                return (null, null);
        }
-        public List<UserFlag> GetUserFlags()
+        public List<(UserFlag flag, FlagPermission permission)> GetUserFlags()
        {
-            return _Cache.Values.ToList();
+            return cache.Values.ToList();
        }

        public void AddOrUpdate(UserFlag UserFlag)
        {
-            _Cache.AddOrUpdate(UserFlag.Id, UserFlag, (key, existingItem) => UserFlag);
+            var value = (UserFlag, UserFlag.Permissions);
+            cache.AddOrUpdate(UserFlag.Id, value, (key, existingItem) => value);
        }

-        public UserFlag Remove(int UserFlagId)
+        public void Remove(int UserFlagId)
        {
-            if (_Cache.TryRemove(UserFlagId, out var item))
-                return item;
-            else
-                return null;
-        }
-        public UserFlag Remove(UserFlag UserFlag)
-        {
-            return Remove(UserFlag.Id);
+            cache.TryRemove(UserFlagId, out _);
        }
    }
 }
@@ -0,0 +1,144 @@
+using Disco.Models.Repository;
+using Disco.Services.Authorization;
+using Disco.Services.Devices.DeviceFlags;
+using Disco.Services.Users;
+using Disco.Services.Users.UserFlags;
+using System.Collections.Generic;
+using System.Linq;
+
+namespace Disco
+{
+    public static class FlagPermissionExtensions
+    {
+        public static bool CanShow(this FlagPermission permission)
+        {
+            var authorization = UserService.CurrentAuthorization;
+
+            // inherited permission
+            if (permission.Inherit &&
+                authorization.Has(permission.FlagType == FlagType.User ? Claims.User.ShowFlagAssignments : Claims.Device.ShowFlagAssignments))
+            {
+                return true;
+            }
+
+            // permission override
+            if (permission != null && (
+                permission.CanShowSubjectIds.Contains(authorization.User.UserId) ||
+                permission.CanShowSubjectIds.Overlaps(authorization.GroupMembership) ||
+                permission.CanShowSubjectIds.Overlaps(authorization.RoleTokens.Select(r => $"[{r.Role.Id}]"))
+                ))
+            {
+                return true;
+            }
+
+            return false;
+        }
+        public static bool CanAssign(this FlagPermission permission)
+        {
+            var authorization = UserService.CurrentAuthorization;
+
+            // inherited permission
+            if (permission.Inherit &&
+                authorization.Has(permission.FlagType == FlagType.User ? Claims.User.Actions.AddFlags : Claims.Device.Actions.AddFlags))
+            {
+                return true;
+            }
+
+            // permission override
+            if (permission != null && (
+                permission.CanAssignSubjectIds.Contains(authorization.User.UserId) ||
+                permission.CanAssignSubjectIds.Overlaps(authorization.GroupMembership) ||
+                permission.CanAssignSubjectIds.Overlaps(authorization.RoleTokens.Select(r => $"[{r.Role.Id}]"))
+                ))
+            {
+                return true;
+            }
+
+            return false;
+        }
+        public static bool CanEdit(this FlagPermission permission)
+        {
+            var authorization = UserService.CurrentAuthorization;
+
+            // inherited permission
+            if (permission.Inherit &&
+                authorization.Has(permission.FlagType == FlagType.User ? Claims.User.Actions.EditFlags : Claims.Device.Actions.EditFlags))
+            {
+                return true;
+            }
+
+            // permission override
+            if (permission != null && (
+                permission.CanEditSubjectIds.Contains(authorization.User.UserId) ||
+                permission.CanEditSubjectIds.Overlaps(authorization.GroupMembership) ||
+                permission.CanEditSubjectIds.Overlaps(authorization.RoleTokens.Select(r => $"[{r.Role.Id}]"))
+                ))
+            {
+                return true;
+            }
+
+            return false;
+        }
+        public static bool CanRemove(this FlagPermission permission)
+        {
+            var authorization = UserService.CurrentAuthorization;
+
+            // inherited permission
+            if (permission.Inherit &&
+                authorization.Has(permission.FlagType == FlagType.User ? Claims.User.Actions.RemoveFlags : Claims.Device.Actions.RemoveFlags))
+            {
+                return true;
+            }
+
+            // permission override
+            if (permission != null && (
+                permission.CanRemoveSubjectIds.Contains(authorization.User.UserId) ||
+                permission.CanRemoveSubjectIds.Overlaps(authorization.GroupMembership) ||
+                permission.CanRemoveSubjectIds.Overlaps(authorization.RoleTokens.Select(r => $"[{r.Role.Id}]"))
+                ))
+            {
+                return true;
+            }
+
+            return false;
+        }
+
+        public static bool CanShowAny(this IEnumerable<UserFlagAssignment> assignments)
+        {
+            if (assignments == null)
+                return false;
+
+            foreach (var assignment in assignments)
+            {
+                if (assignment.RemovedDate.HasValue)
+                    continue;
+
+                var (_, permission) = UserFlagService.GetUserFlag(assignment.UserFlagId);
+
+                if (permission.CanShow())
+                    return true;
+            }
+
+            return false;
+        }
+
+        public static bool CanShowAny(this IEnumerable<DeviceFlagAssignment> assignments)
+        {
+            if (assignments == null)
+                return false;
+
+            foreach (var assignment in assignments)
+            {
+                if (assignment.RemovedDate.HasValue)
+                    continue;
+
+                var (_, permission) = DeviceFlagService.GetDeviceFlag(assignment.DeviceFlagId);
+
+                if (permission.CanShow())
+                    return true;
+            }
+
+            return false;
+        }
+    }
+}
@@ -4,6 +4,7 @@ using Disco.Services.Authorization;
 using Disco.Services.Expressions;
 using Disco.Services.Logging;
 using Disco.Services.Users;
+using Disco.Services.Users.UserFlags;
 using System;
 using System.Collections;
 using System.Linq;
@@ -14,16 +15,18 @@ namespace Disco.Services
    {

        #region Edit Comments
-        public static bool CanEditComments(this UserFlagAssignment fa)
+        public static bool CanEdit(this UserFlagAssignment fa)
        {
-            return UserService.CurrentAuthorization.Has(Claims.User.Actions.EditFlags);
+            var (_, permission) = UserFlagService.GetUserFlag(fa.UserFlagId);
+
+            return permission.CanEdit();
        }
-        public static void OnEditComments(this UserFlagAssignment fa, string Comments)
+        public static void OnEdit(this UserFlagAssignment fa, string comments)
        {
-            if (!fa.CanEditComments())
+            if (!fa.CanEdit())
                throw new InvalidOperationException("Editing comments for user flags is denied");

-            fa.Comments = string.IsNullOrWhiteSpace(Comments) ? null : Comments.Trim();
+            fa.Comments = string.IsNullOrWhiteSpace(comments) ? null : comments.Trim();
        }
        #endregion

@@ -33,34 +36,36 @@ namespace Disco.Services
            if (fa.RemovedDate.HasValue)
                return false;

-            return UserService.CurrentAuthorization.Has(Claims.User.Actions.RemoveFlags);
+            var (_, permission) = UserFlagService.GetUserFlag(fa.UserFlagId);
+
+            return permission.CanRemove();
        }
-        public static void OnRemove(this UserFlagAssignment fa, DiscoDataContext Database, User RemovingUser)
+        public static void OnRemove(this UserFlagAssignment fa, DiscoDataContext database)
        {
            if (!fa.CanRemove())
                throw new InvalidOperationException("Removing user flags is denied");

-            fa.OnRemoveUnsafe(Database, RemovingUser);
+            fa.OnRemoveUnsafe(database, UserService.CurrentUser);
        }

-        public static void OnRemoveUnsafe(this UserFlagAssignment fa, DiscoDataContext Database, User RemovingUser)
+        public static void OnRemoveUnsafe(this UserFlagAssignment fa, DiscoDataContext database, User removingUser)
        {
-            fa = Database.UserFlagAssignments.First(a => a.Id == fa.Id);
-            RemovingUser = Database.Users.First(u => u.UserId == RemovingUser.UserId);
+            fa = database.UserFlagAssignments.First(a => a.Id == fa.Id);
+            removingUser = database.Users.First(u => u.UserId == removingUser.UserId);

            fa.RemovedDate = DateTime.Now;
-            fa.RemovedUserId = RemovingUser.UserId;
+            fa.RemovedUserId = removingUser.UserId;

            if (!string.IsNullOrWhiteSpace(fa.UserFlag.OnUnassignmentExpression))
            {
                try
                {
-                    Database.SaveChanges();
-                    var expressionResult = fa.EvaluateOnUnassignmentExpression(Database, RemovingUser, fa.AddedDate);
+                    database.SaveChanges();
+                    var expressionResult = fa.EvaluateOnUnassignmentExpression(database, removingUser, fa.AddedDate);
                    if (!string.IsNullOrWhiteSpace(expressionResult))
                    {
                        fa.OnUnassignmentExpressionResult = expressionResult;
-                        Database.SaveChanges();
+                        database.SaveChanges();
                    }
                }
                catch (Exception ex)
@@ -72,58 +77,52 @@ namespace Disco.Services
        #endregion

        #region Add
-        public static bool CanAddUserFlags(this User u)
-        {
-            return UserService.CurrentAuthorization.Has(Claims.User.Actions.AddFlags);
-        }
        public static bool CanAddUserFlag(this User u, UserFlag flag)
        {
-            // Shortcut
-            if (!u.CanAddUserFlags())
-                return false;
-
            // Already has User Flag?
            if (u.UserFlagAssignments.Any(fa => !fa.RemovedDate.HasValue && fa.UserFlagId == flag.Id))
                return false;

-            return true;
+            var (_, permission) = UserFlagService.GetUserFlag(flag.Id);
+
+            return permission.CanAssign();
        }
-        public static UserFlagAssignment OnAddUserFlag(this User u, DiscoDataContext Database, UserFlag flag, User AddingUser, string Comments)
+        public static UserFlagAssignment OnAddUserFlag(this User u, DiscoDataContext database, UserFlag flag, string comments)
        {
            if (!u.CanAddUserFlag(flag))
                throw new InvalidOperationException("Adding user flag is denied");

-            return u.OnAddUserFlagUnsafe(Database, flag, AddingUser, Comments);
+            return u.OnAddUserFlagUnsafe(database, flag, UserService.CurrentUser, comments);
        }

-        public static UserFlagAssignment OnAddUserFlagUnsafe(this User u, DiscoDataContext Database, UserFlag flag, User AddingUser, string Comments)
+        public static UserFlagAssignment OnAddUserFlagUnsafe(this User u, DiscoDataContext database, UserFlag flag, User addingUser, string comments)
        {
-            flag = Database.UserFlags.First(f => f.Id == flag.Id);
-            u = Database.Users.First(user => user.UserId == u.UserId);
-            AddingUser = Database.Users.First(user => user.UserId == AddingUser.UserId);
+            flag = database.UserFlags.First(f => f.Id == flag.Id);
+            u = database.Users.First(user => user.UserId == u.UserId);
+            addingUser = database.Users.First(user => user.UserId == addingUser.UserId);

            var fa = new UserFlagAssignment()
            {
                UserFlag = flag,
                User = u,
                AddedDate = DateTime.Now,
-                AddedUser = AddingUser,
-                AddedUserId = AddingUser.UserId,
-                Comments = string.IsNullOrWhiteSpace(Comments) ? null : Comments.Trim()
+                AddedUser = addingUser,
+                AddedUserId = addingUser.UserId,
+                Comments = string.IsNullOrWhiteSpace(comments) ? null : comments.Trim()
            };

-            Database.UserFlagAssignments.Add(fa);
+            database.UserFlagAssignments.Add(fa);

            if (!string.IsNullOrWhiteSpace(flag.OnAssignmentExpression))
            {
                try
                {
-                    Database.SaveChanges();
-                    var expressionResult = fa.EvaluateOnAssignmentExpression(Database, AddingUser, fa.AddedDate);
+                    database.SaveChanges();
+                    var expressionResult = fa.EvaluateOnAssignmentExpression(database, addingUser, fa.AddedDate);
                    if (!string.IsNullOrWhiteSpace(expressionResult))
                    {
                        fa.OnAssignmentExpressionResult = expressionResult;
-                        Database.SaveChanges();
+                        database.SaveChanges();
                    }
                }
                catch (Exception ex)
@@ -5,6 +5,7 @@ using Disco.Services.Extensions;
 using Disco.Services.Tasks;
 using System;
 using System.Collections.Generic;
+using System.Data.Entity;
 using System.Linq;
 using System.Reactive.Linq;

@@ -12,7 +13,7 @@ namespace Disco.Services.Users.UserFlags
 {
    public static class UserFlagService
    {
-        private static Cache _cache;
+        private static Cache cache;
        internal static Lazy<IObservable<RepositoryMonitorEvent>> UserFlagAssignmentRepositoryEvents;

        static UserFlagService()
@@ -24,25 +25,58 @@ namespace Disco.Services.Users.UserFlags
                    RepositoryMonitor.StreamAfterCommit.Where(e =>
                        e.EntityType == typeof(UserFlagAssignment) &&
                        (e.EventType != RepositoryMonitorEventType.Modified ||
-                        e.ModifiedProperties.Contains("RemovedDate"))
+                        e.ModifiedProperties.Contains(nameof(UserFlagAssignment.RemovedDate)))
                        )
                    );
        }

        public static void Initialize(DiscoDataContext Database)
        {
-            _cache = new Cache(Database);
+            cache = new Cache(Database);

            // Initialize Managed Groups (if configured)
-            _cache.GetUserFlags().ForEach(uf =>
+            cache.GetUserFlags().ForEach(uf =>
            {
-                UserFlagUsersManagedGroup.Initialize(uf);
-                UserFlagUserDevicesManagedGroup.Initialize(uf);
+                UserFlagUsersManagedGroup.Initialize(uf.flag);
+                UserFlagUserDevicesManagedGroup.Initialize(uf.flag);
            });
        }

-        public static List<UserFlag> GetUserFlags() { return _cache.GetUserFlags(); }
-        public static UserFlag GetUserFlag(int UserFlagId) { return _cache.GetUserFlag(UserFlagId); }
+        public static IEnumerable<(UserFlag flag, FlagPermission permission)> GetUserFlags() { return cache.GetUserFlags(); }
+        public static (UserFlag flag, FlagPermission permission) GetUserFlag(int UserFlagId) { return cache.GetUserFlag(UserFlagId); }
+
+        public static UserFlag GetAvailableUserFlag(int userFlagId, User targetUser)
+        {
+            var (userFlag, permission) = cache.GetUserFlag(userFlagId);
+
+            if (targetUser.UserFlagAssignments
+                .Where(a => a.UserFlagId == userFlagId && !a.RemovedDate.HasValue).Any())
+                return null;
+
+            if (permission.CanAssign())
+                return userFlag;
+
+            return null;
+        }
+
+        public static IEnumerable<UserFlag> GetAvailableUserFlags(User targetUser)
+        {
+            var records = cache.GetUserFlags();
+
+            var usedFlags = targetUser.UserFlagAssignments
+                    .Where(a => !a.RemovedDate.HasValue)
+                    .Select(a => a.UserFlagId)
+                    .ToList();
+
+            foreach (var (flag, permission) in records)
+            {
+                if (usedFlags.Contains(flag.Id))
+                    continue;
+
+                if (permission.CanAssign())
+                    yield return flag;
+            }
+        }

        #region User Flag Maintenance
        public static UserFlag CreateUserFlag(DiscoDataContext Database, string name, string description)
@@ -52,7 +86,7 @@ namespace Disco.Services.Users.UserFlags
                throw new ArgumentException("The User Flag Name is required", nameof(name));

            // Name Unique
-            if (_cache.GetUserFlags().Any(f => f.Name.Equals(name, StringComparison.Ordinal)))
+            if (cache.GetUserFlags().Any(f => f.flag.Name.Equals(name, StringComparison.Ordinal)))
                throw new ArgumentException("Another User Flag already exists with that name", nameof(name));

            // Clone to break reference
@@ -67,7 +101,7 @@ namespace Disco.Services.Users.UserFlags
            Database.UserFlags.Add(flag);
            Database.SaveChanges();

-            _cache.AddOrUpdate(flag);
+            cache.AddOrUpdate(flag);

            return flag;
        }
@@ -78,12 +112,12 @@ namespace Disco.Services.Users.UserFlags
                throw new ArgumentException("The User Flag Name is required");

            // Name Unique
-            if (_cache.GetUserFlags().Any(f => f.Id != UserFlag.Id && f.Name == UserFlag.Name))
-                throw new ArgumentException("Another User Flag already exists with that name", "UserFlag");
+            if (cache.GetUserFlags().Any(f => f.flag.Id != UserFlag.Id && f.flag.Name == UserFlag.Name))
+                throw new ArgumentException("Another User Flag already exists with that name", nameof(UserFlag));

            Database.SaveChanges();

-            _cache.AddOrUpdate(UserFlag);
+            cache.AddOrUpdate(UserFlag);
            UserFlagUsersManagedGroup.Initialize(UserFlag);
            UserFlagUserDevicesManagedGroup.Initialize(UserFlag);

@@ -113,22 +147,22 @@ namespace Disco.Services.Users.UserFlags
            Database.SaveChanges();

            // Remove from Cache
-            _cache.Remove(UserFlagId);
+            cache.Remove(UserFlagId);

            Status.Finished($"Successfully Deleted User Flag: '{flag.Name}' [{flag.Id}]");
        }
        #endregion

        #region Bulk Assignment
-        public static IEnumerable<UserFlagAssignment> BulkAssignAddUsers(DiscoDataContext Database, UserFlag UserFlag, User Technician, string Comments, List<User> Users, IScheduledTaskStatus Status)
+        public static IEnumerable<UserFlagAssignment> BulkAssignAddUsers(DiscoDataContext database, UserFlag userFlag, User techUser, string comments, List<User> users, IScheduledTaskStatus status)
        {
-            if (Users.Count > 0)
+            if (users.Count > 0)
            {
                double progressInterval;
                const int databaseChunkSize = 100;
-                string comments = string.IsNullOrWhiteSpace(Comments) ? null : Comments.Trim();
+                comments = string.IsNullOrWhiteSpace(comments) ? null : comments.Trim();

-                var addUsers = Users.Where(u => !u.UserFlagAssignments.Any(a => a.UserFlagId == UserFlag.Id && !a.RemovedDate.HasValue)).ToList();
+                var addUsers = users.Where(u => !u.UserFlagAssignments.Any(a => a.UserFlagId == userFlag.Id && !a.RemovedDate.HasValue)).ToList();

                progressInterval = (double)100 / addUsers.Count;

@@ -138,39 +172,39 @@ namespace Disco.Services.Users.UserFlags

                    var chunkResults = chunk.Select((user, index) =>
                    {
-                        Status.UpdateStatus((chunkIndexOffset + index) * progressInterval, $"Assigning Flag: {user.ToString()}");
+                        status.UpdateStatus((chunkIndexOffset + index) * progressInterval, $"Assigning Flag: {user}");

-                        return user.OnAddUserFlag(Database, UserFlag, Technician, comments);
+                        return user.OnAddUserFlagUnsafe(database, userFlag, techUser, comments);
                    }).ToList();

                    // Save Chunk Items to Database
-                    Database.SaveChanges();
+                    database.SaveChanges();

                    return chunkResults;
                }).Where(fa => fa != null).ToList();

-                Status.SetFinishedMessage($"{addUsers.Count} Users/s Added; {(Users.Count - addUsers.Count)} User/s Skipped");
+                status.SetFinishedMessage($"{addUsers.Count} Users/s Added; {users.Count - addUsers.Count} User/s Skipped");

                return addedUserAssignments;
            }
            else
            {
-                Status.SetFinishedMessage("No changes found");
+                status.SetFinishedMessage("No changes found");
                return Enumerable.Empty<UserFlagAssignment>();
            }
        }

-        public static IEnumerable<UserFlagAssignment> BulkAssignOverrideUsers(DiscoDataContext Database, UserFlag UserFlag, User Technician, string Comments, List<User> Users, IScheduledTaskStatus Status)
+        public static IEnumerable<UserFlagAssignment> BulkAssignOverrideUsers(DiscoDataContext database, UserFlag userFlag, User techUser, string comments, List<User> users, IScheduledTaskStatus status)
        {
            double progressInterval;
            const int databaseChunkSize = 100;
-            string comments = string.IsNullOrWhiteSpace(Comments) ? null : Comments.Trim();
+            comments = string.IsNullOrWhiteSpace(comments) ? null : comments.Trim();

-            Status.UpdateStatus(0, "Calculating assignment changes");
+            status.UpdateStatus(0, "Calculating assignment changes");

-            var currentAssignments = Database.UserFlagAssignments.Include("User").Where(a => a.UserFlagId == UserFlag.Id && !a.RemovedDate.HasValue).ToList();
-            var removeAssignments = currentAssignments.Where(ca => !Users.Any(u => u.UserId.Equals(ca.UserId, StringComparison.OrdinalIgnoreCase))).ToList();
-            var addUsers = Users.Where(u => !currentAssignments.Any(ca => ca.UserId.Equals(u.UserId, StringComparison.OrdinalIgnoreCase))).ToList();
+            var currentAssignments = database.UserFlagAssignments.Include(a => a.User).Where(a => a.UserFlagId == userFlag.Id && !a.RemovedDate.HasValue).ToList();
+            var removeAssignments = currentAssignments.Where(ca => !users.Any(u => u.UserId.Equals(ca.UserId, StringComparison.OrdinalIgnoreCase))).ToList();
+            var addUsers = users.Where(u => !currentAssignments.Any(ca => ca.UserId.Equals(u.UserId, StringComparison.OrdinalIgnoreCase))).ToList();

            if (removeAssignments.Count > 0 || addUsers.Count > 0)
            {
@@ -184,15 +218,15 @@ namespace Disco.Services.Users.UserFlags

                    var chunkResults = chunk.Select((flagAssignment, index) =>
                    {
-                        Status.UpdateStatus((chunkIndexOffset + index) * progressInterval, $"Removing Flag: {flagAssignment.User.ToString()}");
+                        status.UpdateStatus((chunkIndexOffset + index) * progressInterval, $"Removing Flag: {flagAssignment.User}");

-                        flagAssignment.OnRemoveUnsafe(Database, Technician);
+                        flagAssignment.OnRemoveUnsafe(database, techUser);

                        return flagAssignment;
                    }).ToList();

                    // Save Chunk Items to Database
-                    Database.SaveChanges();
+                    database.SaveChanges();

                    return chunkResults;
                }).ToList();
@@ -204,24 +238,24 @@ namespace Disco.Services.Users.UserFlags

                    var chunkResults = chunk.Select((user, index) =>
                    {
-                        Status.UpdateStatus((chunkIndexOffset + index) * progressInterval, $"Assigning Flag: {user.ToString()}");
+                        status.UpdateStatus((chunkIndexOffset + index) * progressInterval, string.Format("Assigning Flag: {0}", user.ToString()));

-                        return user.OnAddUserFlag(Database, UserFlag, Technician, comments);
+                        return user.OnAddUserFlagUnsafe(database, userFlag, techUser, comments);
                    }).ToList();

                    // Save Chunk Items to Database
-                    Database.SaveChanges();
+                    database.SaveChanges();

                    return chunkResults;
                }).ToList();

-                Status.SetFinishedMessage($"{addUsers.Count} Users/s Added; {removeAssignments.Count} User/s Removed; {(Users.Count - addUsers.Count)} User/s Skipped");
+                status.SetFinishedMessage($"{addUsers.Count} Users/s Added; {removeAssignments.Count} User/s Removed; {users.Count - addUsers.Count} User/s Skipped");

                return addedUserAssignments;
            }
            else
            {
-                Status.SetFinishedMessage("No changes found");
+                status.SetFinishedMessage("No changes found");
                return Enumerable.Empty<UserFlagAssignment>();
            }
        }
@@ -229,11 +263,11 @@ namespace Disco.Services.Users.UserFlags

        public static string RandomUnusedIcon()
        {
-            return UIHelpers.RandomIcon(_cache.GetUserFlags().Select(f => f.Icon));
+            return UIHelpers.RandomIcon(cache.GetUserFlags().Select(f => f.flag.Icon));
        }
        public static string RandomUnusedThemeColour()
        {
-            return UIHelpers.RandomThemeColour(_cache.GetUserFlags().Select(f => f.IconColour));
+            return UIHelpers.RandomThemeColour(cache.GetUserFlags().Select(f => f.flag.IconColour));
        }
    }
 }