feature: flag permissions

feature: flag permissions

Disco.Web/Areas/API/Controllers/AuthorizationRoleController.cs

@@ -78,14 +78,16 @@ namespace Disco.Web.Areas.API.Controllers
             }
         }
 
-        private void UpdateClaims(AuthorizationRole AuthorizationRole, string[] ClaimKeys)
+        private void UpdateClaims(AuthorizationRole AuthorizationRole, string[] claimKeys)
         {
-            var proposedClaims = Claims.BuildClaims(ClaimKeys);
+            claimKeys = claimKeys ?? Array.Empty<string>();
+
+            var proposedClaims = Claims.BuildClaims(claimKeys);
 
             var currentToken = RoleToken.FromAuthorizationRole(AuthorizationRole);
             var currentClaimKeys = Claims.GetClaimKeys(currentToken.Claims);
-            var removedClaims = currentClaimKeys.Except(ClaimKeys).ToArray();
-            var addedClaims = ClaimKeys.Except(currentClaimKeys).ToArray();
+            var removedClaims = currentClaimKeys.Except(claimKeys).ToArray();
+            var addedClaims = claimKeys.Except(currentClaimKeys).ToArray();
 
             AuthorizationRole.SetClaims(proposedClaims);
             UserService.UpdateAuthorizationRole(Database, AuthorizationRole);

Disco.Web/Areas/API/Controllers/DeviceFlagAssignmentController.cs

@@ -1,6 +1,5 @@
 using Disco.Models.Repository;
 using Disco.Services;
-using Disco.Services.Authorization;
 using Disco.Services.Web;
 using System;
 using System.Data.Entity;
@@ -12,7 +11,7 @@ namespace Disco.Web.Areas.API.Controllers
     public partial class DeviceFlagAssignmentController : AuthorizedDatabaseController
     {
         const string pComments = "comments";
-
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Update(int id, string key, string value = null, bool? redirect = null)
         {
             try
@@ -21,7 +20,9 @@ namespace Disco.Web.Areas.API.Controllers
                     throw new ArgumentOutOfRangeException(nameof(id));
                 if (string.IsNullOrEmpty(key))
                     throw new ArgumentNullException(nameof(key));
-                var assignment = Database.DeviceFlagAssignments.FirstOrDefault(a => a.Id == id);
+                var assignment = Database.DeviceFlagAssignments
+                    .Include(a => a.DeviceFlag)
+                    .FirstOrDefault(a => a.Id == id);
                 if (assignment != null)
                 {
                     switch (key.ToLower())
@@ -52,7 +53,7 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         #region Update Shortcut Methods
-        [DiscoAuthorizeAny(Claims.Device.Actions.EditFlags)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateComments(int id, string Comments = null, bool? redirect = null)
         {
             return Update(id, pComments, Comments, redirect);
@@ -60,20 +61,19 @@ namespace Disco.Web.Areas.API.Controllers
         #endregion
 
         #region Update Properties
-        private void UpdateComments(DeviceFlagAssignment assignment, string Comments)
+        private void UpdateComments(DeviceFlagAssignment assignment, string comments)
         {
-            if (!assignment.CanEditComments())
+            if (!assignment.CanEdit())
                 throw new InvalidOperationException("Editing comments for device flags is denied");
 
-            assignment.OnEditComments(Comments);
+            assignment.OnEdit(comments);
             Database.SaveChanges();
         }
         #endregion
 
         #region Actions
-
-        [DiscoAuthorizeAny(Claims.Device.Actions.AddFlags)]
-        public virtual ActionResult AddDevice(int id, string DeviceSerialNumber, string Comments)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult AddDevice(int id, string deviceSerialNumber, string comments)
         {
             Database.Configuration.LazyLoadingEnabled = true;
 
@@ -81,37 +81,35 @@ namespace Disco.Web.Areas.API.Controllers
             if (flag == null)
                 throw new ArgumentException("Invalid Device Flag Id", nameof(id));
 
-            var device = Database.Devices.Include(u => u.DeviceFlagAssignments).FirstOrDefault(d => d.SerialNumber == DeviceSerialNumber);
+            var device = Database.Devices.Include(u => u.DeviceFlagAssignments).FirstOrDefault(d => d.SerialNumber == deviceSerialNumber);
             if (device == null)
-                throw new ArgumentException("Invalid Device Serial Number", nameof(DeviceSerialNumber));
+                throw new ArgumentException("Invalid Device Serial Number", nameof(deviceSerialNumber));
 
             if (!device.CanAddDeviceFlag(flag))
-                throw new InvalidOperationException("Adding device flag is denied");
+                return Unauthorized("Adding device flag is denied");
 
-            var addingUser = Database.Users.Find(CurrentUser.UserId);
-
-            var assignment = device.OnAddDeviceFlag(Database, flag, addingUser, Comments);
+            var assignment = device.OnAddDeviceFlag(Database, flag, comments);
 
             Database.SaveChanges();
 
             return Redirect($"{Url.Action(MVC.Device.Show(device.SerialNumber))}#DeviceDetailTab-Flags");
         }
 
-        [DiscoAuthorizeAny(Claims.Device.Actions.RemoveFlags)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult RemoveDevice(int id)
         {
             Database.Configuration.LazyLoadingEnabled = true;
 
-            var assignment = Database.DeviceFlagAssignments.FirstOrDefault(a => a.Id == id);
+            var assignment = Database.DeviceFlagAssignments
+                .Include(a => a.DeviceFlag)
+                .FirstOrDefault(a => a.Id == id);
             if (assignment == null)
                 throw new ArgumentException("Invalid Device Flag Assignment Id", nameof(id));
 
             if (!assignment.CanRemove())
-                throw new InvalidOperationException("Removing device flag assignment is denied");
+                return Unauthorized("Removing device flag assignment is denied");
 
-            var removingUser = Database.Users.Find(CurrentUser.UserId);
-
-            assignment.OnRemove(Database, removingUser);
+            assignment.OnRemove(Database);
             Database.SaveChanges();
 
             return Redirect($"{Url.Action(MVC.Device.Show(assignment.DeviceSerialNumber))}#DeviceDetailTab-Flags");
@@ -120,4 +118,4 @@ namespace Disco.Web.Areas.API.Controllers
         #endregion
 
     }
-}
+}

Disco.Web/Areas/API/Controllers/DeviceFlagController.cs

@@ -5,7 +5,9 @@ using Disco.Services.Devices.DeviceFlags;
 using Disco.Services.Exporting;
 using Disco.Services.Interop.ActiveDirectory;
 using Disco.Services.Tasks;
+using Disco.Services.Users.UserFlags;
 using Disco.Services.Web;
+using Disco.Web.Areas.API.Models.Shared;
 using Disco.Web.Areas.Config.Models.DeviceFlag;
 using Disco.Web.Extensions;
 using System;
@@ -467,6 +469,24 @@ namespace Disco.Web.Areas.API.Controllers
             return RedirectToAction(MVC.Config.Export.Create(savedExport.Id));
         }
 
+        [DiscoAuthorize(Claims.Config.DeviceFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult Permission(int id, FlagPermissionModel model = null)
+        {
+            var deviceFlag = Database.DeviceFlags.Find(id);
+
+            if (deviceFlag == null)
+                return NotFound();
+
+            if (model == null || !model.IsOverride)
+                deviceFlag.Permissions = null;
+            else
+                deviceFlag.Permissions = model.ToFlagPermission(deviceFlag);
+
+            DeviceFlagService.Update(Database, deviceFlag);
+
+            return RedirectToAction(MVC.Config.DeviceFlag.Index(deviceFlag.Id));
+        }
         #endregion
     }
 }

Disco.Web/Areas/API/Controllers/SystemController.cs

@@ -4,7 +4,9 @@ using Disco.Services.Authorization;
 using Disco.Services.Interop.ActiveDirectory;
 using Disco.Services.Interop.DiscoServices;
 using Disco.Services.Messaging;
+using Disco.Services.Users;
 using Disco.Services.Web;
+using Disco.Web.Areas.API.Models.Shared;
 using System;
 using System.Collections.Generic;
 using System.Drawing;
@@ -320,38 +322,64 @@ namespace Disco.Web.Areas.API.Controllers
             };
         }
 
-        [DiscoAuthorizeAny(Claims.DiscoAdminAccount, Claims.Config.JobQueue.Configure)]
-        public virtual ActionResult SearchSubjects(string term)
+        [DiscoAuthorizeAny(Claims.DiscoAdminAccount, Claims.Config.JobQueue.Configure, Claims.Config.UserFlag.Configure, Claims.Config.DeviceFlag.Configure)]
+        public virtual ActionResult SearchSubjects(string term, bool includeAuthorizationRoles = false)
         {
-            var groupResults = ActiveDirectory.SearchADGroups(term).Cast<IADObject>();
-            var userResults = ActiveDirectory.SearchADUserAccounts(term, true).Cast<IADObject>();
+            var groupResults = ActiveDirectory.SearchADGroups(term).Select(r => SubjectDescriptorModel.FromActiveDirectoryObject(r));
+            var userResults = ActiveDirectory.SearchADUserAccounts(term, true).Select(r => SubjectDescriptorModel.FromActiveDirectoryObject(r));
 
-            var results = groupResults.Concat(userResults).OrderBy(r => r.SamAccountName)
-                .Select(r => Models.Shared.SubjectDescriptorModel.FromActiveDirectoryObject(r)).ToList();
+            IEnumerable<SubjectDescriptorModel> roleResults;
+            if (includeAuthorizationRoles)
+            {
+                roleResults = Database.AuthorizationRoles.AsNoTracking().Where(r => r.Name.Contains(term))
+                    .ToList()
+                    .Select(r => SubjectDescriptorModel.FromAuthorizationRole(r));
+            }
+            else
+                roleResults = Enumerable.Empty<SubjectDescriptorModel>();
+
+            var results = groupResults.Concat(userResults).Concat(roleResults)
+                .OrderBy(r => r.Id).ToList();
 
             return Json(results, JsonRequestBehavior.AllowGet);
         }
 
-        [DiscoAuthorizeAny(Claims.Config.UserFlag.Configure)]
+        [DiscoAuthorizeAny(Claims.DiscoAdminAccount, Claims.Config.DeviceProfile.Configure, Claims.Config.DocumentTemplate.Configure, Claims.Config.Plugin.Configure, Claims.Config.UserFlag.Configure, Claims.Config.DeviceFlag.Configure)]
         public virtual ActionResult SearchGroupSubjects(string term)
         {
             var groupResults = ActiveDirectory.SearchADGroups(term).Cast<IADObject>();
 
             var results = groupResults.OrderBy(r => r.SamAccountName)
-                .Select(r => Models.Shared.SubjectDescriptorModel.FromActiveDirectoryObject(r)).ToList();
+                .Select(r => SubjectDescriptorModel.FromActiveDirectoryObject(r)).ToList();
 
             return Json(results, JsonRequestBehavior.AllowGet);
         }
 
-        [DiscoAuthorizeAny(Claims.DiscoAdminAccount, Claims.Config.JobQueue.Configure)]
-        public virtual ActionResult Subject(string Id)
+        [DiscoAuthorizeAny(Claims.DiscoAdminAccount, Claims.Config.JobQueue.Configure, Claims.Config.UserFlag.Configure, Claims.Config.DeviceFlag.Configure)]
+        public virtual ActionResult Subject(string Id, bool includeAuthorizationRoles = false)
         {
+            if (string.IsNullOrWhiteSpace(Id))
+                return Json(null, JsonRequestBehavior.AllowGet);
+
+            if (Id.StartsWith("[", StringComparison.Ordinal))
+            {
+                if (includeAuthorizationRoles && int.TryParse(Id.Trim('[', ']'), out var roleId))
+                {
+                    var roleName = UserService.GetAuthorizationRoleName(roleId);
+                    if (roleName != null)
+                    {
+                        return Json(SubjectDescriptorModel.FromAuthorizationRole(roleId, roleName), JsonRequestBehavior.AllowGet);
+                    }
+                }
+                return Json(null, JsonRequestBehavior.AllowGet);
+            }
+
             var subject = ActiveDirectory.RetrieveADObject(Id, Quick: true);
 
             if (subject == null)
                 return Json(null, JsonRequestBehavior.AllowGet);
             else
-                return Json(Models.Shared.SubjectDescriptorModel.FromActiveDirectoryObject(subject), JsonRequestBehavior.AllowGet);
+                return Json(SubjectDescriptorModel.FromActiveDirectoryObject(subject), JsonRequestBehavior.AllowGet);
         }
 
         [DiscoAuthorizeAny(Claims.Config.UserFlag.Configure, Claims.Config.DeviceFlag.Configure, Claims.Config.DeviceProfile.Configure, Claims.Config.DocumentTemplate.Configure)]

Disco.Web/Areas/API/Controllers/UserFlagAssignmentController.cs

@@ -12,7 +12,7 @@ namespace Disco.Web.Areas.API.Controllers
     public partial class UserFlagAssignmentController : AuthorizedDatabaseController
     {
         const string pComments = "comments";
-
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Update(int id, string key, string value = null, bool? redirect = null)
         {
             try
@@ -21,7 +21,9 @@ namespace Disco.Web.Areas.API.Controllers
                     throw new ArgumentOutOfRangeException(nameof(id));
                 if (string.IsNullOrEmpty(key))
                     throw new ArgumentNullException(nameof(key));
-                var userFlagAssignment = Database.UserFlagAssignments.FirstOrDefault(a => a.Id == id);
+                var userFlagAssignment = Database.UserFlagAssignments
+                    .Include(a => a.UserFlag)
+                    .FirstOrDefault(a => a.Id == id);
                 if (userFlagAssignment != null)
                 {
                     switch (key.ToLower())
@@ -52,7 +54,7 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         #region Update Shortcut Methods
-        [DiscoAuthorizeAny(Claims.User.Actions.EditFlags)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateComments(int id, string Comments = null, bool? redirect = null)
         {
             return Update(id, pComments, Comments, redirect);
@@ -60,19 +62,19 @@ namespace Disco.Web.Areas.API.Controllers
         #endregion
 
         #region Update Properties
-        private void UpdateComments(UserFlagAssignment userFlagAssignment, string Comments)
+        private void UpdateComments(UserFlagAssignment userFlagAssignment, string comments)
         {
-            if (!userFlagAssignment.CanEditComments())
+            if (!userFlagAssignment.CanEdit())
                 throw new InvalidOperationException("Editing comments for user flags is denied");
 
-            userFlagAssignment.OnEditComments(Comments);
+            userFlagAssignment.OnEdit(comments);
             Database.SaveChanges();
         }
         #endregion
 
         #region Actions
 
-        [DiscoAuthorizeAny(Claims.User.Actions.AddFlags)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult AddUser(int id, string UserId, string Comments)
         {
             Database.Configuration.LazyLoadingEnabled = true;
@@ -86,32 +88,30 @@ namespace Disco.Web.Areas.API.Controllers
                 throw new ArgumentException("Invalid User Id", nameof(UserId));
 
             if (!user.CanAddUserFlag(userFlag))
-                throw new InvalidOperationException("Adding user flag is denied");
+                return Unauthorized("Adding user flag is denied");
 
-            var addingUser = Database.Users.Find(CurrentUser.UserId);
-
-            var userFlagAssignment = user.OnAddUserFlag(Database, userFlag, addingUser, Comments);
+            var userFlagAssignment = user.OnAddUserFlag(Database, userFlag, Comments);
 
             Database.SaveChanges();
 
             return Redirect($"{Url.Action(MVC.User.Show(user.UserId))}#UserDetailTab-Flags");
         }
 
-        [DiscoAuthorizeAny(Claims.User.Actions.RemoveFlags)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult RemoveUser(int id)
         {
             Database.Configuration.LazyLoadingEnabled = true;
 
-            var userFlagAssignment = Database.UserFlagAssignments.FirstOrDefault(a => a.Id == id);
+            var userFlagAssignment = Database.UserFlagAssignments
+                .Include(a => a.UserFlag)
+                .FirstOrDefault(a => a.Id == id);
             if (userFlagAssignment == null)
                 throw new ArgumentException("Invalid User Flag Assignment Id", nameof(id));
 
             if (!userFlagAssignment.CanRemove())
-                throw new InvalidOperationException("Removing user flag assignment is denied");
+                return Unauthorized("Removing user flag assignment is denied");
 
-            var removingUser = Database.Users.Find(CurrentUser.UserId);
-
-            userFlagAssignment.OnRemove(Database, removingUser);
+            userFlagAssignment.OnRemove(Database);
             Database.SaveChanges();
 
             return Redirect($"{Url.Action(MVC.User.Show(userFlagAssignment.UserId))}#UserDetailTab-Flags");
@@ -120,4 +120,4 @@ namespace Disco.Web.Areas.API.Controllers
         #endregion
 
     }
-}
+}

Disco.Web/Areas/API/Controllers/UserFlagController.cs

@@ -6,6 +6,7 @@ using Disco.Services.Interop.ActiveDirectory;
 using Disco.Services.Tasks;
 using Disco.Services.Users.UserFlags;
 using Disco.Services.Web;
+using Disco.Web.Areas.API.Models.Shared;
 using Disco.Web.Areas.Config.Models.UserFlag;
 using Disco.Web.Extensions;
 using System;
@@ -467,6 +468,24 @@ namespace Disco.Web.Areas.API.Controllers
             return RedirectToAction(MVC.Config.Export.Create(savedExport.Id));
         }
 
+        [DiscoAuthorize(Claims.Config.UserFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult Permission(int id, FlagPermissionModel model = null)
+        {
+            var userFlag = Database.UserFlags.Find(id);
+
+            if (userFlag == null)
+                return NotFound();
+
+            if (model == null || !model.IsOverride)
+                userFlag.Permissions = null;
+            else
+                userFlag.Permissions = model.ToFlagPermission(userFlag);
+
+            UserFlagService.Update(Database, userFlag);
+
+            return RedirectToAction(MVC.Config.UserFlag.Index(userFlag.Id));
+        }
         #endregion
     }
 }

Disco.Web/Areas/API/Models/Shared/FlagPermissionModel.cs

@@ -0,0 +1,21 @@
+using Disco.Models.Repository;
+using System.Collections.Generic;
+
+namespace Disco.Web.Areas.API.Models.Shared
+{
+    public class FlagPermissionModel
+    {
+        public bool IsOverride { get; set; }
+        public bool Inherit { get; set; }
+        public List<string> CanShow { get; set; }
+        public List<string> CanAssign { get; set; }
+        public List<string> CanEdit { get; set; }
+        public List<string> CanRemove { get; set; }
+
+        public FlagPermission ToFlagPermission(UserFlag userFlag)
+            => FlagPermission.Create(userFlag, Inherit, CanShow, CanAssign, CanEdit, CanRemove);
+
+        public FlagPermission ToFlagPermission(DeviceFlag deviceFlag)
+            => FlagPermission.Create(deviceFlag, Inherit, CanShow, CanAssign, CanEdit, CanRemove);
+    }
+}

Disco.Web/Areas/API/Models/Shared/SubjectDescriptorModel.cs

@@ -1,4 +1,5 @@
-using Disco.Services.Interop.ActiveDirectory;
+using Disco.Models.Repository;
+using Disco.Services.Interop.ActiveDirectory;
 
 namespace Disco.Web.Areas.API.Models.Shared
 {
@@ -43,5 +44,19 @@ namespace Disco.Web.Areas.API.Models.Shared
 
             return item;
         }
+
+        public static SubjectDescriptorModel FromAuthorizationRole(int roleId, string roleName)
+        {
+            return new SubjectDescriptorModel()
+            {
+                Id = $"[{roleId}]",
+                Name = roleName,
+                Type = "role",
+                IsGroup = true
+            };
+        }
+
+        public static SubjectDescriptorModel FromAuthorizationRole(AuthorizationRole role)
+            => FromAuthorizationRole(role.Id, role.Name);
     }
 }

Disco.Web/Areas/Config/Controllers/DeviceFlagController.cs

@@ -47,6 +47,9 @@ namespace Disco.Web.Areas.Config.Controllers
                     m.ThemeColours = UIHelpers.ThemeColours;
                 }
 
+                var (_, permission) = DeviceFlagService.GetDeviceFlag(m.DeviceFlag.Id);
+                m.Permission = permission;
+
                 // UI Extensions
                 UIExtensions.ExecuteExtensions<ConfigDeviceFlagShowModel>(ControllerContext, m);
 
@@ -121,7 +124,7 @@ namespace Disco.Web.Areas.Config.Controllers
             var m = new ExportModel()
             {
                 Options = Database.DiscoConfiguration.DeviceFlags.LastExportOptions,
-                DeviceFlags = DeviceFlagService.GetDeviceFlags(),
+                DeviceFlags = DeviceFlagService.GetDeviceFlags().Select(f => f.flag).ToList(),
             };
 
             m.Fields = ExportFieldsModel.Create(m.Options, DeviceFlagExportOptions.DefaultOptions(), nameof(DeviceFlagExportOptions.CurrentOnly));

Disco.Web/Areas/Config/Controllers/UserFlagController.cs

@@ -46,6 +46,9 @@ namespace Disco.Web.Areas.Config.Controllers
                     m.ThemeColours = UIHelpers.ThemeColours;
                 }
 
+                var (flag, permission) = UserFlagService.GetUserFlag(m.UserFlag.Id);
+                m.Permission = permission;
+
                 // UI Extensions
                 UIExtensions.ExecuteExtensions<ConfigUserFlagShowModel>(ControllerContext, m);
 
@@ -122,7 +125,7 @@ namespace Disco.Web.Areas.Config.Controllers
             var m = new ExportModel()
             {
                 Options = Database.DiscoConfiguration.UserFlags.LastExportOptions,
-                UserFlags = UserFlagService.GetUserFlags(),
+                UserFlags = UserFlagService.GetUserFlags().Select(f => f.flag).ToList(),
             };
 
             m.Fields = ExportFieldsModel.Create(m.Options, UserFlagExportOptions.DefaultOptions(), nameof(UserFlagExportOptions.CurrentOnly));

Disco.Web/Areas/Config/Models/DeviceFlag/ShowModel.cs

@@ -1,4 +1,5 @@
-using Disco.Models.UI.Config.DeviceFlag;
+using Disco.Models.Repository;
+using Disco.Models.UI.Config.DeviceFlag;
 using Disco.Services.Devices.DeviceFlags;
 using System.Collections.Generic;
 
@@ -16,5 +17,7 @@ namespace Disco.Web.Areas.Config.Models.DeviceFlag
 
         public IEnumerable<KeyValuePair<string, string>> Icons { get; set; }
         public IEnumerable<KeyValuePair<string, string>> ThemeColours { get; set; }
+
+        public FlagPermission Permission { get; set; }
     }
 }

Disco.Web/Areas/Config/Models/UserFlag/ShowModel.cs

@@ -1,4 +1,5 @@
-using Disco.Models.UI.Config.UserFlag;
+using Disco.Models.Repository;
+using Disco.Models.UI.Config.UserFlag;
 using Disco.Services.Users.UserFlags;
 using System.Collections.Generic;
 
@@ -16,5 +17,7 @@ namespace Disco.Web.Areas.Config.Models.UserFlag
 
         public IEnumerable<KeyValuePair<string, string>> Icons { get; set; }
         public IEnumerable<KeyValuePair<string, string>> ThemeColours { get; set; }
+
+        public FlagPermission Permission { get; set; }
     }
 }

Disco.Web/Areas/Config/Views/AuthorizationRole/Show.cshtml

@@ -237,7 +237,7 @@
                 <div id="Config_AuthRoles_Claims_Tree">
                 </div>
                 <div>
-                    <button type="button" id="Config_AuthRoles_Claims_SaveChanges" class="button small disabled" data-saveurl="@Url.Action(MVC.API.AuthorizationRole.UpdateClaims(Model.Token.Role.Id))">Save Changes</button>@AjaxHelpers.AjaxLoader()
+                    <button type="button" typeof="button" id="Config_AuthRoles_Claims_SaveChanges" class="button small disabled" data-saveurl="@Url.Action(MVC.API.AuthorizationRole.UpdateClaims(Model.Token.Role.Id))">Save Changes</button>@AjaxHelpers.AjaxLoader()
                 </div>
                 <script id="Config_AuthRoles_Claims_NodesJson" type="application/json">
                     @Html.Raw(Newtonsoft.Json.JsonConvert.SerializeObject(Model.ClaimNavigatorFancyTreeNodes))
@@ -286,7 +286,7 @@
                                             saveButton.addClass('disabled');
                                             ajaxLoading.next('.ajaxOk').show().delay('fast').fadeOut('slow');
                                         } else {
-                                            alert('Unable to save changes:\n' + response);
+                                            alert('Unable to save changes:\n' + response.statusText);
                                         }
                                     } catch (e) {
                                         alert('Error: ' + e);

Disco.Web/Areas/Config/Views/AuthorizationRole/Show.generated.cs

@@ -656,6 +656,8 @@ WriteLiteral(">\r\n                </div>\r\n                <div>\r\n
 
 WriteLiteral(" type=\"button\"");
 
+WriteLiteral(" typeof=\"button\"");
+
 WriteLiteral(" id=\"Config_AuthRoles_Claims_SaveChanges\"");
 
 WriteLiteral(" class=\"button small disabled\"");
@@ -664,7 +666,7 @@ WriteLiteral(" data-saveurl=\"");
 
             
             #line 240 "..\..\Areas\Config\Views\AuthorizationRole\Show.cshtml"
-                                                                                                                          Write(Url.Action(MVC.API.AuthorizationRole.UpdateClaims(Model.Token.Role.Id)));
+                                                                                                                                          Write(Url.Action(MVC.API.AuthorizationRole.UpdateClaims(Model.Token.Role.Id)));
 
             
             #line default
@@ -675,7 +677,7 @@ WriteLiteral(">Save Changes</button>");
 
             
             #line 240 "..\..\Areas\Config\Views\AuthorizationRole\Show.cshtml"
-                                                                                                                                                                                                                         Write(AjaxHelpers.AjaxLoader());
+                                                                                                                                                                                                                                         Write(AjaxHelpers.AjaxLoader());
 
             
             #line default
@@ -728,13 +730,13 @@ WriteLiteral("\r\n                </script>\r\n                <script>\r\n
 "dClass(\'disabled\');\r\n                                            ajaxLoading.nex" +
 "t(\'.ajaxOk\').show().delay(\'fast\').fadeOut(\'slow\');\r\n                            " +
 "            } else {\r\n                                            alert(\'Unable " +
-"to save changes:\\n\' + response);\r\n                                        }\r\n   " +
-"                                 } catch (e) {\r\n                                " +
-"        alert(\'Error: \' + e);\r\n                                    }\r\n          " +
-"                          ajaxLoading.hide();\r\n                                }" +
-"\r\n                            });\r\n                        });\r\n                " +
-"    })();\r\n                </script>\r\n            </td>\r\n        </tr>\r\n    </ta" +
-"ble>\r\n</div>\r\n<div");
+"to save changes:\\n\' + response.statusText);\r\n                                   " +
+"     }\r\n                                    } catch (e) {\r\n                     " +
+"                   alert(\'Error: \' + e);\r\n                                    }\r" +
+"\n                                    ajaxLoading.hide();\r\n                      " +
+"          }\r\n                            });\r\n                        });\r\n     " +
+"               })();\r\n                </script>\r\n            </td>\r\n        </tr" +
+">\r\n    </table>\r\n</div>\r\n<div");
 
 WriteLiteral(" class=\"actionBar\"");
 

Disco.Web/Areas/Config/Views/DeviceFlag/Show.cshtml

@@ -15,6 +15,7 @@
     var canExportAll = Model.TotalAssignmentCount > 0 && Authorization.Has(Claims.Config.DeviceFlag.Export);
 
     var hideAdvanced =
+        Model.Permission.IsDefault() &&
         Model.DeviceFlag.DevicesLinkedGroup == null &&
         Model.DeviceFlag.DeviceUsersLinkedGroup == null &&
         Model.DeviceFlag.OnAssignmentExpression == null &&
@@ -38,10 +39,11 @@
             </th>
             <td>
                 @if (canConfig)
-                {@Html.EditorFor(model => model.DeviceFlag.Name)
-                @AjaxHelpers.AjaxSave()
-                @AjaxHelpers.AjaxLoader()
-                <script type="text/javascript">
+                {
+                    @Html.EditorFor(model => model.DeviceFlag.Name)
+                    @AjaxHelpers.AjaxSave()
+                    @AjaxHelpers.AjaxLoader()
+                    <script type="text/javascript">
                         $(function () {
                             document.DiscoFunctions.PropertyChangeHelper(
                                 $('#DeviceFlag_Name'),
@@ -50,12 +52,12 @@
                                 'FlagName'
                             );
                         });
-                </script>
-            }
-            else
-            {
-                @Model.DeviceFlag.Name
-            }
+                    </script>
+                }
+                else
+                {
+                    @Model.DeviceFlag.Name
+                }
             </td>
         </tr>
         <tr>
@@ -227,6 +229,340 @@
                 </td>
             </tr>
         }
+        <tr class="Config_HideAdvanced_Item">
+            <th>
+                Assignment Permission<br />
+                Override:
+            </th>
+            <td>
+                @if (!Model.Permission.IsDefault())
+                {
+                    var permission = Model.Permission;
+                    <div>
+                        @if (permission.Inherit)
+                        {
+                            <span><i class="fa fa-check-square-o"></i> Inheriting from Authorization Roles</span>
+                        }
+                        else
+                        {
+                            <span><i class="fa fa-square-o"></i> Authorization Roles are Ignored</span>
+                        }
+                    </div>
+                    if (!permission.HasSubjects())
+                    {
+                        <span class="smallMessage">There are no users/groups associated with this permission override</span>
+                    }
+                    else
+                    {
+                        if (permission.IsSimple())
+                        {
+                            <table class="tableData">
+                                <thead>
+                                    <tr>
+                                        <th>Users/Groups/Roles</th>
+                                    </tr>
+                                </thead>
+                                <tbody>
+                                    @foreach (var subjectId in permission.CanShowSubjectIds)
+                                    {
+                                        <tr>
+                                            <td>
+                                                @{
+                                                    int roleId;
+                                                    if (subjectId.StartsWith("[") && int.TryParse(subjectId.Trim('[', ']'), out roleId))
+                                                    {
+                                                        <span>@Disco.Services.Users.UserService.GetAuthorizationRoleName(roleId) @subjectId</span>
+                                                    }
+                                                    else
+                                                    {
+                                                        <span>@subjectId</span>
+                                                    }
+                                                }
+                                            </td>
+                                        </tr>
+                                    }
+                                </tbody>
+                            </table>
+                            <div class="info-box">
+                                <p class="fa-p">
+                                    <i class="fa fa-fw fa-info-circle"></i> All users/groups/roles can view, assign, edit assignments, and remove assignments for this flag.
+                                </p>
+                            </div>
+                        }
+                        else
+                        {
+                            var subjects = permission.AllSubjects();
+                            <table class="tableData">
+                                <thead>
+                                    <tr>
+                                        <th>Users/Groups/Roles</th>
+                                        <th>View</th>
+                                        <th>Assign</th>
+                                        <th>Edit</th>
+                                        <th>Remove</th>
+                                    </tr>
+                                </thead>
+                                <tbody>
+                                    @foreach (var subjectId in subjects.OrderBy(s => s))
+                                    {
+                                        <tr>
+                                            <td>
+                                                <i class="fa"></i> @{
+                                                    int roleId;
+                                                    if (subjectId.StartsWith("[") && int.TryParse(subjectId.Trim('[', ']'), out roleId))
+                                                    {
+                                                        <span>@Disco.Services.Users.UserService.GetAuthorizationRoleName(roleId) @subjectId</span>
+                                                    }
+                                                    else
+                                                    {
+                                                        <span>@subjectId</span>
+                                                    }
+                                                }
+                                            </td>
+                                            <td>
+                                                @if (permission.CanShowSubjectIds.Contains(subjectId))
+                                                {
+                                                    <i class="fa fa-fw fa-check"></i>
+                                                }
+                                            </td>
+                                            <td>
+                                                @if (permission.CanAssignSubjectIds.Contains(subjectId))
+                                                {
+                                                    <i class="fa fa-fw fa-check"></i>
+                                                }
+                                            </td>
+                                            <td>
+                                                @if (permission.CanEditSubjectIds.Contains(subjectId))
+                                                {
+                                                    <i class="fa fa-fw fa-check"></i>
+                                                }
+                                            </td>
+                                            <td>
+                                                @if (permission.CanRemoveSubjectIds.Contains(subjectId))
+                                                {
+                                                    <i class="fa fa-fw fa-check"></i>
+                                                }
+                                            </td>
+                                        </tr>
+                                    }
+                                </tbody>
+                            </table>
+                        }
+
+                    }
+                }
+                @if (canConfig)
+                {
+                    var permission = Model.Permission;
+                    <button id="Config_Flag_Permission_Edit" class="button small">@(permission.IsDefault() ? "Override" : "Edit") Permission</button>
+
+                    <div id="Config_Flag_Permissions" class="dialog" title="Flag Assignment Permission Override">
+                        @using (Html.BeginForm(MVC.API.DeviceFlag.Permission(Model.DeviceFlag.Id)))
+                        {
+                            @Html.AntiForgeryToken()
+                            <input type="hidden" name="IsOverride" value="true" />
+                            <div id="Config_Flag_Permissions_Inherit_Container">
+                                <label>
+                                    <input id="Config_Flag_Permissions_Inherit" type="checkbox" name="Inherit" value="true" @(permission.Inherit ? "checked" : null) /> Inherit Authorization from Authorization Roles
+                                </label>
+                            </div>
+                            <div class="tableDataContainer">
+                                <table class="tableData">
+                                    <thead>
+                                        <tr>
+                                            <th>User/Group/Role</th>
+                                            <th>View</th>
+                                            <th>Assign</th>
+                                            <th>Edit</th>
+                                            <th>Remove</th>
+                                        </tr>
+                                    </thead>
+                                    <tbody>
+                                        @{
+                                            var subjects = permission.AllSubjects();
+
+                                            foreach (var subjectId in subjects.OrderBy(s => s))
+                                            {
+                                                <tr data-subjectid="@subjectId">
+                                                    <td><i class="fa type"></i> <span>@subjectId</span><i class="fa fa-times-circle remove"></i></td>
+                                                    <td>
+                                                        <input type="checkbox" name="CanShow" value="@subjectId" @(permission.CanShowSubjectIds.Contains(subjectId) ? " checked" : null) />
+                                                    </td>
+                                                    <td>
+                                                        <input type="checkbox" name="CanAssign" value="@subjectId" @(permission.CanAssignSubjectIds.Contains(subjectId) ? " checked" : null) />
+                                                    </td>
+                                                    <td>
+                                                        <input type="checkbox" name="CanEdit" value="@subjectId" @(permission.CanEditSubjectIds.Contains(subjectId) ? " checked" : null) />
+                                                    </td>
+                                                    <td>
+                                                        <input type="checkbox" name="CanRemove" value="@subjectId" @(permission.CanRemoveSubjectIds.Contains(subjectId) ? " checked" : null) />
+                                                    </td>
+                                                </tr>
+                                            }
+                                        }
+                                    </tbody>
+                                </table>
+                            </div>
+                            <div>
+                                <input type="text" id="Config_Flag_Permissions_Subject_Input" placeholder="Search Users/Groups/Roles" data-autocompleteurl="@(Url.Action(MVC.API.System.SearchSubjects(null, includeAuthorizationRoles: true)))" />
+                                <button type="button" id="Config_Flag_Permissions_Subject_Add" class="button small" data-subjecturl="@Url.Action(MVC.API.System.Subject(null, includeAuthorizationRoles: true))">Add</button>
+                            </div>
+                        }
+                    </div>
+                    <script>
+                        $(function () {
+                            let $dialog = null;
+                            let originalSubjects = null;
+                            let originalInherit = null;
+                            $('#Config_Flag_Permission_Edit').on('click', async function () {
+                                if (!$dialog) {
+                                    $dialog = $('#Config_Flag_Permissions');
+                                    const $tbody = $dialog.find('tbody');
+                                    const $inherit = $dialog.find('#Config_Flag_Permissions_Inherit');
+                                    const $input = $dialog.find('#Config_Flag_Permissions_Subject_Input');
+                                    const $add = $dialog.find('#Config_Flag_Permissions_Subject_Add');
+
+                                    $dialog.dialog({
+                                        resizable: false,
+                                        modal: true,
+                                        autoOpen: false,
+                                        width: 550,
+                                        height: 420,
+                                        buttons: {
+                                            Cancel: function () {
+                                                $(this).dialog('close');
+                                                $tbody.html(originalSubjects);
+                                                $inherit.prop('checked', originalInherit);
+                                            },
+                                            'Remove Override': function () {
+                                                const $this = $(this);
+                                                $(this).dialog('option', 'buttons', null);
+                                                $this.find('input[name="IsOverride"]').val('false');
+                                                $this.find('form').trigger('submit');
+                                            },
+                                            'Save Changes': function () {
+                                                $(this).dialog('option', 'buttons', null);
+                                                $(this).find('form').trigger('submit');
+                                            }
+                                        }
+                                    });
+
+                                    $tbody.on('click', 'i.remove', function () {
+                                        $(this).closest('tr').remove();
+                                    });
+
+                                    $input
+                                        .autocomplete({
+                                            source: $input.attr('data-autocompleteurl'),
+                                            minLength: 2,
+                                            focus: function (e, ui) {
+                                                $input.val(ui.item.Id);
+                                                return false;
+                                            },
+                                            select: function (e, ui) {
+                                                $input.val(ui.item.Id).blur();
+                                                $add.trigger('click');
+                                                $input.val('');
+                                                return false;
+                                            }
+                                        }).data('ui-autocomplete')._renderItem = function (ul, item) {
+                                            return $("<li></li>")
+                                                .data('item.autocomplete', item)
+                                                .append('<a><strong>' + item.Name + '</strong><br>' + item.Id + ' (' + item.Type + ')</a>')
+                                                .appendTo(ul);
+                                        };
+
+                                    $add.on('click', async function () {
+                                        const value = $input.val();
+                                        if (!value) {
+                                            $input.focus();
+                                            return;
+                                        }
+                                        const existing = $tbody.find('tr').filter(function () {
+                                            return $(this).attr('data-subjectid') === value;
+                                        });
+                                        if (existing.length !== 0) {
+                                            $input.val('');
+                                            $input.focus();
+                                            return;
+                                        }
+
+                                        const body = new FormData();
+                                        body.append('id', value);
+                                        const response = await fetch($add.attr('data-subjecturl'), {
+                                            body: body,
+                                            method: 'POST'
+                                        });
+
+                                        if (!response.ok) {
+                                            alert('Unable to lookup User/Group/Role: ' + response.statusText);
+                                            $input.focus();
+                                            return;
+                                        }
+
+                                        const subject = await response.json();
+
+                                        if (!subject) {
+                                            alert('Invalid User/Group/Role');
+                                            $input.focus();
+                                            return;
+                                        }
+
+                                        const $record = $('<tr><td><i class="fa type"></i> <span></span><i class="fa fa-times-circle remove"></i></td><td><input type="checkbox" name="CanShow" checked /></td><td><input type="checkbox" name="CanAssign" checked /></td><td><input type="checkbox" name="CanEdit" checked /></td><td><input type="checkbox" name="CanRemove" checked /></td></tr>');
+                                        $record.attr('data-subjectid', subject.Id);
+                                        $record.find('span').text(subject.Name + ' ' + subject.Id);
+                                        $record.find('i.type').addClass(subject.Type === 'role' ? 'fa-lock' : subject.IsGroup ? 'fa-users' : 'fa-user');
+                                        $record.find('input').val(subject.Id);
+                                        $tbody.append($record);
+                                        $input.val('');
+                                        $input.focus();
+                                    });
+
+                                    const $records = $tbody.find('tr');
+                                    for (var i = 0; i < $records.length; i++) {
+                                        const $record = $($records[i]);
+                                        const body = new FormData();
+                                        body.append('id', $record.attr('data-subjectid'));
+                                        const response = await fetch($add.attr('data-subjecturl'), {
+                                            body: body,
+                                            method: 'POST'
+                                        });
+                                        if (response.ok) {
+                                            const subject = await response.json();
+                                            if (subject) {
+                                                $record.find('span').text(subject.Name + ' ' + subject.Id);
+                                                $record.find('i.type').addClass(subject.Type === 'role' ? 'fa-lock' : subject.IsGroup ? 'fa-users' : 'fa-user');
+                                                continue;
+                                            }
+                                        }
+                                        $record.remove();
+                                    }
+                                    originalInherit = $inherit.prop('checked');
+                                    originalSubjects = $tbody.html();
+                                    $dialog.dialog('open');
+                                } else {
+                                    $dialog.dialog('open');
+                                }
+                            });
+                        });
+                    </script>
+                }
+                <div class="info-box">
+                    <p class="fa-p">
+                        <i class="fa fa-fw fa-info-circle"></i> Flag actions are normally authorized globally by
+                        @if (Authorization.Has(Claims.DiscoAdminAccount))
+                        {
+                            <span><a href="@Url.Action(MVC.Config.AuthorizationRole.Index(null))">Authorization Roles</a>.</span>
+                        }
+                        else
+                        {
+                            <span>Authorization Roles.</span>
+                        }
+                        Overriding individual flag permissions allows for targeted authorization.
+                    </p>
+                </div>
+            </td>
+        </tr>
         <tr class="Config_HideAdvanced_Item">
             <th>
                 On Assignment<br />Expression:

Disco.Web/Areas/Config/Views/UserFlag/Show.cshtml

@@ -15,6 +15,7 @@
     var canExportAll = Model.TotalAssignmentCount > 0 && Authorization.Has(Claims.Config.UserFlag.Export);
 
     var hideAdvanced =
+        Model.Permission.IsDefault() &&
         Model.UserFlag.UserDevicesLinkedGroup == null &&
         Model.UserFlag.UsersLinkedGroup == null &&
         Model.UserFlag.OnAssignmentExpression == null &&
@@ -229,6 +230,340 @@
                 </td>
             </tr>
         }
+        <tr class="Config_HideAdvanced_Item">
+            <th>
+                Assignment Permission<br />
+                Override:
+            </th>
+            <td>
+                @if (!Model.Permission.IsDefault())
+                {
+                    var permission = Model.Permission;
+                    <div>
+                        @if (permission.Inherit)
+                        {
+                            <span><i class="fa fa-check-square-o"></i> Inheriting from Authorization Roles</span>
+                        }
+                        else
+                        {
+                            <span><i class="fa fa-square-o"></i> Authorization Roles are Ignored</span>
+                        }
+                    </div>
+                    if (!permission.HasSubjects())
+                    {
+                        <span class="smallMessage">There are no users/groups associated with this permission override</span>
+                    }
+                    else
+                    {
+                        if (permission.IsSimple())
+                        {
+                            <table class="tableData">
+                                <thead>
+                                    <tr>
+                                        <th>Users/Groups/Roles</th>
+                                    </tr>
+                                </thead>
+                                <tbody>
+                                    @foreach (var subjectId in permission.CanShowSubjectIds)
+                                    {
+                                        <tr>
+                                            <td>
+                                                @{
+                                                    int roleId;
+                                                    if (subjectId.StartsWith("[") && int.TryParse(subjectId.Trim('[', ']'), out roleId))
+                                                    {
+                                                        <span>@Disco.Services.Users.UserService.GetAuthorizationRoleName(roleId) @subjectId</span>
+                                                    }
+                                                    else
+                                                    {
+                                                        <span>@subjectId</span>
+                                                    }
+                                                }
+                                            </td>
+                                        </tr>
+                                    }
+                                </tbody>
+                            </table>
+                            <div class="info-box">
+                                <p class="fa-p">
+                                    <i class="fa fa-fw fa-info-circle"></i> All users/groups/roles can view, assign, edit assignments, and remove assignments for this flag.
+                                </p>
+                            </div>
+                        }
+                        else
+                        {
+                            var subjects = permission.AllSubjects();
+                            <table class="tableData">
+                                <thead>
+                                    <tr>
+                                        <th>Users/Groups/Roles</th>
+                                        <th>View</th>
+                                        <th>Assign</th>
+                                        <th>Edit</th>
+                                        <th>Remove</th>
+                                    </tr>
+                                </thead>
+                                <tbody>
+                                    @foreach (var subjectId in subjects.OrderBy(s => s))
+                                    {
+                                        <tr>
+                                            <td>
+                                                <i class="fa"></i> @{
+                                                    int roleId;
+                                                    if (subjectId.StartsWith("[") && int.TryParse(subjectId.Trim('[', ']'), out roleId))
+                                                    {
+                                                        <span>@Disco.Services.Users.UserService.GetAuthorizationRoleName(roleId) @subjectId</span>
+                                                    }
+                                                    else
+                                                    {
+                                                        <span>@subjectId</span>
+                                                    }
+                                                }
+                                            </td>
+                                            <td>
+                                                @if (permission.CanShowSubjectIds.Contains(subjectId))
+                                                {
+                                                    <i class="fa fa-fw fa-check"></i>
+                                                }
+                                            </td>
+                                            <td>
+                                                @if (permission.CanAssignSubjectIds.Contains(subjectId))
+                                                {
+                                                    <i class="fa fa-fw fa-check"></i>
+                                                }
+                                            </td>
+                                            <td>
+                                                @if (permission.CanEditSubjectIds.Contains(subjectId))
+                                                {
+                                                    <i class="fa fa-fw fa-check"></i>
+                                                }
+                                            </td>
+                                            <td>
+                                                @if (permission.CanRemoveSubjectIds.Contains(subjectId))
+                                                {
+                                                    <i class="fa fa-fw fa-check"></i>
+                                                }
+                                            </td>
+                                        </tr>
+                                    }
+                                </tbody>
+                            </table>
+                        }
+
+                    }
+                }
+                @if (canConfig)
+                {
+                    var permission = Model.Permission;
+                    <button id="Config_Flag_Permission_Edit" class="button small">@(permission.IsDefault() ? "Override" : "Edit") Permission</button>
+
+                    <div id="Config_Flag_Permissions" class="dialog" title="Flag Assignment Permission Override">
+                        @using (Html.BeginForm(MVC.API.UserFlag.Permission(Model.UserFlag.Id)))
+                        {
+                            @Html.AntiForgeryToken()
+                            <input type="hidden" name="IsOverride" value="true" />
+                            <div id="Config_Flag_Permissions_Inherit_Container">
+                                <label>
+                                    <input id="Config_Flag_Permissions_Inherit" type="checkbox" name="Inherit" value="true" @(permission.Inherit ? "checked" : null) /> Inherit Authorization from Authorization Roles
+                                </label>
+                            </div>
+                            <div class="tableDataContainer">
+                                <table class="tableData">
+                                    <thead>
+                                        <tr>
+                                            <th>User/Group/Role</th>
+                                            <th>View</th>
+                                            <th>Assign</th>
+                                            <th>Edit</th>
+                                            <th>Remove</th>
+                                        </tr>
+                                    </thead>
+                                    <tbody>
+                                        @{
+                                            var subjects = permission.AllSubjects();
+
+                                            foreach (var subjectId in subjects.OrderBy(s => s))
+                                            {
+                                                <tr data-subjectid="@subjectId">
+                                                    <td><i class="fa type"></i> <span>@subjectId</span><i class="fa fa-times-circle remove"></i></td>
+                                                    <td>
+                                                        <input type="checkbox" name="CanShow" value="@subjectId" @(permission.CanShowSubjectIds.Contains(subjectId) ? " checked" : null) />
+                                                    </td>
+                                                    <td>
+                                                        <input type="checkbox" name="CanAssign" value="@subjectId" @(permission.CanAssignSubjectIds.Contains(subjectId) ? " checked" : null) />
+                                                    </td>
+                                                    <td>
+                                                        <input type="checkbox" name="CanEdit" value="@subjectId" @(permission.CanEditSubjectIds.Contains(subjectId) ? " checked" : null) />
+                                                    </td>
+                                                    <td>
+                                                        <input type="checkbox" name="CanRemove" value="@subjectId" @(permission.CanRemoveSubjectIds.Contains(subjectId) ? " checked" : null) />
+                                                    </td>
+                                                </tr>
+                                            }
+                                        }
+                                    </tbody>
+                                </table>
+                            </div>
+                            <div>
+                                <input type="text" id="Config_Flag_Permissions_Subject_Input" placeholder="Search Users/Groups" data-autocompleteurl="@(Url.Action(MVC.API.System.SearchSubjects(null, includeAuthorizationRoles: true)))" />
+                                <button type="button" id="Config_Flag_Permissions_Subject_Add" class="button small" data-subjecturl="@Url.Action(MVC.API.System.Subject(null, includeAuthorizationRoles: true))">Add</button>
+                            </div>
+                        }
+                    </div>
+                    <script>
+                        $(function () {
+                            let $dialog = null;
+                            let originalSubjects = null;
+                            let originalInherit = null;
+                            $('#Config_Flag_Permission_Edit').on('click', async function () {
+                                if (!$dialog) {
+                                    $dialog = $('#Config_Flag_Permissions');
+                                    const $tbody = $dialog.find('tbody');
+                                    const $inherit = $dialog.find('#Config_Flag_Permissions_Inherit');
+                                    const $input = $dialog.find('#Config_Flag_Permissions_Subject_Input');
+                                    const $add = $dialog.find('#Config_Flag_Permissions_Subject_Add');
+
+                                    $dialog.dialog({
+                                        resizable: false,
+                                        modal: true,
+                                        autoOpen: false,
+                                        width: 550,
+                                        height: 420,
+                                        buttons: {
+                                            Cancel: function () {
+                                                $(this).dialog('close');
+                                                $tbody.html(originalSubjects);
+                                                $inherit.prop('checked', originalInherit);
+                                            },
+                                            'Remove Override': function () {
+                                                const $this = $(this);
+                                                $(this).dialog('option', 'buttons', null);
+                                                $this.find('input[name="IsOverride"]').val('false');
+                                                $this.find('form').trigger('submit');
+                                            },
+                                            'Save Changes': function () {
+                                                $(this).dialog('option', 'buttons', null);
+                                                $(this).find('form').trigger('submit');
+                                            }
+                                        }
+                                    });
+
+                                    $tbody.on('click', 'i.remove', function () {
+                                        $(this).closest('tr').remove();
+                                    });
+
+                                    $input
+                                        .autocomplete({
+                                            source: $input.attr('data-autocompleteurl'),
+                                            minLength: 2,
+                                            focus: function (e, ui) {
+                                                $input.val(ui.item.Id);
+                                                return false;
+                                            },
+                                            select: function (e, ui) {
+                                                $input.val(ui.item.Id).blur();
+                                                $add.trigger('click');
+                                                $input.val('');
+                                                return false;
+                                            }
+                                        }).data('ui-autocomplete')._renderItem = function (ul, item) {
+                                            return $("<li></li>")
+                                                .data('item.autocomplete', item)
+                                                .append('<a><strong>' + item.Name + '</strong><br>' + item.Id + ' (' + item.Type + ')</a>')
+                                                .appendTo(ul);
+                                        };
+
+                                    $add.on('click', async function () {
+                                        const value = $input.val();
+                                        if (!value) {
+                                            $input.focus();
+                                            return;
+                                        }
+                                        const existing = $tbody.find('tr').filter(function () {
+                                            return $(this).attr('data-subjectid') === value;
+                                        });
+                                        if (existing.length !== 0) {
+                                            $input.val('');
+                                            $input.focus();
+                                            return;
+                                        }
+
+                                        const body = new FormData();
+                                        body.append('id', value);
+                                        const response = await fetch($add.attr('data-subjecturl'), {
+                                            body: body,
+                                            method: 'POST'
+                                        });
+
+                                        if (!response.ok) {
+                                            alert('Unable to lookup User/Group/Role: ' + response.statusText);
+                                            $input.focus();
+                                            return;
+                                        }
+
+                                        const subject = await response.json();
+
+                                        if (!subject) {
+                                            alert('Invalid User/Group');
+                                            $input.focus();
+                                            return;
+                                        }
+
+                                        const $record = $('<tr><td><i class="fa type"></i> <span></span><i class="fa fa-times-circle remove"></i></td><td><input type="checkbox" name="CanShow" checked /></td><td><input type="checkbox" name="CanAssign" checked /></td><td><input type="checkbox" name="CanEdit" checked /></td><td><input type="checkbox" name="CanRemove" checked /></td></tr>');
+                                        $record.attr('data-subjectid', subject.Id);
+                                        $record.find('span').text(subject.Name + ' ' + subject.Id);
+                                        $record.find('i.type').addClass(subject.Type === 'role' ? 'fa-lock' : subject.IsGroup ? 'fa-users' : 'fa-user');
+                                        $record.find('input').val(subject.Id);
+                                        $tbody.append($record);
+                                        $input.val('');
+                                        $input.focus();
+                                    });
+
+                                    const $records = $tbody.find('tr');
+                                    for (var i = 0; i < $records.length; i++) {
+                                        const $record = $($records[i]);
+                                        const body = new FormData();
+                                        body.append('id', $record.attr('data-subjectid'));
+                                        const response = await fetch($add.attr('data-subjecturl'), {
+                                            body: body,
+                                            method: 'POST'
+                                        });
+                                        if (response.ok) {
+                                            const subject = await response.json();
+                                            if (subject) {
+                                                $record.find('span').text(subject.Name + ' ' + subject.Id);
+                                                $record.find('i.type').addClass(subject.Type === 'role' ? 'fa-lock' : subject.IsGroup ? 'fa-users' : 'fa-user');
+                                                continue;
+                                            }
+                                        }
+                                        $record.remove();
+                                    }
+                                    originalInherit = $inherit.prop('checked');
+                                    originalSubjects = $tbody.html();
+                                    $dialog.dialog('open');
+                                } else {
+                                    $dialog.dialog('open');
+                                }
+                            });
+                        });
+                    </script>
+                }
+                <div class="info-box">
+                    <p class="fa-p">
+                        <i class="fa fa-fw fa-info-circle"></i> Flag actions are normally authorized globally by
+                        @if (Authorization.Has(Claims.DiscoAdminAccount))
+                        {
+                            <span><a href="@Url.Action(MVC.Config.AuthorizationRole.Index(null))">Authorization Roles</a>.</span>
+                        }
+                        else
+                        {
+                            <span>Authorization Roles.</span>
+                        }
+                        Overriding individual flag permissions allows for targeted authorization.
+                    </p>
+                </div>
+            </td>
+        </tr>
         <tr class="Config_HideAdvanced_Item">
             <th>
                 On Assignment<br />Expression:
@@ -369,7 +704,6 @@
                 </div>
             </td>
         </tr>
-
         <tr class="Config_HideAdvanced_Item">
             <th>
                 Linked Groups:
@@ -605,4 +939,4 @@
             @Html.ActionLinkButton(string.Format("Show {0} user{1}", Model.CurrentAssignmentCount, (Model.CurrentAssignmentCount == 1 ? null : "s")), MVC.Search.Query(Model.UserFlag.Id.ToString(), "UserFlag"), "Config_UserFlags_Actions_ShowUsers_Button")
         }
     </div>
-}
+}

Disco.Web/ClientSource/Style/Config.css

@@ -1960,6 +1960,23 @@ h1.Config_DocumentTemplates {
 #Config_DeviceFlags_BulkAssign_AssignDialog.loading > form {
   display: none;
 }
+#Config_Flag_Permissions #Config_Flag_Permissions_Inherit_Container {
+  margin: 5px 0;
+}
+#Config_Flag_Permissions .tableDataContainer {
+  min-height: 260px;
+}
+#Config_Flag_Permissions .tableDataContainer td i.remove {
+  float: right;
+  cursor: pointer;
+  visibility: hidden;
+  color: #e51400;
+  font-size: 1.4em;
+  opacity: 0.8;
+}
+#Config_Flag_Permissions .tableDataContainer td:hover i.remove {
+  visibility: visible;
+}
 #DocumentTemplate_BulkGenerate .actions {
   padding-bottom: 0.5em;
   text-align: right;

Disco.Web/ClientSource/Style/Config.less

@@ -2354,6 +2354,33 @@ h1.Config_DocumentTemplates {
     }
 }
 
+#Config_Flag_Permissions {
+    #Config_Flag_Permissions_Inherit_Container {
+        margin: 5px 0;
+    }
+
+    .tableDataContainer {
+        min-height: 260px;
+
+        td {
+            i.remove {
+                float: right;
+                cursor: pointer;
+                visibility: hidden;
+                color: @StatusRemove;
+                font-size: 1.4em;
+                opacity: .8;
+            }
+        }
+
+        td:hover {
+            i.remove {
+                visibility: visible;
+            }
+        }
+    }
+}
+
 #DocumentTemplate_BulkGenerate {
     .actions {
         padding-bottom: .5em;

Disco.Web/Controllers/DeviceController.cs

@@ -235,6 +235,7 @@ namespace Disco.Web.Controllers
                 .Include(d => d.DeviceCertificates)
                 .Include(d => d.DeviceAttachments.Select(a => a.TechUser))
                 .Include(d => d.DeviceAttachments.Select(a => a.DocumentTemplate))
+                .Include(d => d.DeviceFlagAssignments.Select(a => a.DeviceFlag))
                 .Include(d => d.DeviceFlagAssignments.Select(a => a.AddedUser))
                 .Include(d => d.DeviceFlagAssignments.Select(a => a.RemovedUser))
                 .FirstOrDefault(d => d.SerialNumber == id);
@@ -311,15 +312,7 @@ namespace Disco.Web.Controllers
                 m.DeviceProfileWirelessProfileProviders = m.Device.DeviceProfile.GetWirelessProfileProviders().ToList();
             }
 
-            if (Authorization.Has(Claims.Device.ShowFlagAssignments))
-            {
-                var usedFlags = m.Device.DeviceFlagAssignments
-                    .Where(a => !a.RemovedDate.HasValue)
-                    .Select(a => a.DeviceFlagId)
-                    .Distinct().ToList();
-
-                m.AvailableDeviceFlags = DeviceFlagService.GetDeviceFlags().Where(f => !usedFlags.Contains(f.Id)).ToList();
-            }
+            m.AvailableDeviceFlags = DeviceFlagService.GetAvailableDeviceFlags(m.Device).ToList();
 
             if (Authorization.Has(Claims.User.ShowDetails))
             {

Disco.Web/Controllers/UserController.cs

@@ -61,6 +61,7 @@ namespace Disco.Web.Controllers
                 .Include(u => u.DeviceUserAssignments.Select(dua => dua.Device.DeviceDetails))
                 .Include(u => u.UserAttachments.Select(ua => ua.TechUser))
                 .Include(u => u.UserAttachments.Select(ua => ua.DocumentTemplate))
+                .Include(u => u.UserFlagAssignments.Select(ufa => ufa.UserFlag))
                 .Include(u => u.UserFlagAssignments.Select(ufa => ufa.AddedUser))
                 .Include(u => u.UserFlagAssignments.Select(ufa => ufa.RemovedUser))
                 .Include(u => u.UserDetails)
@@ -84,15 +85,7 @@ namespace Disco.Web.Controllers
                 m.Jobs.Fill(Database, Services.Searching.Search.BuildJobTableModel(Database).Where(j => j.UserId == id).OrderByDescending(j => j.Id), true);
             }
 
-            if (Authorization.Has(Claims.User.ShowFlagAssignments))
-            {
-                var usedFlags = m.User.UserFlagAssignments
-                    .Where(a => !a.RemovedDate.HasValue)
-                    .Select(a => a.UserFlagId)
-                    .Distinct().ToList();
-
-                m.AvailableUserFlags = UserFlagService.GetUserFlags().Where(f => !usedFlags.Contains(f.Id)).ToList();
-            }
+            m.AvailableUserFlags = UserFlagService.GetAvailableUserFlags(m.User).ToList();
 
             try
             {

Disco.Web/Disco.Web.csproj

@@ -227,6 +227,7 @@
     <Compile Include="Areas\API\Models\Job\DeviceHeldLocationModel.cs" />
     <Compile Include="Areas\API\Models\Shared\SubjectDescriptorModel.cs" />
     <Compile Include="Areas\API\Models\System\DomainOrganisationalUnitsModel.cs" />
+    <Compile Include="Areas\API\Models\Shared\FlagPermissionModel.cs" />
     <Compile Include="Areas\API\Views\_ViewStart.generated.cs">
       <DependentUpon>_ViewStart.cshtml</DependentUpon>
       <AutoGen>True</AutoGen>

Disco.Web/Extensions/T4MVC/API.DeviceFlagAssignmentController.generated.cs

@@ -143,8 +143,8 @@ namespace Disco.Web.Areas.API.Controllers
         public class ActionParamsClass_AddDevice
         {
             public readonly string id = "id";
-            public readonly string DeviceSerialNumber = "DeviceSerialNumber";
-            public readonly string Comments = "Comments";
+            public readonly string deviceSerialNumber = "deviceSerialNumber";
+            public readonly string comments = "comments";
         }
         static readonly ActionParamsClass_RemoveDevice s_params_RemoveDevice = new ActionParamsClass_RemoveDevice();
         [GeneratedCode("T4MVC", "2.0"), DebuggerNonUserCode]
@@ -203,16 +203,16 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [NonAction]
-        partial void AddDeviceOverride(T4MVC_System_Web_Mvc_ActionResult callInfo, int id, string DeviceSerialNumber, string Comments);
+        partial void AddDeviceOverride(T4MVC_System_Web_Mvc_ActionResult callInfo, int id, string deviceSerialNumber, string comments);
 
         [NonAction]
-        public override System.Web.Mvc.ActionResult AddDevice(int id, string DeviceSerialNumber, string Comments)
+        public override System.Web.Mvc.ActionResult AddDevice(int id, string deviceSerialNumber, string comments)
         {
             var callInfo = new T4MVC_System_Web_Mvc_ActionResult(Area, Name, ActionNames.AddDevice);
             ModelUnbinderHelpers.AddRouteValues(callInfo.RouteValueDictionary, "id", id);
-            ModelUnbinderHelpers.AddRouteValues(callInfo.RouteValueDictionary, "DeviceSerialNumber", DeviceSerialNumber);
-            ModelUnbinderHelpers.AddRouteValues(callInfo.RouteValueDictionary, "Comments", Comments);
-            AddDeviceOverride(callInfo, id, DeviceSerialNumber, Comments);
+            ModelUnbinderHelpers.AddRouteValues(callInfo.RouteValueDictionary, "deviceSerialNumber", deviceSerialNumber);
+            ModelUnbinderHelpers.AddRouteValues(callInfo.RouteValueDictionary, "comments", comments);
+            AddDeviceOverride(callInfo, id, deviceSerialNumber, comments);
             return callInfo;
         }
 

Disco.Web/Extensions/T4MVC/API.DeviceFlagController.generated.cs

@@ -155,6 +155,12 @@ namespace Disco.Web.Areas.API.Controllers
         {
             return new T4MVC_System_Web_Mvc_ActionResult(Area, Name, ActionNames.SaveExport);
         }
+        [NonAction]
+        [GeneratedCode("T4MVC", "2.0"), DebuggerNonUserCode]
+        public virtual System.Web.Mvc.ActionResult Permission()
+        {
+            return new T4MVC_System_Web_Mvc_ActionResult(Area, Name, ActionNames.Permission);
+        }
 
         [GeneratedCode("T4MVC", "2.0"), DebuggerNonUserCode]
         public DeviceFlagController Actions { get { return MVC.API.DeviceFlag; } }
@@ -187,6 +193,7 @@ namespace Disco.Web.Areas.API.Controllers
             public readonly string Export = "Export";
             public readonly string ExportRetrieve = "ExportRetrieve";
             public readonly string SaveExport = "SaveExport";
+            public readonly string Permission = "Permission";
         }
 
         [GeneratedCode("T4MVC", "2.0"), DebuggerNonUserCode]
@@ -208,6 +215,7 @@ namespace Disco.Web.Areas.API.Controllers
             public const string Export = "Export";
             public const string ExportRetrieve = "ExportRetrieve";
             public const string SaveExport = "SaveExport";
+            public const string Permission = "Permission";
         }
 
 
@@ -367,6 +375,15 @@ namespace Disco.Web.Areas.API.Controllers
         {
             public readonly string model = "model";
         }
+        static readonly ActionParamsClass_Permission s_params_Permission = new ActionParamsClass_Permission();
+        [GeneratedCode("T4MVC", "2.0"), DebuggerNonUserCode]
+        public ActionParamsClass_Permission PermissionParams { get { return s_params_Permission; } }
+        [GeneratedCode("T4MVC", "2.0"), DebuggerNonUserCode]
+        public class ActionParamsClass_Permission
+        {
+            public readonly string id = "id";
+            public readonly string model = "model";
+        }
         static readonly ViewsClass s_views = new ViewsClass();
         [GeneratedCode("T4MVC", "2.0"), DebuggerNonUserCode]
         public ViewsClass Views { get { return s_views; } }
@@ -606,6 +623,19 @@ namespace Disco.Web.Areas.API.Controllers
             return callInfo;
         }
 
+        [NonAction]
+        partial void PermissionOverride(T4MVC_System_Web_Mvc_ActionResult callInfo, int id, Disco.Web.Areas.API.Models.Shared.FlagPermissionModel model);
+
+        [NonAction]
+        public override System.Web.Mvc.ActionResult Permission(int id, Disco.Web.Areas.API.Models.Shared.FlagPermissionModel model)
+        {
+            var callInfo = new T4MVC_System_Web_Mvc_ActionResult(Area, Name, ActionNames.Permission);
+            ModelUnbinderHelpers.AddRouteValues(callInfo.RouteValueDictionary, "id", id);
+            ModelUnbinderHelpers.AddRouteValues(callInfo.RouteValueDictionary, "model", model);
+            PermissionOverride(callInfo, id, model);
+            return callInfo;
+        }
+
     }
 }
 

Disco.Web/Extensions/T4MVC/API.SystemController.generated.cs

@@ -308,6 +308,7 @@ namespace Disco.Web.Areas.API.Controllers
         public class ActionParamsClass_SearchSubjects
         {
             public readonly string term = "term";
+            public readonly string includeAuthorizationRoles = "includeAuthorizationRoles";
         }
         static readonly ActionParamsClass_SearchGroupSubjects s_params_SearchGroupSubjects = new ActionParamsClass_SearchGroupSubjects();
         [GeneratedCode("T4MVC", "2.0"), DebuggerNonUserCode]
@@ -324,6 +325,7 @@ namespace Disco.Web.Areas.API.Controllers
         public class ActionParamsClass_Subject
         {
             public readonly string Id = "Id";
+            public readonly string includeAuthorizationRoles = "includeAuthorizationRoles";
         }
         static readonly ActionParamsClass_SyncActiveDirectoryManagedGroup s_params_SyncActiveDirectoryManagedGroup = new ActionParamsClass_SyncActiveDirectoryManagedGroup();
         [GeneratedCode("T4MVC", "2.0"), DebuggerNonUserCode]
@@ -587,14 +589,15 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [NonAction]
-        partial void SearchSubjectsOverride(T4MVC_System_Web_Mvc_ActionResult callInfo, string term);
+        partial void SearchSubjectsOverride(T4MVC_System_Web_Mvc_ActionResult callInfo, string term, bool includeAuthorizationRoles);
 
         [NonAction]
-        public override System.Web.Mvc.ActionResult SearchSubjects(string term)
+        public override System.Web.Mvc.ActionResult SearchSubjects(string term, bool includeAuthorizationRoles)
         {
             var callInfo = new T4MVC_System_Web_Mvc_ActionResult(Area, Name, ActionNames.SearchSubjects);
             ModelUnbinderHelpers.AddRouteValues(callInfo.RouteValueDictionary, "term", term);
-            SearchSubjectsOverride(callInfo, term);
+            ModelUnbinderHelpers.AddRouteValues(callInfo.RouteValueDictionary, "includeAuthorizationRoles", includeAuthorizationRoles);
+            SearchSubjectsOverride(callInfo, term, includeAuthorizationRoles);
             return callInfo;
         }
 
@@ -611,14 +614,15 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [NonAction]
-        partial void SubjectOverride(T4MVC_System_Web_Mvc_ActionResult callInfo, string Id);
+        partial void SubjectOverride(T4MVC_System_Web_Mvc_ActionResult callInfo, string Id, bool includeAuthorizationRoles);
 
         [NonAction]
-        public override System.Web.Mvc.ActionResult Subject(string Id)
+        public override System.Web.Mvc.ActionResult Subject(string Id, bool includeAuthorizationRoles)
         {
             var callInfo = new T4MVC_System_Web_Mvc_ActionResult(Area, Name, ActionNames.Subject);
             ModelUnbinderHelpers.AddRouteValues(callInfo.RouteValueDictionary, "Id", Id);
-            SubjectOverride(callInfo, Id);
+            ModelUnbinderHelpers.AddRouteValues(callInfo.RouteValueDictionary, "includeAuthorizationRoles", includeAuthorizationRoles);
+            SubjectOverride(callInfo, Id, includeAuthorizationRoles);
             return callInfo;
         }
 

Disco.Web/Extensions/T4MVC/API.UserFlagController.generated.cs

@@ -155,6 +155,12 @@ namespace Disco.Web.Areas.API.Controllers
         {
             return new T4MVC_System_Web_Mvc_ActionResult(Area, Name, ActionNames.SaveExport);
         }
+        [NonAction]
+        [GeneratedCode("T4MVC", "2.0"), DebuggerNonUserCode]
+        public virtual System.Web.Mvc.ActionResult Permission()
+        {
+            return new T4MVC_System_Web_Mvc_ActionResult(Area, Name, ActionNames.Permission);
+        }
 
         [GeneratedCode("T4MVC", "2.0"), DebuggerNonUserCode]
         public UserFlagController Actions { get { return MVC.API.UserFlag; } }
@@ -187,6 +193,7 @@ namespace Disco.Web.Areas.API.Controllers
             public readonly string Export = "Export";
             public readonly string ExportRetrieve = "ExportRetrieve";
             public readonly string SaveExport = "SaveExport";
+            public readonly string Permission = "Permission";
         }
 
         [GeneratedCode("T4MVC", "2.0"), DebuggerNonUserCode]
@@ -208,6 +215,7 @@ namespace Disco.Web.Areas.API.Controllers
             public const string Export = "Export";
             public const string ExportRetrieve = "ExportRetrieve";
             public const string SaveExport = "SaveExport";
+            public const string Permission = "Permission";
         }
 
 
@@ -367,6 +375,15 @@ namespace Disco.Web.Areas.API.Controllers
         {
             public readonly string model = "model";
         }
+        static readonly ActionParamsClass_Permission s_params_Permission = new ActionParamsClass_Permission();
+        [GeneratedCode("T4MVC", "2.0"), DebuggerNonUserCode]
+        public ActionParamsClass_Permission PermissionParams { get { return s_params_Permission; } }
+        [GeneratedCode("T4MVC", "2.0"), DebuggerNonUserCode]
+        public class ActionParamsClass_Permission
+        {
+            public readonly string id = "id";
+            public readonly string model = "model";
+        }
         static readonly ViewsClass s_views = new ViewsClass();
         [GeneratedCode("T4MVC", "2.0"), DebuggerNonUserCode]
         public ViewsClass Views { get { return s_views; } }
@@ -606,6 +623,19 @@ namespace Disco.Web.Areas.API.Controllers
             return callInfo;
         }
 
+        [NonAction]
+        partial void PermissionOverride(T4MVC_System_Web_Mvc_ActionResult callInfo, int id, Disco.Web.Areas.API.Models.Shared.FlagPermissionModel model);
+
+        [NonAction]
+        public override System.Web.Mvc.ActionResult Permission(int id, Disco.Web.Areas.API.Models.Shared.FlagPermissionModel model)
+        {
+            var callInfo = new T4MVC_System_Web_Mvc_ActionResult(Area, Name, ActionNames.Permission);
+            ModelUnbinderHelpers.AddRouteValues(callInfo.RouteValueDictionary, "id", id);
+            ModelUnbinderHelpers.AddRouteValues(callInfo.RouteValueDictionary, "model", model);
+            PermissionOverride(callInfo, id, model);
+            return callInfo;
+        }
+
     }
 }
 

Disco.Web/Views/Device/DeviceParts/_Flags.cshtml

@@ -1,15 +1,8 @@
 @model Disco.Web.Models.Device.ShowModel
 @using Disco.Services.Devices.DeviceFlags;
 @{
-    Authorization.Require(Claims.Device.ShowFlagAssignments);
-
-    var hasRemove = Authorization.Has(Claims.Device.Actions.RemoveFlags);
-    var hasEdit = Authorization.Has(Claims.Device.Actions.EditFlags);
-
-    var hasDeviceFlagShow = Authorization.Has(Claims.Config.DeviceFlag.Show);
-    var activeAssignmentCount = Model.Device.DeviceFlagAssignments == null ? 0 : Model.Device.DeviceFlagAssignments.Count(a => !a.RemovedDate.HasValue);
-
-    var flagAssignments = Model.Device.DeviceFlagAssignments.Select(a => Tuple.Create(a, DeviceFlagService.GetDeviceFlag(a.DeviceFlagId))).ToList();
+    var flagAssignments = Model.Device.DeviceFlagAssignments.Select(a => Tuple.Create(a, DeviceFlagService.GetDeviceFlag(a.DeviceFlagId))).Where(a => a.Item2.permission.CanShow()).ToList();
+    var activeAssignmentCount = flagAssignments.Count(a => !a.Item1.RemovedDate.HasValue);
 }
 <div id="DeviceDetailTab-Flags" class="DevicePart">
     @if (flagAssignments.Count > 0)
@@ -25,14 +18,14 @@
             {
                 <tr data-deviceflagassignmentid="@fa.Item1.Id" data-flagassignmentaddeddate="@(fa.Item1.AddedDate.ToString("s"))" class="@(!fa.Item1.RemovedDate.HasValue ? "added" : "removed")">
                     <td class="name">
-                        <i class="fa fa-@(fa.Item2.Icon) fa-fw fa-lg d-@(fa.Item2.IconColour)"></i>
-                        @if (hasDeviceFlagShow)
+                        <i class="fa fa-@(fa.Item2.flag.Icon) fa-fw fa-lg d-@(fa.Item2.flag.IconColour)"></i>
+                        @if (Authorization.Has(Claims.Config.DeviceFlag.Show))
                         {
-                            @Html.ActionLink(fa.Item2.Name, MVC.Config.DeviceFlag.Index(fa.Item2.Id))
+                            @Html.ActionLink(fa.Item2.flag.Name, MVC.Config.DeviceFlag.Index(fa.Item2.flag.Id))
                         }
                         else
                         {
-                            @fa.Item2.Name
+                            @fa.Item2.flag.Name
                         }
                     </td>
                     <td class="added">
@@ -43,7 +36,7 @@
                         }
                     </td>
                     <td class="comments">
-                        @if (hasEdit)
+                        @if (fa.Item2.permission.CanEdit())
                         {
                             <div class="editable"><i class="fa fa-fw fa-edit" title="Edit Comments"></i></div>
                         }
@@ -77,6 +70,7 @@
         <div id="Device_Show_Flags_Actions_Remove_Dialog" class="dialog" title="Remove this flag from the device?">
             @using (Html.BeginForm(MVC.API.DeviceFlagAssignment.RemoveDevice()))
             {
+                @Html.AntiForgeryToken()
                 <input id="Device_Show_Flags_Actions_Remove_Dialog_Id" type="hidden" name="id" value="" />
                 <p>
                     <i class="fa fa-exclamation-triangle fa-lg"></i>&nbsp;Are you sure?
@@ -86,6 +80,7 @@
         <div id="Device_Show_Flags_Actions_EditComments_Dialog" class="dialog" title="Edit the Comments">
             @using (Html.BeginForm(MVC.API.DeviceFlagAssignment.UpdateComments()))
             {
+                @Html.AntiForgeryToken()
                 <input id="Device_Show_Flags_Actions_EditComments_Dialog_Id" type="hidden" name="id" value="" />
                 <input type="hidden" name="redirect" value="true" />
                 <h4>Comments:</h4>

Disco.Web/Views/Device/DeviceParts/_Flags.generated.cs

@@ -52,15 +52,8 @@ namespace Disco.Web.Views.Device.DeviceParts
             
             #line 3 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
   
-    Authorization.Require(Claims.Device.ShowFlagAssignments);
-
-    var hasRemove = Authorization.Has(Claims.Device.Actions.RemoveFlags);
-    var hasEdit = Authorization.Has(Claims.Device.Actions.EditFlags);
-
-    var hasDeviceFlagShow = Authorization.Has(Claims.Config.DeviceFlag.Show);
-    var activeAssignmentCount = Model.Device.DeviceFlagAssignments == null ? 0 : Model.Device.DeviceFlagAssignments.Count(a => !a.RemovedDate.HasValue);
-
-    var flagAssignments = Model.Device.DeviceFlagAssignments.Select(a => Tuple.Create(a, DeviceFlagService.GetDeviceFlag(a.DeviceFlagId))).ToList();
+    var flagAssignments = Model.Device.DeviceFlagAssignments.Select(a => Tuple.Create(a, DeviceFlagService.GetDeviceFlag(a.DeviceFlagId))).Where(a => a.Item2.permission.CanShow()).ToList();
+    var activeAssignmentCount = flagAssignments.Count(a => !a.Item1.RemovedDate.HasValue);
 
             
             #line default
@@ -74,13 +67,13 @@ WriteLiteral(" class=\"DevicePart\"");
 WriteLiteral(">\r\n");
 
             
-            #line 15 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+            #line 8 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
     
             
             #line default
             #line hidden
             
-            #line 15 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+            #line 8 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
      if (flagAssignments.Count > 0)
     {
 
@@ -110,13 +103,13 @@ WriteLiteral(" class=\"removed\"");
 WriteLiteral(">Removed</th>\r\n            </tr>\r\n");
 
             
-            #line 24 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+            #line 17 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
             
             
             #line default
             #line hidden
             
-            #line 24 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+            #line 17 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
              foreach (var fa in flagAssignments.OrderByDescending(a => a.Item1.AddedDate))
             {
 
@@ -128,7 +121,7 @@ WriteLiteral("                <tr");
 WriteLiteral(" data-deviceflagassignmentid=\"");
 
             
-            #line 26 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+            #line 19 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
                                             Write(fa.Item1.Id);
 
             
@@ -139,7 +132,7 @@ WriteLiteral("\"");
 WriteLiteral(" data-flagassignmentaddeddate=\"");
 
             
-            #line 26 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+            #line 19 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
                                                                                          Write(fa.Item1.AddedDate.ToString("s"));
 
             
@@ -147,14 +140,14 @@ WriteLiteral(" data-flagassignmentaddeddate=\"");
             #line hidden
 WriteLiteral("\"");
 
-WriteAttribute("class", Tuple.Create(" class=\"", 1282), Tuple.Create("\"", 1345)
+WriteAttribute("class", Tuple.Create(" class=\"", 967), Tuple.Create("\"", 1030)
             
-            #line 26 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
-                                                          , Tuple.Create(Tuple.Create("", 1290), Tuple.Create<System.Object, System.Int32>(!fa.Item1.RemovedDate.HasValue ? "added" : "removed"
+            #line 19 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+                                                           , Tuple.Create(Tuple.Create("", 975), Tuple.Create<System.Object, System.Int32>(!fa.Item1.RemovedDate.HasValue ? "added" : "removed"
             
             #line default
             #line hidden
-, 1290), false)
+, 975), false)
 );
 
 WriteLiteral(">\r\n                    <td");
@@ -163,54 +156,54 @@ WriteLiteral(" class=\"name\"");
 
 WriteLiteral(">\r\n                        <i");
 
-WriteAttribute("class", Tuple.Create(" class=\"", 1414), Tuple.Create("\"", 1481)
-, Tuple.Create(Tuple.Create("", 1422), Tuple.Create("fa", 1422), true)
-, Tuple.Create(Tuple.Create(" ", 1424), Tuple.Create("fa-", 1425), true)
+WriteAttribute("class", Tuple.Create(" class=\"", 1099), Tuple.Create("\"", 1176)
+, Tuple.Create(Tuple.Create("", 1107), Tuple.Create("fa", 1107), true)
+, Tuple.Create(Tuple.Create(" ", 1109), Tuple.Create("fa-", 1110), true)
             
-            #line 28 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
-, Tuple.Create(Tuple.Create("", 1428), Tuple.Create<System.Object, System.Int32>(fa.Item2.Icon
+            #line 21 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+, Tuple.Create(Tuple.Create("", 1113), Tuple.Create<System.Object, System.Int32>(fa.Item2.flag.Icon
             
             #line default
             #line hidden
-, 1428), false)
-, Tuple.Create(Tuple.Create(" ", 1444), Tuple.Create("fa-fw", 1445), true)
-, Tuple.Create(Tuple.Create(" ", 1450), Tuple.Create("fa-lg", 1451), true)
-, Tuple.Create(Tuple.Create(" ", 1456), Tuple.Create("d-", 1457), true)
+, 1113), false)
+, Tuple.Create(Tuple.Create(" ", 1134), Tuple.Create("fa-fw", 1135), true)
+, Tuple.Create(Tuple.Create(" ", 1140), Tuple.Create("fa-lg", 1141), true)
+, Tuple.Create(Tuple.Create(" ", 1146), Tuple.Create("d-", 1147), true)
             
-            #line 28 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
-, Tuple.Create(Tuple.Create("", 1459), Tuple.Create<System.Object, System.Int32>(fa.Item2.IconColour
+            #line 21 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+, Tuple.Create(Tuple.Create("", 1149), Tuple.Create<System.Object, System.Int32>(fa.Item2.flag.IconColour
             
             #line default
             #line hidden
-, 1459), false)
+, 1149), false)
 );
 
 WriteLiteral("></i>\r\n");
 
             
-            #line 29 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+            #line 22 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
                         
             
             #line default
             #line hidden
             
-            #line 29 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
-                         if (hasDeviceFlagShow)
+            #line 22 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+                         if (Authorization.Has(Claims.Config.DeviceFlag.Show))
                         {
                             
             
             #line default
             #line hidden
             
-            #line 31 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
-                       Write(Html.ActionLink(fa.Item2.Name, MVC.Config.DeviceFlag.Index(fa.Item2.Id)));
+            #line 24 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+                       Write(Html.ActionLink(fa.Item2.flag.Name, MVC.Config.DeviceFlag.Index(fa.Item2.flag.Id)));
 
             
             #line default
             #line hidden
             
-            #line 31 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
-                                                                                                     
+            #line 24 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+                                                                                                               
                         }
                         else
                         {
@@ -219,15 +212,15 @@ WriteLiteral("></i>\r\n");
             #line default
             #line hidden
             
-            #line 35 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
-                       Write(fa.Item2.Name);
+            #line 28 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+                       Write(fa.Item2.flag.Name);
 
             
             #line default
             #line hidden
             
-            #line 35 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
-                                          
+            #line 28 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+                                               
                         }
 
             
@@ -242,7 +235,7 @@ WriteLiteral(">\r\n");
 WriteLiteral("                        ");
 
             
-            #line 39 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+            #line 32 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
                    Write(CommonHelpers.FriendlyDateAndUser(fa.Item1.AddedDate, fa.Item1.AddedUser));
 
             
@@ -251,13 +244,13 @@ WriteLiteral("                        ");
 WriteLiteral("\r\n");
 
             
-            #line 40 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+            #line 33 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
                         
             
             #line default
             #line hidden
             
-            #line 40 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+            #line 33 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
                          if (fa.Item1.OnAssignmentExpressionResult != null)
                         {
 
@@ -271,7 +264,7 @@ WriteLiteral(" class=\"expressionResult\"");
 WriteLiteral(">");
 
             
-            #line 42 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+            #line 35 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
                                                      Write(fa.Item1.OnAssignmentExpressionResult);
 
             
@@ -280,7 +273,7 @@ WriteLiteral(">");
 WriteLiteral("</div>\r\n");
 
             
-            #line 43 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+            #line 36 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
                         }
 
             
@@ -293,14 +286,14 @@ WriteLiteral(" class=\"comments\"");
 WriteLiteral(">\r\n");
 
             
-            #line 46 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+            #line 39 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
                         
             
             #line default
             #line hidden
             
-            #line 46 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
-                         if (hasEdit)
+            #line 39 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+                         if (fa.Item2.permission.CanEdit())
                         {
 
             
@@ -319,7 +312,7 @@ WriteLiteral(" title=\"Edit Comments\"");
 WriteLiteral("></i></div>\r\n");
 
             
-            #line 49 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+            #line 42 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
                         }
 
             
@@ -328,7 +321,7 @@ WriteLiteral("></i></div>\r\n");
 WriteLiteral("                        ");
 
             
-            #line 50 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+            #line 43 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
                          if (fa.Item1.Comments == null)
                         {
 
@@ -342,7 +335,7 @@ WriteLiteral(" class=\"comments smallMessage\"");
 WriteLiteral(">[no comments]</div>\r\n");
 
             
-            #line 53 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+            #line 46 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
                         }
                         else
                         {
@@ -357,7 +350,7 @@ WriteLiteral(" class=\"comments\"");
 WriteLiteral(">");
 
             
-            #line 56 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+            #line 49 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
                                              Write(fa.Item1.Comments.ToHtmlComment());
 
             
@@ -372,7 +365,7 @@ WriteLiteral(" class=\"commentsRaw\"");
 WriteLiteral(">");
 
             
-            #line 57 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+            #line 50 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
                                                 Write(fa.Item1.Comments);
 
             
@@ -381,7 +374,7 @@ WriteLiteral(">");
 WriteLiteral("</div>\r\n");
 
             
-            #line 58 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+            #line 51 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
                         }
 
             
@@ -389,27 +382,27 @@ WriteLiteral("</div>\r\n");
             #line hidden
 WriteLiteral("                    </td>\r\n                    <td");
 
-WriteAttribute("class", Tuple.Create(" class=\"", 3000), Tuple.Create("\"", 3063)
-, Tuple.Create(Tuple.Create("", 3008), Tuple.Create("removed", 3008), true)
+WriteAttribute("class", Tuple.Create(" class=\"", 2763), Tuple.Create("\"", 2826)
+, Tuple.Create(Tuple.Create("", 2771), Tuple.Create("removed", 2771), true)
             
-            #line 60 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
-, Tuple.Create(Tuple.Create("", 3015), Tuple.Create<System.Object, System.Int32>(!fa.Item1.RemovedDate.HasValue ? " na" : null
+            #line 53 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+, Tuple.Create(Tuple.Create("", 2778), Tuple.Create<System.Object, System.Int32>(!fa.Item1.RemovedDate.HasValue ? " na" : null
             
             #line default
             #line hidden
-, 3015), false)
+, 2778), false)
 );
 
 WriteLiteral(">\r\n");
 
             
-            #line 61 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+            #line 54 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
                         
             
             #line default
             #line hidden
             
-            #line 61 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+            #line 54 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
                          if (fa.Item1.RemovedDate.HasValue)
                         {
                             
@@ -417,14 +410,14 @@ WriteLiteral(">\r\n");
             #line default
             #line hidden
             
-            #line 63 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+            #line 56 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
                        Write(CommonHelpers.FriendlyDateAndUser(fa.Item1.RemovedDate.Value, fa.Item1.RemovedUser));
 
             
             #line default
             #line hidden
             
-            #line 63 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+            #line 56 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
                                                                                                                 
                             if (fa.Item1.OnUnassignmentExpressionResult != null)
                             {
@@ -439,7 +432,7 @@ WriteLiteral(" class=\"expressionResult\"");
 WriteLiteral(">");
 
             
-            #line 66 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+            #line 59 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
                                                          Write(fa.Item1.OnUnassignmentExpressionResult);
 
             
@@ -448,7 +441,7 @@ WriteLiteral(">");
 WriteLiteral("</div>\r\n");
 
             
-            #line 67 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+            #line 60 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
                             }
                         }
                         else if (fa.Item1.CanRemove())
@@ -466,7 +459,7 @@ WriteLiteral(" class=\"button small remove\"");
 WriteLiteral(">Remove</a>\r\n");
 
             
-            #line 72 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+            #line 65 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
                         }
 
             
@@ -475,7 +468,7 @@ WriteLiteral(">Remove</a>\r\n");
 WriteLiteral("                    </td>\r\n                </tr>\r\n");
 
             
-            #line 75 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+            #line 68 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
             }
 
             
@@ -494,15 +487,29 @@ WriteLiteral(" title=\"Remove this flag from the device?\"");
 WriteLiteral(">\r\n");
 
             
-            #line 78 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+            #line 71 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
             
             
             #line default
             #line hidden
             
-            #line 78 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+            #line 71 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
              using (Html.BeginForm(MVC.API.DeviceFlagAssignment.RemoveDevice()))
             {
+                
+            
+            #line default
+            #line hidden
+            
+            #line 73 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+           Write(Html.AntiForgeryToken());
+
+            
+            #line default
+            #line hidden
+            
+            #line 73 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+                                        
 
             
             #line default
@@ -526,7 +533,7 @@ WriteLiteral(" class=\"fa fa-exclamation-triangle fa-lg\"");
 WriteLiteral("></i>&nbsp;Are you sure?\r\n                </p>\r\n");
 
             
-            #line 84 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+            #line 78 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
             }
 
             
@@ -545,15 +552,29 @@ WriteLiteral(" title=\"Edit the Comments\"");
 WriteLiteral(">\r\n");
 
             
-            #line 87 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+            #line 81 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
             
             
             #line default
             #line hidden
             
-            #line 87 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+            #line 81 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
              using (Html.BeginForm(MVC.API.DeviceFlagAssignment.UpdateComments()))
             {
+                
+            
+            #line default
+            #line hidden
+            
+            #line 83 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+           Write(Html.AntiForgeryToken());
+
+            
+            #line default
+            #line hidden
+            
+            #line 83 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+                                        
 
             
             #line default
@@ -593,7 +614,7 @@ WriteLiteral(" class=\"block\"");
 WriteLiteral("></textarea>\r\n                </p>\r\n");
 
             
-            #line 95 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+            #line 90 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
             }
 
             
@@ -651,7 +672,7 @@ WriteLiteral(">\r\n            $(function () {\r\n                var deviceFlag
 "eturn false;\r\n                });\r\n            });\r\n        </script>\r\n");
 
             
-            #line 174 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+            #line 169 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
     }
     else
     {
@@ -666,7 +687,7 @@ WriteLiteral(" class=\"none\"");
 WriteLiteral(">This device has no associated flags</div>\r\n");
 
             
-            #line 178 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+            #line 173 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
     }
 
             
@@ -676,7 +697,7 @@ WriteLiteral("    <script>\r\n        $(\'#DeviceDetailTabItems\').append(\'<li>
 "ilTab-Flags\">Flags [");
 
             
-            #line 180 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
+            #line 175 "..\..\Views\Device\DeviceParts\_Flags.cshtml"
                                                                                   Write(activeAssignmentCount);
 
             

Disco.Web/Views/Device/DeviceParts/_Subject.cshtml

@@ -239,17 +239,20 @@
                                                 <div id="Device_Show_User_EmailAddress" title="Email Address"><a href="mailto:@(Model.Device.AssignedUser.EmailAddress)" data-clipboard="@assignedUser.DisplayName &lt;@assignedUser.EmailAddress&gt;">@assignedUser.EmailAddress</a></div>
                                             }
                                         }
-                                        @if (Authorization.Has(Claims.User.ShowFlagAssignments))
+                                        @if (assignedUser.UserFlagAssignments.CanShowAny())
                                         {
                                             <div id="Device_Show_User_Flags">
                                                 @foreach (var flag in assignedUser.UserFlagAssignments.Where(f => !f.RemovedDate.HasValue).Select(f => Tuple.Create(f, UserFlagService.GetUserFlag(f.UserFlagId))))
                                                 {
-                                                    <i class="flag fa fa-@(flag.Item2.Icon) fa-fw d-@(flag.Item2.IconColour)">
-                                                        <span class="details">
-                                                            <span class="name">@flag.Item2.Name</span>@if (flag.Item1.Comments != null)
-                                                            {<span class="comments">@flag.Item1.Comments.ToHtmlComment()</span>}<span class="added">@CommonHelpers.FriendlyDateAndUser(flag.Item1.AddedDate, flag.Item1.AddedUserId)</span>
-                                                        </span>
-                                                    </i>
+                                                    if (flag.Item2.permission.CanShow())
+                                                    {
+                                                        <i class="flag fa fa-@(flag.Item2.flag.Icon) fa-fw d-@(flag.Item2.flag.IconColour)">
+                                                            <span class="details">
+                                                                <span class="name">@flag.Item2.flag.Name</span>@if (flag.Item1.Comments != null)
+                                                                {<span class="comments">@flag.Item1.Comments.ToHtmlComment()</span>}<span class="added">@CommonHelpers.FriendlyDateAndUser(flag.Item1.AddedDate, flag.Item1.AddedUserId)</span>
+                                                            </span>
+                                                        </i>
+                                                    }
                                                 }
                                                 <script type="text/javascript">
                                                     $(function () {
@@ -765,12 +768,13 @@
                     });
                 </script>
             }
-            @if (Model.Device.CanAddDeviceFlags() && Model.AvailableDeviceFlags != null && Model.AvailableDeviceFlags.Count > 0)
+            @if (Model.AvailableDeviceFlags != null && Model.AvailableDeviceFlags.Count > 0)
             {
-                @Html.ActionLinkSmallButton("Add Flag", MVC.API.DeviceFlagAssignment.AddDevice(), "Device_Show_Details_Actions_AddFlag_Button")
+                <button id="Device_Show_Details_Actions_AddFlag_Button" type="button" class="button small">Add Flag</button>
                 <div id="Device_Show_Details_Actions_AddFlag_Dialog" class="dialog" title="Add Device Flag">
                     @using (Html.BeginForm(MVC.API.DeviceFlagAssignment.AddDevice()))
                     {
+                        @Html.AntiForgeryToken()
                         <input id="Device_Show_Details_Actions_AddFlag_Dialog_Id" type="hidden" name="id" />
                         <input id="Device_Show_Details_Actions_AddFlag_Dialog_DeviceSerialNumber" type="hidden" name="DeviceSerialNumber" value="@Model.Device.SerialNumber" />
                         <div class="flagPicker">
@@ -794,7 +798,6 @@
                     $(function () {
                         const button = $('#Device_Show_Details_Actions_AddFlag_Button');
                         let buttonDialog = null;
-                        const buttonLink = button.attr('href');
 
                         let flagPicker = null;
                         let flagAddId = null;
@@ -814,9 +817,7 @@
                             flagAddComments.focus().select();
                         }
 
-                        button.attr('href', '#').click(function (e) {
-                            e.preventDefault();
-
+                        button.click(function (e) {
                             if (!buttonDialog) {
                                 buttonDialog = $('#Device_Show_Details_Actions_AddFlag_Dialog');
                                 buttonDialog.dialog({
@@ -831,10 +832,9 @@
                                         },
                                         "Add Flag": function () {
                                             if (!!flagAddId.val()) {
-                                                const $this = $(this);
-                                                $this.dialog("disable");
-                                                $this.dialog("option", "buttons", null);
-                                                buttonDialog.find('form').submit();
+                                                buttonDialog
+                                                    .dialog("option", "buttons", null)
+                                                    .find('form').submit();
                                             } else {
                                                 alert('Select a Device Flag');
                                             }
@@ -868,7 +868,6 @@
 
                             $('#Device_Show_Details_Actions_AddFlag_Dialog_Filter').val('');
                             buttonDialog.dialog('open');
-                            return false;
                         });
                     });
                 </script>

Disco.Web/Views/Device/Show.cshtml

@@ -19,17 +19,20 @@
             });
         </script>
     </div>
-    @if (Authorization.Has(Claims.Device.ShowFlagAssignments))
+    @if (Model.Device.DeviceFlagAssignments.CanShowAny())
     {
         <div id="Device_Show_Flags">
             @foreach (var flag in Model.Device.DeviceFlagAssignments.Where(f => !f.RemovedDate.HasValue).Select(f => Tuple.Create(f, DeviceFlagService.GetDeviceFlag(f.DeviceFlagId))))
             {
-                <i class="flag fa fa-@(flag.Item2.Icon) fa-fw fa-lg d-@(flag.Item2.IconColour)">
-                    <span class="details">
-                        <span class="name">@flag.Item2.Name</span>@if (flag.Item1.Comments != null)
-                        {<span class="comments">@flag.Item1.Comments.ToHtmlComment()</span>}<span class="added">@CommonHelpers.FriendlyDateAndUser(flag.Item1.AddedDate, flag.Item1.AddedUser)</span>
-                    </span>
-                </i>
+                if (flag.Item2.permission.CanShow())
+                {
+                    <i class="flag fa fa-@(flag.Item2.flag.Icon) fa-fw fa-lg d-@(flag.Item2.flag.IconColour)">
+                        <span class="details">
+                            <span class="name">@flag.Item2.flag.Name</span>@if (flag.Item1.Comments != null)
+                            {<span class="comments">@flag.Item1.Comments.ToHtmlComment()</span>}<span class="added">@CommonHelpers.FriendlyDateAndUser(flag.Item1.AddedDate, flag.Item1.AddedUser)</span>
+                        </span>
+                    </i>
+                }
             }
         </div>
         <script type="text/javascript">
@@ -116,7 +119,7 @@
         {
             @Html.Partial(MVC.Device.Views.DeviceParts._Resources, Model)
         }
-        @if (Authorization.Has(Claims.Device.ShowFlagAssignments))
+        @if (Authorization.Has(Claims.Device.ShowFlagAssignments) || Model.Device.DeviceFlagAssignments.CanShowAny())
         {
             @Html.Partial(MVC.Device.Views.DeviceParts._Flags, Model)
         }

Disco.Web/Views/Device/Show.generated.cs

@@ -122,7 +122,7 @@ WriteLiteral(">\r\n            $(function () {\r\n                $(\'#Device_Sh
             #line hidden
             
             #line 22 "..\..\Views\Device\Show.cshtml"
-     if (Authorization.Has(Claims.Device.ShowFlagAssignments))
+     if (Model.Device.DeviceFlagAssignments.CanShowAny())
     {
 
             
@@ -144,48 +144,50 @@ WriteLiteral(">\r\n");
             #line 25 "..\..\Views\Device\Show.cshtml"
              foreach (var flag in Model.Device.DeviceFlagAssignments.Where(f => !f.RemovedDate.HasValue).Select(f => Tuple.Create(f, DeviceFlagService.GetDeviceFlag(f.DeviceFlagId))))
             {
+                if (flag.Item2.permission.CanShow())
+                {
 
             
             #line default
             #line hidden
-WriteLiteral("                <i");
+WriteLiteral("                    <i");
 
-WriteAttribute("class", Tuple.Create(" class=\"", 1178), Tuple.Create("\"", 1254)
-, Tuple.Create(Tuple.Create("", 1186), Tuple.Create("flag", 1186), true)
-, Tuple.Create(Tuple.Create(" ", 1190), Tuple.Create("fa", 1191), true)
-, Tuple.Create(Tuple.Create(" ", 1193), Tuple.Create("fa-", 1194), true)
+WriteAttribute("class", Tuple.Create(" class=\"", 1250), Tuple.Create("\"", 1336)
+, Tuple.Create(Tuple.Create("", 1258), Tuple.Create("flag", 1258), true)
+, Tuple.Create(Tuple.Create(" ", 1262), Tuple.Create("fa", 1263), true)
+, Tuple.Create(Tuple.Create(" ", 1265), Tuple.Create("fa-", 1266), true)
             
-            #line 27 "..\..\Views\Device\Show.cshtml"
-, Tuple.Create(Tuple.Create("", 1197), Tuple.Create<System.Object, System.Int32>(flag.Item2.Icon
+            #line 29 "..\..\Views\Device\Show.cshtml"
+, Tuple.Create(Tuple.Create("", 1269), Tuple.Create<System.Object, System.Int32>(flag.Item2.flag.Icon
             
             #line default
             #line hidden
-, 1197), false)
-, Tuple.Create(Tuple.Create(" ", 1215), Tuple.Create("fa-fw", 1216), true)
-, Tuple.Create(Tuple.Create(" ", 1221), Tuple.Create("fa-lg", 1222), true)
-, Tuple.Create(Tuple.Create(" ", 1227), Tuple.Create("d-", 1228), true)
+, 1269), false)
+, Tuple.Create(Tuple.Create(" ", 1292), Tuple.Create("fa-fw", 1293), true)
+, Tuple.Create(Tuple.Create(" ", 1298), Tuple.Create("fa-lg", 1299), true)
+, Tuple.Create(Tuple.Create(" ", 1304), Tuple.Create("d-", 1305), true)
             
-            #line 27 "..\..\Views\Device\Show.cshtml"
-, Tuple.Create(Tuple.Create("", 1230), Tuple.Create<System.Object, System.Int32>(flag.Item2.IconColour
+            #line 29 "..\..\Views\Device\Show.cshtml"
+, Tuple.Create(Tuple.Create("", 1307), Tuple.Create<System.Object, System.Int32>(flag.Item2.flag.IconColour
             
             #line default
             #line hidden
-, 1230), false)
+, 1307), false)
 );
 
-WriteLiteral(">\r\n                    <span");
+WriteLiteral(">\r\n                        <span");
 
 WriteLiteral(" class=\"details\"");
 
-WriteLiteral(">\r\n                        <span");
+WriteLiteral(">\r\n                            <span");
 
 WriteLiteral(" class=\"name\"");
 
 WriteLiteral(">");
 
             
-            #line 29 "..\..\Views\Device\Show.cshtml"
-                                      Write(flag.Item2.Name);
+            #line 31 "..\..\Views\Device\Show.cshtml"
+                                          Write(flag.Item2.flag.Name);
 
             
             #line default
@@ -193,9 +195,9 @@ WriteLiteral(">");
 WriteLiteral("</span>");
 
             
-            #line 29 "..\..\Views\Device\Show.cshtml"
-                                                                   if (flag.Item1.Comments != null)
-                        {
+            #line 31 "..\..\Views\Device\Show.cshtml"
+                                                                            if (flag.Item1.Comments != null)
+                            {
             
             #line default
             #line hidden
@@ -206,8 +208,8 @@ WriteLiteral(" class=\"comments\"");
 WriteLiteral(">");
 
             
-            #line 30 "..\..\Views\Device\Show.cshtml"
-                                           Write(flag.Item1.Comments.ToHtmlComment());
+            #line 32 "..\..\Views\Device\Show.cshtml"
+                                               Write(flag.Item1.Comments.ToHtmlComment());
 
             
             #line default
@@ -215,8 +217,8 @@ WriteLiteral(">");
 WriteLiteral("</span>");
 
             
-            #line 30 "..\..\Views\Device\Show.cshtml"
-                                                                                           }
+            #line 32 "..\..\Views\Device\Show.cshtml"
+                                                                                               }
             
             #line default
             #line hidden
@@ -227,16 +229,17 @@ WriteLiteral(" class=\"added\"");
 WriteLiteral(">");
 
             
-            #line 30 "..\..\Views\Device\Show.cshtml"
-                                                                                                           Write(CommonHelpers.FriendlyDateAndUser(flag.Item1.AddedDate, flag.Item1.AddedUser));
+            #line 32 "..\..\Views\Device\Show.cshtml"
+                                                                                                               Write(CommonHelpers.FriendlyDateAndUser(flag.Item1.AddedDate, flag.Item1.AddedUser));
 
             
             #line default
             #line hidden
-WriteLiteral("</span>\r\n                    </span>\r\n                </i>\r\n");
+WriteLiteral("</span>\r\n                        </span>\r\n                    </i>\r\n");
 
             
-            #line 33 "..\..\Views\Device\Show.cshtml"
+            #line 35 "..\..\Views\Device\Show.cshtml"
+                }
             }
 
             
@@ -282,7 +285,7 @@ WriteLiteral(@">
 ");
 
             
-            #line 66 "..\..\Views\Device\Show.cshtml"
+            #line 69 "..\..\Views\Device\Show.cshtml"
     }
 
             
@@ -291,7 +294,7 @@ WriteLiteral(@">
 WriteLiteral("    ");
 
             
-            #line 67 "..\..\Views\Device\Show.cshtml"
+            #line 70 "..\..\Views\Device\Show.cshtml"
 Write(Html.Partial(MVC.Device.Views.DeviceParts._Subject, Model));
 
             
@@ -332,13 +335,13 @@ WriteLiteral(" id=\"DeviceDetailTabItems\"");
 WriteLiteral("></ul>\r\n");
 
             
-            #line 103 "..\..\Views\Device\Show.cshtml"
+            #line 106 "..\..\Views\Device\Show.cshtml"
         
             
             #line default
             #line hidden
             
-            #line 103 "..\..\Views\Device\Show.cshtml"
+            #line 106 "..\..\Views\Device\Show.cshtml"
          if (Authorization.HasAny(Claims.Device.ShowComments, Claims.Device.ShowJobs))
         {
             
@@ -346,14 +349,14 @@ WriteLiteral("></ul>\r\n");
             #line default
             #line hidden
             
-            #line 105 "..\..\Views\Device\Show.cshtml"
+            #line 108 "..\..\Views\Device\Show.cshtml"
        Write(Html.Partial(MVC.Device.Views.DeviceParts._CommentsAndJobs, Model));
 
             
             #line default
             #line hidden
             
-            #line 105 "..\..\Views\Device\Show.cshtml"
+            #line 108 "..\..\Views\Device\Show.cshtml"
                                                                                
         }
 
@@ -363,7 +366,7 @@ WriteLiteral("></ul>\r\n");
 WriteLiteral("        ");
 
             
-            #line 107 "..\..\Views\Device\Show.cshtml"
+            #line 110 "..\..\Views\Device\Show.cshtml"
          if (Authorization.Has(Claims.Device.ShowDetails))
         {
             
@@ -371,14 +374,14 @@ WriteLiteral("        ");
             #line default
             #line hidden
             
-            #line 109 "..\..\Views\Device\Show.cshtml"
+            #line 112 "..\..\Views\Device\Show.cshtml"
        Write(Html.Partial(MVC.Device.Views.DeviceParts._Details, Model));
 
             
             #line default
             #line hidden
             
-            #line 109 "..\..\Views\Device\Show.cshtml"
+            #line 112 "..\..\Views\Device\Show.cshtml"
                                                                        
         }
 
@@ -388,7 +391,7 @@ WriteLiteral("        ");
 WriteLiteral("        ");
 
             
-            #line 111 "..\..\Views\Device\Show.cshtml"
+            #line 114 "..\..\Views\Device\Show.cshtml"
          if (Authorization.Has(Claims.Device.ShowAssignmentHistory))
         {
             
@@ -396,14 +399,14 @@ WriteLiteral("        ");
             #line default
             #line hidden
             
-            #line 113 "..\..\Views\Device\Show.cshtml"
+            #line 116 "..\..\Views\Device\Show.cshtml"
        Write(Html.Partial(MVC.Device.Views.DeviceParts._AssignmentHistory, Model));
 
             
             #line default
             #line hidden
             
-            #line 113 "..\..\Views\Device\Show.cshtml"
+            #line 116 "..\..\Views\Device\Show.cshtml"
                                                                                  
         }
 
@@ -413,7 +416,7 @@ WriteLiteral("        ");
 WriteLiteral("        ");
 
             
-            #line 115 "..\..\Views\Device\Show.cshtml"
+            #line 118 "..\..\Views\Device\Show.cshtml"
          if (Authorization.Has(Claims.Device.ShowAttachments))
         {
             
@@ -421,14 +424,14 @@ WriteLiteral("        ");
             #line default
             #line hidden
             
-            #line 117 "..\..\Views\Device\Show.cshtml"
+            #line 120 "..\..\Views\Device\Show.cshtml"
        Write(Html.Partial(MVC.Device.Views.DeviceParts._Resources, Model));
 
             
             #line default
             #line hidden
             
-            #line 117 "..\..\Views\Device\Show.cshtml"
+            #line 120 "..\..\Views\Device\Show.cshtml"
                                                                          
         }
 
@@ -438,22 +441,22 @@ WriteLiteral("        ");
 WriteLiteral("        ");
 
             
-            #line 119 "..\..\Views\Device\Show.cshtml"
-         if (Authorization.Has(Claims.Device.ShowFlagAssignments))
+            #line 122 "..\..\Views\Device\Show.cshtml"
+         if (Authorization.Has(Claims.Device.ShowFlagAssignments) || Model.Device.DeviceFlagAssignments.CanShowAny())
         {
             
             
             #line default
             #line hidden
             
-            #line 121 "..\..\Views\Device\Show.cshtml"
+            #line 124 "..\..\Views\Device\Show.cshtml"
        Write(Html.Partial(MVC.Device.Views.DeviceParts._Flags, Model));
 
             
             #line default
             #line hidden
             
-            #line 121 "..\..\Views\Device\Show.cshtml"
+            #line 124 "..\..\Views\Device\Show.cshtml"
                                                                      
         }
 
@@ -463,7 +466,7 @@ WriteLiteral("        ");
 WriteLiteral("        ");
 
             
-            #line 123 "..\..\Views\Device\Show.cshtml"
+            #line 126 "..\..\Views\Device\Show.cshtml"
          if (Authorization.Has(Claims.Device.ShowCertificates))
         {
             
@@ -471,14 +474,14 @@ WriteLiteral("        ");
             #line default
             #line hidden
             
-            #line 125 "..\..\Views\Device\Show.cshtml"
+            #line 128 "..\..\Views\Device\Show.cshtml"
        Write(Html.Partial(MVC.Device.Views.DeviceParts._Certificates, Model));
 
             
             #line default
             #line hidden
             
-            #line 125 "..\..\Views\Device\Show.cshtml"
+            #line 128 "..\..\Views\Device\Show.cshtml"
                                                                             
         }
 
@@ -488,13 +491,13 @@ WriteLiteral("        ");
 WriteLiteral("    </div>\r\n");
 
             
-            #line 128 "..\..\Views\Device\Show.cshtml"
+            #line 131 "..\..\Views\Device\Show.cshtml"
     
             
             #line default
             #line hidden
             
-            #line 128 "..\..\Views\Device\Show.cshtml"
+            #line 131 "..\..\Views\Device\Show.cshtml"
      if (requiresLive)
     {
 
@@ -550,7 +553,7 @@ WriteLiteral("        <script>\r\n            $(function () {\r\n
 "     </script>\r\n");
 
             
-            #line 197 "..\..\Views\Device\Show.cshtml"
+            #line 200 "..\..\Views\Device\Show.cshtml"
     }
 
             

Disco.Web/Views/Device/_DeviceTable.cshtml

@@ -32,22 +32,22 @@
                             {@Html.ActionLink(item.Id, MVC.Device.Show(item.Id))}
                         else
                         {@item.Id}
-                            @if (Authorization.Has(Claims.Device.ShowFlagAssignments))
+                            @if (item.DeviceFlagAssignments.CanShowAny())
                             {
-                                @if (item.DeviceFlagAssignments != null && item.DeviceFlagAssignments.Count > 0)
-                                {
-                                    <div class="flags">
-                                        @foreach (var flag in item.DeviceFlagAssignments.Where(f => !f.RemovedDate.HasValue).Select(f => Tuple.Create(f, DeviceFlagService.GetDeviceFlag(f.DeviceFlagId))))
+                                <div class="flags">
+                                    @foreach (var flag in item.DeviceFlagAssignments.Where(f => !f.RemovedDate.HasValue).Select(f => Tuple.Create(f, DeviceFlagService.GetDeviceFlag(f.DeviceFlagId))))
+                                    {
+                                        @if (flag.Item2.permission.CanShow())
                                         {
-                                            <i class="flag fa fa-@(flag.Item2.Icon) fa-fw d-@(flag.Item2.IconColour)">
+                                            <i class="flag fa fa-@(flag.Item2.flag.Icon) fa-fw d-@(flag.Item2.flag.IconColour)">
                                                 <span class="details">
-                                                    <span class="name">@flag.Item2.Name</span>@if (flag.Item1.Comments != null)
+                                                    <span class="name">@flag.Item2.flag.Name</span>@if (flag.Item1.Comments != null)
                                                     {<span class="comments">@flag.Item1.Comments.ToHtmlComment()</span>}<span class="added">@CommonHelpers.FriendlyDateAndUser(flag.Item1.AddedDate, flag.Item1.AddedUserId)</span>
                                                 </span>
                                             </i>
                                         }
-                                    </div>
-                                }
+                                    }
+                                </div>
                             }
                         </td>
                         <td>
@@ -117,43 +117,43 @@
             </tbody>
         </table>
         <script type="text/javascript">
-    $(function () {
-        var userTable = $('table.deviceTable');
+            $(function () {
+                var userTable = $('table.deviceTable');
 
-        userTable.each(function () {
-            var $this = $(this);
+                userTable.each(function () {
+                    var $this = $(this);
 
-            if (!$this.data('deviceTable_Flags')) {
-                $this.tooltip({
-                    items: 'i.flag',
-                    content: function () {
-                        var $this = $(this);
-                        return $this.children('.details').html();
-                    },
-                    tooltipClass: 'FlagAssignment_Tooltip',
-                    position: {
-                        my: "right top",
-                        at: "right bottom",
-                        collision: "flipfit flip"
-                    },
-                    hade: {
-                        effect: ''
-                    },
-                    close: function (e, ui) {
-                        ui.tooltip.hover(
-                            function () {
-                                $(this).stop(true).fadeTo(100, 1);
+                    if (!$this.data('deviceTable_Flags')) {
+                        $this.tooltip({
+                            items: 'i.flag',
+                            content: function () {
+                                var $this = $(this);
+                                return $this.children('.details').html();
                             },
-                            function () {
-                                $(this).fadeOut(100, function () { $(this).remove(); });
-                            });
+                            tooltipClass: 'FlagAssignment_Tooltip',
+                            position: {
+                                my: "right top",
+                                at: "right bottom",
+                                collision: "flipfit flip"
+                            },
+                            hade: {
+                                effect: ''
+                            },
+                            close: function (e, ui) {
+                                ui.tooltip.hover(
+                                    function () {
+                                        $(this).stop(true).fadeTo(100, 1);
+                                    },
+                                    function () {
+                                        $(this).fadeOut(100, function () { $(this).remove(); });
+                                    });
+                            }
+                        });
+
+                        $this.data('deviceTable_Flags', true)
                     }
                 });
-
-                $this.data('deviceTable_Flags', true)
-            }
-        });
-    });
+            });
         </script>
     }
     else

Disco.Web/Views/Device/_DeviceTable.generated.cs

@@ -175,35 +175,35 @@ WriteLiteral("                            ");
 
             
             #line 35 "..\..\Views\Device\_DeviceTable.cshtml"
-                             if (Authorization.Has(Claims.Device.ShowFlagAssignments))
+                             if (item.DeviceFlagAssignments.CanShowAny())
                             {
-                                
-            
-            #line default
-            #line hidden
-            
-            #line 37 "..\..\Views\Device\_DeviceTable.cshtml"
-                                 if (item.DeviceFlagAssignments != null && item.DeviceFlagAssignments.Count > 0)
-                                {
 
             
             #line default
             #line hidden
-WriteLiteral("                                    <div");
+WriteLiteral("                                <div");
 
 WriteLiteral(" class=\"flags\"");
 
 WriteLiteral(">\r\n");
 
             
-            #line 40 "..\..\Views\Device\_DeviceTable.cshtml"
+            #line 38 "..\..\Views\Device\_DeviceTable.cshtml"
+                                    
+            
+            #line default
+            #line hidden
+            
+            #line 38 "..\..\Views\Device\_DeviceTable.cshtml"
+                                     foreach (var flag in item.DeviceFlagAssignments.Where(f => !f.RemovedDate.HasValue).Select(f => Tuple.Create(f, DeviceFlagService.GetDeviceFlag(f.DeviceFlagId))))
+                                    {
                                         
             
             #line default
             #line hidden
             
             #line 40 "..\..\Views\Device\_DeviceTable.cshtml"
-                                         foreach (var flag in item.DeviceFlagAssignments.Where(f => !f.RemovedDate.HasValue).Select(f => Tuple.Create(f, DeviceFlagService.GetDeviceFlag(f.DeviceFlagId))))
+                                         if (flag.Item2.permission.CanShow())
                                         {
 
             
@@ -211,26 +211,26 @@ WriteLiteral(">\r\n");
             #line hidden
 WriteLiteral("                                            <i");
 
-WriteAttribute("class", Tuple.Create(" class=\"", 1953), Tuple.Create("\"", 2023)
-, Tuple.Create(Tuple.Create("", 1961), Tuple.Create("flag", 1961), true)
-, Tuple.Create(Tuple.Create(" ", 1965), Tuple.Create("fa", 1966), true)
-, Tuple.Create(Tuple.Create(" ", 1968), Tuple.Create("fa-", 1969), true)
+WriteAttribute("class", Tuple.Create(" class=\"", 1901), Tuple.Create("\"", 1981)
+, Tuple.Create(Tuple.Create("", 1909), Tuple.Create("flag", 1909), true)
+, Tuple.Create(Tuple.Create(" ", 1913), Tuple.Create("fa", 1914), true)
+, Tuple.Create(Tuple.Create(" ", 1916), Tuple.Create("fa-", 1917), true)
             
             #line 42 "..\..\Views\Device\_DeviceTable.cshtml"
-, Tuple.Create(Tuple.Create("", 1972), Tuple.Create<System.Object, System.Int32>(flag.Item2.Icon
+, Tuple.Create(Tuple.Create("", 1920), Tuple.Create<System.Object, System.Int32>(flag.Item2.flag.Icon
             
             #line default
             #line hidden
-, 1972), false)
-, Tuple.Create(Tuple.Create(" ", 1990), Tuple.Create("fa-fw", 1991), true)
-, Tuple.Create(Tuple.Create(" ", 1996), Tuple.Create("d-", 1997), true)
+, 1920), false)
+, Tuple.Create(Tuple.Create(" ", 1943), Tuple.Create("fa-fw", 1944), true)
+, Tuple.Create(Tuple.Create(" ", 1949), Tuple.Create("d-", 1950), true)
             
             #line 42 "..\..\Views\Device\_DeviceTable.cshtml"
-             , Tuple.Create(Tuple.Create("", 1999), Tuple.Create<System.Object, System.Int32>(flag.Item2.IconColour
+                  , Tuple.Create(Tuple.Create("", 1952), Tuple.Create<System.Object, System.Int32>(flag.Item2.flag.IconColour
             
             #line default
             #line hidden
-, 1999), false)
+, 1952), false)
 );
 
 WriteLiteral(">\r\n                                                <span");
@@ -245,7 +245,7 @@ WriteLiteral(">");
 
             
             #line 44 "..\..\Views\Device\_DeviceTable.cshtml"
-                                                                  Write(flag.Item2.Name);
+                                                                  Write(flag.Item2.flag.Name);
 
             
             #line default
@@ -254,7 +254,7 @@ WriteLiteral("</span>");
 
             
             #line 44 "..\..\Views\Device\_DeviceTable.cshtml"
-                                                                                               if (flag.Item1.Comments != null)
+                                                                                                    if (flag.Item1.Comments != null)
                                                     {
             
             #line default
@@ -302,17 +302,18 @@ WriteLiteral("</span>\r\n                                                </span>
             
             #line default
             #line hidden
-WriteLiteral("\r\n                                    </div>\r\n");
-
             
-            #line 50 "..\..\Views\Device\_DeviceTable.cshtml"
-                                }
+            #line 48 "..\..\Views\Device\_DeviceTable.cshtml"
+                                         
+                                    }
+
             
             #line default
             #line hidden
+WriteLiteral("                                </div>\r\n");
+
             
-            #line 50 "..\..\Views\Device\_DeviceTable.cshtml"
-                                 
+            #line 51 "..\..\Views\Device\_DeviceTable.cshtml"
                             }
 
             
@@ -627,46 +628,27 @@ WriteLiteral("        <script");
 
 WriteLiteral(" type=\"text/javascript\"");
 
-WriteLiteral(@">
-    $(function () {
-        var userTable = $('table.deviceTable');
-
-        userTable.each(function () {
-            var $this = $(this);
-
-            if (!$this.data('deviceTable_Flags')) {
-                $this.tooltip({
-                    items: 'i.flag',
-                    content: function () {
-                        var $this = $(this);
-                        return $this.children('.details').html();
-                    },
-                    tooltipClass: 'FlagAssignment_Tooltip',
-                    position: {
-                        my: ""right top"",
-                        at: ""right bottom"",
-                        collision: ""flipfit flip""
-                    },
-                    hade: {
-                        effect: ''
-                    },
-                    close: function (e, ui) {
-                        ui.tooltip.hover(
-                            function () {
-                                $(this).stop(true).fadeTo(100, 1);
-                            },
-                            function () {
-                                $(this).fadeOut(100, function () { $(this).remove(); });
-                            });
-                    }
-                });
-
-                $this.data('deviceTable_Flags', true)
-            }
-        });
-    });
-        </script>
-");
+WriteLiteral(">\r\n            $(function () {\r\n                var userTable = $(\'table.deviceTa" +
+"ble\');\r\n\r\n                userTable.each(function () {\r\n                    var " +
+"$this = $(this);\r\n\r\n                    if (!$this.data(\'deviceTable_Flags\')) {\r" +
+"\n                        $this.tooltip({\r\n                            items: \'i." +
+"flag\',\r\n                            content: function () {\r\n                    " +
+"            var $this = $(this);\r\n                                return $this.c" +
+"hildren(\'.details\').html();\r\n                            },\r\n                   " +
+"         tooltipClass: \'FlagAssignment_Tooltip\',\r\n                            po" +
+"sition: {\r\n                                my: \"right top\",\r\n                   " +
+"             at: \"right bottom\",\r\n                                collision: \"fl" +
+"ipfit flip\"\r\n                            },\r\n                            hade: {" +
+"\r\n                                effect: \'\'\r\n                            },\r\n  " +
+"                          close: function (e, ui) {\r\n                           " +
+"     ui.tooltip.hover(\r\n                                    function () {\r\n     " +
+"                                   $(this).stop(true).fadeTo(100, 1);\r\n         " +
+"                           },\r\n                                    function () {" +
+"\r\n                                        $(this).fadeOut(100, function () { $(t" +
+"his).remove(); });\r\n                                    });\r\n                   " +
+"         }\r\n                        });\r\n\r\n                        $this.data(\'d" +
+"eviceTable_Flags\', true)\r\n                    }\r\n                });\r\n          " +
+"  });\r\n        </script>\r\n");
 
             
             #line 158 "..\..\Views\Device\_DeviceTable.cshtml"

Disco.Web/Views/Job/JobParts/_Subject.cshtml

@@ -256,19 +256,20 @@
                                     </div>
                                 }
                             }
-                            @if (Authorization.Has(Claims.Device.ShowFlagAssignments) &&
-                                Model.Job.Device.DeviceFlagAssignments != null &&
-                                Model.Job.Device.DeviceFlagAssignments.Any(a => !a.RemovedDate.HasValue))
+                            @if (Model.Job.Device.DeviceFlagAssignments.CanShowAny())
                             {
                                 <div id="Job_Show_Device_Flags">
                                     @foreach (var flag in Model.Job.Device.DeviceFlagAssignments.Where(f => !f.RemovedDate.HasValue).Select(f => Tuple.Create(f, DeviceFlagService.GetDeviceFlag(f.DeviceFlagId))))
                                     {
-                                        <i class="flag fa fa-@(flag.Item2.Icon) fa-fw d-@(flag.Item2.IconColour)">
-                                            <span class="details">
-                                                <span class="name">@flag.Item2.Name</span>@if (flag.Item1.Comments != null)
-                                                {<span class="comments">@flag.Item1.Comments.ToHtmlComment()</span>}<span class="added">@CommonHelpers.FriendlyDateAndUser(flag.Item1.AddedDate, flag.Item1.AddedUserId)</span>
-                                            </span>
-                                        </i>
+                                        if (flag.Item2.permission.CanShow())
+                                        {
+                                            <i class="flag fa fa-@(flag.Item2.flag.Icon) fa-fw d-@(flag.Item2.flag.IconColour)">
+                                                <span class="details">
+                                                    <span class="name">@flag.Item2.flag.Name</span>@if (flag.Item1.Comments != null)
+                                                    {<span class="comments">@flag.Item1.Comments.ToHtmlComment()</span>}<span class="added">@CommonHelpers.FriendlyDateAndUser(flag.Item1.AddedDate, flag.Item1.AddedUserId)</span>
+                                                </span>
+                                            </i>
+                                        }
                                     }
                                     <script type="text/javascript">
                                         $(function () {
@@ -506,17 +507,20 @@
                     if (!string.IsNullOrWhiteSpace(Model.Job.User.EmailAddress))
                     {<div id="Job_Show_User_EmailAddress" title="Email Address">Email: <a href="mailto:@(Model.Job.User.EmailAddress)" data-clipboard="@Model.Job.User.DisplayName &lt;@Model.Job.User.EmailAddress&gt;">@Model.Job.User.EmailAddress</a></div>}
             }
-                    @if (Authorization.Has(Claims.User.ShowFlagAssignments))
+                    @if (Model.Job.User.UserFlagAssignments.CanShowAny())
                     {
                         <div id="Job_Show_User_Flags">
                             @foreach (var flag in Model.Job.User.UserFlagAssignments.Where(f => !f.RemovedDate.HasValue).Select(f => Tuple.Create(f, UserFlagService.GetUserFlag(f.UserFlagId))))
                             {
-                                <i class="flag fa fa-@(flag.Item2.Icon) fa-fw d-@(flag.Item2.IconColour)">
-                                    <span class="details">
-                                        <span class="name">@flag.Item2.Name</span>@if (flag.Item1.Comments != null)
-                                        {<span class="comments">@flag.Item1.Comments.ToHtmlComment()</span>}<span class="added">@CommonHelpers.FriendlyDateAndUser(flag.Item1.AddedDate, flag.Item1.AddedUserId)</span>
-                                    </span>
-                                </i>
+                                if (flag.Item2.permission.CanShow())
+                                {
+                                    <i class="flag fa fa-@(flag.Item2.flag.Icon) fa-fw d-@(flag.Item2.flag.IconColour)">
+                                        <span class="details">
+                                            <span class="name">@flag.Item2.flag.Name</span>@if (flag.Item1.Comments != null)
+                                            {<span class="comments">@flag.Item1.Comments.ToHtmlComment()</span>}<span class="added">@CommonHelpers.FriendlyDateAndUser(flag.Item1.AddedDate, flag.Item1.AddedUserId)</span>
+                                        </span>
+                                    </i>
+                                }
                             }
                             <script type="text/javascript">
                                 $(function () {

Disco.Web/Views/User/Show.cshtml

@@ -13,17 +13,20 @@
     }
 }
 <div id="User_Show" data-userid="@Model.User.UserId">
-    @if (Authorization.Has(Claims.User.ShowFlagAssignments))
+    @if (Model.User.UserFlagAssignments.CanShowAny())
     {
         <div id="User_Show_Flags">
             @foreach (var flag in Model.User.UserFlagAssignments.Where(f => !f.RemovedDate.HasValue).Select(f => Tuple.Create(f, UserFlagService.GetUserFlag(f.UserFlagId))))
             {
-                <i class="flag fa fa-@(flag.Item2.Icon) fa-fw fa-lg d-@(flag.Item2.IconColour)">
-                    <span class="details">
-                        <span class="name">@flag.Item2.Name</span>@if (flag.Item1.Comments != null)
-                        {<span class="comments">@flag.Item1.Comments.ToHtmlComment()</span>}<span class="added">@CommonHelpers.FriendlyDateAndUser(flag.Item1.AddedDate, flag.Item1.AddedUser)</span>
-                    </span>
-                </i>
+                if (flag.Item2.permission.CanShow())
+                {
+                    <i class="flag fa fa-@(flag.Item2.flag.Icon) fa-fw fa-lg d-@(flag.Item2.flag.IconColour)">
+                        <span class="details">
+                            <span class="name">@flag.Item2.flag.Name</span>@if (flag.Item1.Comments != null)
+                            {<span class="comments">@flag.Item1.Comments.ToHtmlComment()</span>}<span class="added">@CommonHelpers.FriendlyDateAndUser(flag.Item1.AddedDate, flag.Item1.AddedUser)</span>
+                        </span>
+                    </i>
+                }
             }
         </div>
         <script type="text/javascript">
@@ -106,7 +109,7 @@
         {
             @Html.Partial(MVC.User.Views.UserParts._Resources, Model)
         }
-        @if (Authorization.Has(Claims.User.ShowFlagAssignments))
+        @if (Authorization.Has(Claims.User.ShowFlagAssignments) || Model.User.UserFlagAssignments.CanShowAny())
         {
             @Html.Partial(MVC.User.Views.UserParts._Flags, Model)
         }

Disco.Web/Views/User/Show.generated.cs

@@ -91,7 +91,7 @@ WriteLiteral(">\r\n");
             #line hidden
             
             #line 16 "..\..\Views\User\Show.cshtml"
-     if (Authorization.Has(Claims.User.ShowFlagAssignments))
+     if (Model.User.UserFlagAssignments.CanShowAny())
     {
 
             
@@ -113,48 +113,50 @@ WriteLiteral(">\r\n");
             #line 19 "..\..\Views\User\Show.cshtml"
              foreach (var flag in Model.User.UserFlagAssignments.Where(f => !f.RemovedDate.HasValue).Select(f => Tuple.Create(f, UserFlagService.GetUserFlag(f.UserFlagId))))
             {
+                if (flag.Item2.permission.CanShow())
+                {
 
             
             #line default
             #line hidden
-WriteLiteral("                <i");
+WriteLiteral("                    <i");
 
-WriteAttribute("class", Tuple.Create(" class=\"", 867), Tuple.Create("\"", 943)
-, Tuple.Create(Tuple.Create("", 875), Tuple.Create("flag", 875), true)
-, Tuple.Create(Tuple.Create(" ", 879), Tuple.Create("fa", 880), true)
-, Tuple.Create(Tuple.Create(" ", 882), Tuple.Create("fa-", 883), true)
+WriteAttribute("class", Tuple.Create(" class=\"", 937), Tuple.Create("\"", 1023)
+, Tuple.Create(Tuple.Create("", 945), Tuple.Create("flag", 945), true)
+, Tuple.Create(Tuple.Create(" ", 949), Tuple.Create("fa", 950), true)
+, Tuple.Create(Tuple.Create(" ", 952), Tuple.Create("fa-", 953), true)
             
-            #line 21 "..\..\Views\User\Show.cshtml"
-, Tuple.Create(Tuple.Create("", 886), Tuple.Create<System.Object, System.Int32>(flag.Item2.Icon
+            #line 23 "..\..\Views\User\Show.cshtml"
+, Tuple.Create(Tuple.Create("", 956), Tuple.Create<System.Object, System.Int32>(flag.Item2.flag.Icon
             
             #line default
             #line hidden
-, 886), false)
-, Tuple.Create(Tuple.Create(" ", 904), Tuple.Create("fa-fw", 905), true)
-, Tuple.Create(Tuple.Create(" ", 910), Tuple.Create("fa-lg", 911), true)
-, Tuple.Create(Tuple.Create(" ", 916), Tuple.Create("d-", 917), true)
+, 956), false)
+, Tuple.Create(Tuple.Create(" ", 979), Tuple.Create("fa-fw", 980), true)
+, Tuple.Create(Tuple.Create(" ", 985), Tuple.Create("fa-lg", 986), true)
+, Tuple.Create(Tuple.Create(" ", 991), Tuple.Create("d-", 992), true)
             
-            #line 21 "..\..\Views\User\Show.cshtml"
-, Tuple.Create(Tuple.Create("", 919), Tuple.Create<System.Object, System.Int32>(flag.Item2.IconColour
+            #line 23 "..\..\Views\User\Show.cshtml"
+ , Tuple.Create(Tuple.Create("", 994), Tuple.Create<System.Object, System.Int32>(flag.Item2.flag.IconColour
             
             #line default
             #line hidden
-, 919), false)
+, 994), false)
 );
 
-WriteLiteral(">\r\n                    <span");
+WriteLiteral(">\r\n                        <span");
 
 WriteLiteral(" class=\"details\"");
 
-WriteLiteral(">\r\n                        <span");
+WriteLiteral(">\r\n                            <span");
 
 WriteLiteral(" class=\"name\"");
 
 WriteLiteral(">");
 
             
-            #line 23 "..\..\Views\User\Show.cshtml"
-                                      Write(flag.Item2.Name);
+            #line 25 "..\..\Views\User\Show.cshtml"
+                                          Write(flag.Item2.flag.Name);
 
             
             #line default
@@ -162,9 +164,9 @@ WriteLiteral(">");
 WriteLiteral("</span>");
 
             
-            #line 23 "..\..\Views\User\Show.cshtml"
-                                                                   if (flag.Item1.Comments != null)
-                        {
+            #line 25 "..\..\Views\User\Show.cshtml"
+                                                                            if (flag.Item1.Comments != null)
+                            {
             
             #line default
             #line hidden
@@ -175,8 +177,8 @@ WriteLiteral(" class=\"comments\"");
 WriteLiteral(">");
 
             
-            #line 24 "..\..\Views\User\Show.cshtml"
-                                           Write(flag.Item1.Comments.ToHtmlComment());
+            #line 26 "..\..\Views\User\Show.cshtml"
+                                               Write(flag.Item1.Comments.ToHtmlComment());
 
             
             #line default
@@ -184,8 +186,8 @@ WriteLiteral(">");
 WriteLiteral("</span>");
 
             
-            #line 24 "..\..\Views\User\Show.cshtml"
-                                                                                           }
+            #line 26 "..\..\Views\User\Show.cshtml"
+                                                                                               }
             
             #line default
             #line hidden
@@ -196,16 +198,17 @@ WriteLiteral(" class=\"added\"");
 WriteLiteral(">");
 
             
-            #line 24 "..\..\Views\User\Show.cshtml"
-                                                                                                           Write(CommonHelpers.FriendlyDateAndUser(flag.Item1.AddedDate, flag.Item1.AddedUser));
+            #line 26 "..\..\Views\User\Show.cshtml"
+                                                                                                               Write(CommonHelpers.FriendlyDateAndUser(flag.Item1.AddedDate, flag.Item1.AddedUser));
 
             
             #line default
             #line hidden
-WriteLiteral("</span>\r\n                    </span>\r\n                </i>\r\n");
+WriteLiteral("</span>\r\n                        </span>\r\n                    </i>\r\n");
 
             
-            #line 27 "..\..\Views\User\Show.cshtml"
+            #line 29 "..\..\Views\User\Show.cshtml"
+                }
             }
 
             
@@ -251,7 +254,7 @@ WriteLiteral(@">
 ");
 
             
-            #line 60 "..\..\Views\User\Show.cshtml"
+            #line 63 "..\..\Views\User\Show.cshtml"
     }
 
             
@@ -260,7 +263,7 @@ WriteLiteral(@">
 WriteLiteral("    ");
 
             
-            #line 61 "..\..\Views\User\Show.cshtml"
+            #line 64 "..\..\Views\User\Show.cshtml"
 Write(Html.Partial(MVC.User.Views.UserParts._Subject, Model));
 
             
@@ -300,13 +303,13 @@ WriteLiteral(" id=\"UserDetailTabItems\"");
 WriteLiteral("></ul>\r\n");
 
             
-            #line 97 "..\..\Views\User\Show.cshtml"
+            #line 100 "..\..\Views\User\Show.cshtml"
         
             
             #line default
             #line hidden
             
-            #line 97 "..\..\Views\User\Show.cshtml"
+            #line 100 "..\..\Views\User\Show.cshtml"
          if (Authorization.HasAny(Claims.User.ShowComments, Claims.User.ShowJobs))
         {
             
@@ -314,14 +317,14 @@ WriteLiteral("></ul>\r\n");
             #line default
             #line hidden
             
-            #line 99 "..\..\Views\User\Show.cshtml"
+            #line 102 "..\..\Views\User\Show.cshtml"
        Write(Html.Partial(MVC.User.Views.UserParts._CommentsAndJobs, Model));
 
             
             #line default
             #line hidden
             
-            #line 99 "..\..\Views\User\Show.cshtml"
+            #line 102 "..\..\Views\User\Show.cshtml"
                                                                            
         }
 
@@ -331,7 +334,7 @@ WriteLiteral("></ul>\r\n");
 WriteLiteral("        ");
 
             
-            #line 101 "..\..\Views\User\Show.cshtml"
+            #line 104 "..\..\Views\User\Show.cshtml"
          if (Authorization.Has(Claims.User.ShowAssignmentHistory))
         {
             
@@ -339,14 +342,14 @@ WriteLiteral("        ");
             #line default
             #line hidden
             
-            #line 103 "..\..\Views\User\Show.cshtml"
+            #line 106 "..\..\Views\User\Show.cshtml"
        Write(Html.Partial(MVC.User.Views.UserParts._AssignmentHistory, Model));
 
             
             #line default
             #line hidden
             
-            #line 103 "..\..\Views\User\Show.cshtml"
+            #line 106 "..\..\Views\User\Show.cshtml"
                                                                              
         }
 
@@ -356,7 +359,7 @@ WriteLiteral("        ");
 WriteLiteral("        ");
 
             
-            #line 105 "..\..\Views\User\Show.cshtml"
+            #line 108 "..\..\Views\User\Show.cshtml"
          if (Authorization.Has(Claims.User.ShowAttachments))
         {
             
@@ -364,14 +367,14 @@ WriteLiteral("        ");
             #line default
             #line hidden
             
-            #line 107 "..\..\Views\User\Show.cshtml"
+            #line 110 "..\..\Views\User\Show.cshtml"
        Write(Html.Partial(MVC.User.Views.UserParts._Resources, Model));
 
             
             #line default
             #line hidden
             
-            #line 107 "..\..\Views\User\Show.cshtml"
+            #line 110 "..\..\Views\User\Show.cshtml"
                                                                      
         }
 
@@ -381,22 +384,22 @@ WriteLiteral("        ");
 WriteLiteral("        ");
 
             
-            #line 109 "..\..\Views\User\Show.cshtml"
-         if (Authorization.Has(Claims.User.ShowFlagAssignments))
+            #line 112 "..\..\Views\User\Show.cshtml"
+         if (Authorization.Has(Claims.User.ShowFlagAssignments) || Model.User.UserFlagAssignments.CanShowAny())
         {
             
             
             #line default
             #line hidden
             
-            #line 111 "..\..\Views\User\Show.cshtml"
+            #line 114 "..\..\Views\User\Show.cshtml"
        Write(Html.Partial(MVC.User.Views.UserParts._Flags, Model));
 
             
             #line default
             #line hidden
             
-            #line 111 "..\..\Views\User\Show.cshtml"
+            #line 114 "..\..\Views\User\Show.cshtml"
                                                                  
         }
 
@@ -406,7 +409,7 @@ WriteLiteral("        ");
 WriteLiteral("        ");
 
             
-            #line 113 "..\..\Views\User\Show.cshtml"
+            #line 116 "..\..\Views\User\Show.cshtml"
          if (Authorization.Has(Claims.User.ShowAuthorization))
         {
             
@@ -414,14 +417,14 @@ WriteLiteral("        ");
             #line default
             #line hidden
             
-            #line 115 "..\..\Views\User\Show.cshtml"
+            #line 118 "..\..\Views\User\Show.cshtml"
        Write(Html.Partial(MVC.User.Views.UserParts._Authorization, Model));
 
             
             #line default
             #line hidden
             
-            #line 115 "..\..\Views\User\Show.cshtml"
+            #line 118 "..\..\Views\User\Show.cshtml"
                                                                          
         }
 
@@ -431,13 +434,13 @@ WriteLiteral("        ");
 WriteLiteral("    </div>\r\n");
 
             
-            #line 118 "..\..\Views\User\Show.cshtml"
+            #line 121 "..\..\Views\User\Show.cshtml"
     
             
             #line default
             #line hidden
             
-            #line 118 "..\..\Views\User\Show.cshtml"
+            #line 121 "..\..\Views\User\Show.cshtml"
      if (requiresLive)
     {
 
@@ -492,7 +495,7 @@ WriteLiteral("        <script>\r\n            $(function () {\r\n
 "   });\r\n            });\r\n        </script>\r\n");
 
             
-            #line 187 "..\..\Views\User\Show.cshtml"
+            #line 190 "..\..\Views\User\Show.cshtml"
     }
 
             

Disco.Web/Views/User/UserParts/_Flags.cshtml

@@ -1,15 +1,8 @@
 @model Disco.Web.Models.User.ShowModel
 @using Disco.Services.Users.UserFlags;
 @{
-    Authorization.Require(Claims.User.ShowFlagAssignments);
-
-    var hasRemove = Authorization.Has(Claims.User.Actions.RemoveFlags);
-    var hasEdit = Authorization.Has(Claims.User.Actions.EditFlags);
-
-    var hasUserFlagShow = Authorization.Has(Claims.Config.UserFlag.Show);
-    var activeAssignmentCount = Model.User.UserFlagAssignments == null ? 0 : Model.User.UserFlagAssignments.Count(a => !a.RemovedDate.HasValue);
-
-    var flagAssignments = Model.User.UserFlagAssignments.Select(a => Tuple.Create(a, UserFlagService.GetUserFlag(a.UserFlagId))).ToList();
+    var flagAssignments = Model.User.UserFlagAssignments.Select(a => Tuple.Create(a, UserFlagService.GetUserFlag(a.UserFlagId))).Where(g => g.Item2.permission.CanShow()).ToList();
+    var activeAssignmentCount = flagAssignments.Count(a => !a.Item1.RemovedDate.HasValue);
 }
 <div id="UserDetailTab-Flags" class="UserPart">
     @if (flagAssignments.Count > 0)
@@ -25,14 +18,14 @@
             {
                 <tr data-userflagassignmentid="@fa.Item1.Id" data-flagassignmentaddeddate="@(fa.Item1.AddedDate.ToString("s"))" class="@(!fa.Item1.RemovedDate.HasValue ? "added" : "removed")">
                     <td class="name">
-                        <i class="fa fa-@(fa.Item2.Icon) fa-fw fa-lg d-@(fa.Item2.IconColour)"></i>
-                        @if (hasUserFlagShow)
+                        <i class="fa fa-@(fa.Item2.flag.Icon) fa-fw fa-lg d-@(fa.Item2.flag.IconColour)"></i>
+                        @if (Authorization.Has(Claims.Config.UserFlag.Show))
                         {
-                            @Html.ActionLink(fa.Item2.Name, MVC.Config.UserFlag.Index(fa.Item2.Id))
+                            @Html.ActionLink(fa.Item2.flag.Name, MVC.Config.UserFlag.Index(fa.Item2.flag.Id))
                         }
                         else
                         {
-                            @fa.Item2.Name
+                            @fa.Item2.flag.Name
                         }
                     </td>
                     <td class="added">
@@ -43,7 +36,7 @@
                         }
                     </td>
                     <td class="comments">
-                        @if (hasEdit)
+                        @if (fa.Item2.permission.CanEdit())
                         {
                             <div class="editable"><i class="fa fa-fw fa-edit" title="Edit Comments"></i></div>
                         }
@@ -77,6 +70,7 @@
         <div id="User_Show_Flags_Actions_Remove_Dialog" class="dialog" title="Remove this flag from the user?">
             @using (Html.BeginForm(MVC.API.UserFlagAssignment.RemoveUser()))
             {
+                @Html.AntiForgeryToken()
                 <input id="User_Show_Flags_Actions_Remove_Dialog_Id" type="hidden" name="id" value="" />
                 <p>
                     <i class="fa fa-exclamation-triangle fa-lg"></i>&nbsp;Are you sure?
@@ -86,6 +80,7 @@
         <div id="User_Show_Flags_Actions_EditComments_Dialog" class="dialog" title="Edit the Comments">
             @using (Html.BeginForm(MVC.API.UserFlagAssignment.UpdateComments()))
             {
+                @Html.AntiForgeryToken()
                 <input id="User_Show_Flags_Actions_EditComments_Dialog_Id" type="hidden" name="id" value="" />
                 <input type="hidden" name="redirect" value="true" />
                 <h4>Comments:</h4>

Disco.Web/Views/User/UserParts/_Flags.generated.cs

@@ -52,15 +52,8 @@ namespace Disco.Web.Views.User.UserParts
             
             #line 3 "..\..\Views\User\UserParts\_Flags.cshtml"
   
-    Authorization.Require(Claims.User.ShowFlagAssignments);
-
-    var hasRemove = Authorization.Has(Claims.User.Actions.RemoveFlags);
-    var hasEdit = Authorization.Has(Claims.User.Actions.EditFlags);
-
-    var hasUserFlagShow = Authorization.Has(Claims.Config.UserFlag.Show);
-    var activeAssignmentCount = Model.User.UserFlagAssignments == null ? 0 : Model.User.UserFlagAssignments.Count(a => !a.RemovedDate.HasValue);
-
-    var flagAssignments = Model.User.UserFlagAssignments.Select(a => Tuple.Create(a, UserFlagService.GetUserFlag(a.UserFlagId))).ToList();
+    var flagAssignments = Model.User.UserFlagAssignments.Select(a => Tuple.Create(a, UserFlagService.GetUserFlag(a.UserFlagId))).Where(g => g.Item2.permission.CanShow()).ToList();
+    var activeAssignmentCount = flagAssignments.Count(a => !a.Item1.RemovedDate.HasValue);
 
             
             #line default
@@ -74,13 +67,13 @@ WriteLiteral(" class=\"UserPart\"");
 WriteLiteral(">\r\n");
 
             
-            #line 15 "..\..\Views\User\UserParts\_Flags.cshtml"
+            #line 8 "..\..\Views\User\UserParts\_Flags.cshtml"
     
             
             #line default
             #line hidden
             
-            #line 15 "..\..\Views\User\UserParts\_Flags.cshtml"
+            #line 8 "..\..\Views\User\UserParts\_Flags.cshtml"
      if (flagAssignments.Count > 0)
     {
 
@@ -110,13 +103,13 @@ WriteLiteral(" class=\"removed\"");
 WriteLiteral(">Removed</th>\r\n            </tr>\r\n");
 
             
-            #line 24 "..\..\Views\User\UserParts\_Flags.cshtml"
+            #line 17 "..\..\Views\User\UserParts\_Flags.cshtml"
             
             
             #line default
             #line hidden
             
-            #line 24 "..\..\Views\User\UserParts\_Flags.cshtml"
+            #line 17 "..\..\Views\User\UserParts\_Flags.cshtml"
              foreach (var fa in flagAssignments.OrderByDescending(a => a.Item1.AddedDate))
             {
 
@@ -128,7 +121,7 @@ WriteLiteral("                <tr");
 WriteLiteral(" data-userflagassignmentid=\"");
 
             
-            #line 26 "..\..\Views\User\UserParts\_Flags.cshtml"
+            #line 19 "..\..\Views\User\UserParts\_Flags.cshtml"
                                           Write(fa.Item1.Id);
 
             
@@ -139,7 +132,7 @@ WriteLiteral("\"");
 WriteLiteral(" data-flagassignmentaddeddate=\"");
 
             
-            #line 26 "..\..\Views\User\UserParts\_Flags.cshtml"
+            #line 19 "..\..\Views\User\UserParts\_Flags.cshtml"
                                                                                        Write(fa.Item1.AddedDate.ToString("s"));
 
             
@@ -147,14 +140,14 @@ WriteLiteral(" data-flagassignmentaddeddate=\"");
             #line hidden
 WriteLiteral("\"");
 
-WriteAttribute("class", Tuple.Create(" class=\"", 1240), Tuple.Create("\"", 1303)
+WriteAttribute("class", Tuple.Create(" class=\"", 943), Tuple.Create("\"", 1006)
             
-            #line 26 "..\..\Views\User\UserParts\_Flags.cshtml"
-                                                        , Tuple.Create(Tuple.Create("", 1248), Tuple.Create<System.Object, System.Int32>(!fa.Item1.RemovedDate.HasValue ? "added" : "removed"
+            #line 19 "..\..\Views\User\UserParts\_Flags.cshtml"
+                                                         , Tuple.Create(Tuple.Create("", 951), Tuple.Create<System.Object, System.Int32>(!fa.Item1.RemovedDate.HasValue ? "added" : "removed"
             
             #line default
             #line hidden
-, 1248), false)
+, 951), false)
 );
 
 WriteLiteral(">\r\n                    <td");
@@ -163,54 +156,54 @@ WriteLiteral(" class=\"name\"");
 
 WriteLiteral(">\r\n                        <i");
 
-WriteAttribute("class", Tuple.Create(" class=\"", 1372), Tuple.Create("\"", 1439)
-, Tuple.Create(Tuple.Create("", 1380), Tuple.Create("fa", 1380), true)
-, Tuple.Create(Tuple.Create(" ", 1382), Tuple.Create("fa-", 1383), true)
+WriteAttribute("class", Tuple.Create(" class=\"", 1075), Tuple.Create("\"", 1152)
+, Tuple.Create(Tuple.Create("", 1083), Tuple.Create("fa", 1083), true)
+, Tuple.Create(Tuple.Create(" ", 1085), Tuple.Create("fa-", 1086), true)
             
-            #line 28 "..\..\Views\User\UserParts\_Flags.cshtml"
-, Tuple.Create(Tuple.Create("", 1386), Tuple.Create<System.Object, System.Int32>(fa.Item2.Icon
+            #line 21 "..\..\Views\User\UserParts\_Flags.cshtml"
+, Tuple.Create(Tuple.Create("", 1089), Tuple.Create<System.Object, System.Int32>(fa.Item2.flag.Icon
             
             #line default
             #line hidden
-, 1386), false)
-, Tuple.Create(Tuple.Create(" ", 1402), Tuple.Create("fa-fw", 1403), true)
-, Tuple.Create(Tuple.Create(" ", 1408), Tuple.Create("fa-lg", 1409), true)
-, Tuple.Create(Tuple.Create(" ", 1414), Tuple.Create("d-", 1415), true)
+, 1089), false)
+, Tuple.Create(Tuple.Create(" ", 1110), Tuple.Create("fa-fw", 1111), true)
+, Tuple.Create(Tuple.Create(" ", 1116), Tuple.Create("fa-lg", 1117), true)
+, Tuple.Create(Tuple.Create(" ", 1122), Tuple.Create("d-", 1123), true)
             
-            #line 28 "..\..\Views\User\UserParts\_Flags.cshtml"
-, Tuple.Create(Tuple.Create("", 1417), Tuple.Create<System.Object, System.Int32>(fa.Item2.IconColour
+            #line 21 "..\..\Views\User\UserParts\_Flags.cshtml"
+, Tuple.Create(Tuple.Create("", 1125), Tuple.Create<System.Object, System.Int32>(fa.Item2.flag.IconColour
             
             #line default
             #line hidden
-, 1417), false)
+, 1125), false)
 );
 
 WriteLiteral("></i>\r\n");
 
             
-            #line 29 "..\..\Views\User\UserParts\_Flags.cshtml"
+            #line 22 "..\..\Views\User\UserParts\_Flags.cshtml"
                         
             
             #line default
             #line hidden
             
-            #line 29 "..\..\Views\User\UserParts\_Flags.cshtml"
-                         if (hasUserFlagShow)
+            #line 22 "..\..\Views\User\UserParts\_Flags.cshtml"
+                         if (Authorization.Has(Claims.Config.UserFlag.Show))
                         {
                             
             
             #line default
             #line hidden
             
-            #line 31 "..\..\Views\User\UserParts\_Flags.cshtml"
-                       Write(Html.ActionLink(fa.Item2.Name, MVC.Config.UserFlag.Index(fa.Item2.Id)));
+            #line 24 "..\..\Views\User\UserParts\_Flags.cshtml"
+                       Write(Html.ActionLink(fa.Item2.flag.Name, MVC.Config.UserFlag.Index(fa.Item2.flag.Id)));
 
             
             #line default
             #line hidden
             
-            #line 31 "..\..\Views\User\UserParts\_Flags.cshtml"
-                                                                                                   
+            #line 24 "..\..\Views\User\UserParts\_Flags.cshtml"
+                                                                                                             
                         }
                         else
                         {
@@ -219,15 +212,15 @@ WriteLiteral("></i>\r\n");
             #line default
             #line hidden
             
-            #line 35 "..\..\Views\User\UserParts\_Flags.cshtml"
-                       Write(fa.Item2.Name);
+            #line 28 "..\..\Views\User\UserParts\_Flags.cshtml"
+                       Write(fa.Item2.flag.Name);
 
             
             #line default
             #line hidden
             
-            #line 35 "..\..\Views\User\UserParts\_Flags.cshtml"
-                                          
+            #line 28 "..\..\Views\User\UserParts\_Flags.cshtml"
+                                               
                         }
 
             
@@ -242,7 +235,7 @@ WriteLiteral(">\r\n");
 WriteLiteral("                        ");
 
             
-            #line 39 "..\..\Views\User\UserParts\_Flags.cshtml"
+            #line 32 "..\..\Views\User\UserParts\_Flags.cshtml"
                    Write(CommonHelpers.FriendlyDateAndUser(fa.Item1.AddedDate, fa.Item1.AddedUser));
 
             
@@ -251,13 +244,13 @@ WriteLiteral("                        ");
 WriteLiteral("\r\n");
 
             
-            #line 40 "..\..\Views\User\UserParts\_Flags.cshtml"
+            #line 33 "..\..\Views\User\UserParts\_Flags.cshtml"
                         
             
             #line default
             #line hidden
             
-            #line 40 "..\..\Views\User\UserParts\_Flags.cshtml"
+            #line 33 "..\..\Views\User\UserParts\_Flags.cshtml"
                          if (fa.Item1.OnAssignmentExpressionResult != null)
                         {
 
@@ -271,7 +264,7 @@ WriteLiteral(" class=\"expressionResult\"");
 WriteLiteral(">");
 
             
-            #line 42 "..\..\Views\User\UserParts\_Flags.cshtml"
+            #line 35 "..\..\Views\User\UserParts\_Flags.cshtml"
                                                      Write(fa.Item1.OnAssignmentExpressionResult);
 
             
@@ -280,7 +273,7 @@ WriteLiteral(">");
 WriteLiteral("</div>\r\n");
 
             
-            #line 43 "..\..\Views\User\UserParts\_Flags.cshtml"
+            #line 36 "..\..\Views\User\UserParts\_Flags.cshtml"
                         }
 
             
@@ -293,14 +286,14 @@ WriteLiteral(" class=\"comments\"");
 WriteLiteral(">\r\n");
 
             
-            #line 46 "..\..\Views\User\UserParts\_Flags.cshtml"
+            #line 39 "..\..\Views\User\UserParts\_Flags.cshtml"
                         
             
             #line default
             #line hidden
             
-            #line 46 "..\..\Views\User\UserParts\_Flags.cshtml"
-                         if (hasEdit)
+            #line 39 "..\..\Views\User\UserParts\_Flags.cshtml"
+                         if (fa.Item2.permission.CanEdit())
                         {
 
             
@@ -319,7 +312,7 @@ WriteLiteral(" title=\"Edit Comments\"");
 WriteLiteral("></i></div>\r\n");
 
             
-            #line 49 "..\..\Views\User\UserParts\_Flags.cshtml"
+            #line 42 "..\..\Views\User\UserParts\_Flags.cshtml"
                         }
 
             
@@ -328,7 +321,7 @@ WriteLiteral("></i></div>\r\n");
 WriteLiteral("                        ");
 
             
-            #line 50 "..\..\Views\User\UserParts\_Flags.cshtml"
+            #line 43 "..\..\Views\User\UserParts\_Flags.cshtml"
                          if (fa.Item1.Comments == null)
                         {
 
@@ -342,7 +335,7 @@ WriteLiteral(" class=\"comments smallMessage\"");
 WriteLiteral(">[no comments]</div>\r\n");
 
             
-            #line 53 "..\..\Views\User\UserParts\_Flags.cshtml"
+            #line 46 "..\..\Views\User\UserParts\_Flags.cshtml"
                         }
                         else
                         {
@@ -357,7 +350,7 @@ WriteLiteral(" class=\"comments\"");
 WriteLiteral(">");
 
             
-            #line 56 "..\..\Views\User\UserParts\_Flags.cshtml"
+            #line 49 "..\..\Views\User\UserParts\_Flags.cshtml"
                                              Write(fa.Item1.Comments.ToHtmlComment());
 
             
@@ -372,7 +365,7 @@ WriteLiteral(" class=\"commentsRaw\"");
 WriteLiteral(">");
 
             
-            #line 57 "..\..\Views\User\UserParts\_Flags.cshtml"
+            #line 50 "..\..\Views\User\UserParts\_Flags.cshtml"
                                                 Write(fa.Item1.Comments);
 
             
@@ -381,7 +374,7 @@ WriteLiteral(">");
 WriteLiteral("</div>\r\n");
 
             
-            #line 58 "..\..\Views\User\UserParts\_Flags.cshtml"
+            #line 51 "..\..\Views\User\UserParts\_Flags.cshtml"
                         }
 
             
@@ -389,27 +382,27 @@ WriteLiteral("</div>\r\n");
             #line hidden
 WriteLiteral("                    </td>\r\n                    <td");
 
-WriteAttribute("class", Tuple.Create(" class=\"", 2954), Tuple.Create("\"", 3017)
-, Tuple.Create(Tuple.Create("", 2962), Tuple.Create("removed", 2962), true)
+WriteAttribute("class", Tuple.Create(" class=\"", 2735), Tuple.Create("\"", 2798)
+, Tuple.Create(Tuple.Create("", 2743), Tuple.Create("removed", 2743), true)
             
-            #line 60 "..\..\Views\User\UserParts\_Flags.cshtml"
-, Tuple.Create(Tuple.Create("", 2969), Tuple.Create<System.Object, System.Int32>(!fa.Item1.RemovedDate.HasValue ? " na" : null
+            #line 53 "..\..\Views\User\UserParts\_Flags.cshtml"
+, Tuple.Create(Tuple.Create("", 2750), Tuple.Create<System.Object, System.Int32>(!fa.Item1.RemovedDate.HasValue ? " na" : null
             
             #line default
             #line hidden
-, 2969), false)
+, 2750), false)
 );
 
 WriteLiteral(">\r\n");
 
             
-            #line 61 "..\..\Views\User\UserParts\_Flags.cshtml"
+            #line 54 "..\..\Views\User\UserParts\_Flags.cshtml"
                         
             
             #line default
             #line hidden
             
-            #line 61 "..\..\Views\User\UserParts\_Flags.cshtml"
+            #line 54 "..\..\Views\User\UserParts\_Flags.cshtml"
                          if (fa.Item1.RemovedDate.HasValue)
                         {
                             
@@ -417,14 +410,14 @@ WriteLiteral(">\r\n");
             #line default
             #line hidden
             
-            #line 63 "..\..\Views\User\UserParts\_Flags.cshtml"
+            #line 56 "..\..\Views\User\UserParts\_Flags.cshtml"
                        Write(CommonHelpers.FriendlyDateAndUser(fa.Item1.RemovedDate.Value, fa.Item1.RemovedUser));
 
             
             #line default
             #line hidden
             
-            #line 63 "..\..\Views\User\UserParts\_Flags.cshtml"
+            #line 56 "..\..\Views\User\UserParts\_Flags.cshtml"
                                                                                                                 
                             if (fa.Item1.OnUnassignmentExpressionResult != null)
                             {
@@ -439,7 +432,7 @@ WriteLiteral(" class=\"expressionResult\"");
 WriteLiteral(">");
 
             
-            #line 66 "..\..\Views\User\UserParts\_Flags.cshtml"
+            #line 59 "..\..\Views\User\UserParts\_Flags.cshtml"
                                                          Write(fa.Item1.OnUnassignmentExpressionResult);
 
             
@@ -448,7 +441,7 @@ WriteLiteral(">");
 WriteLiteral("</div>\r\n");
 
             
-            #line 67 "..\..\Views\User\UserParts\_Flags.cshtml"
+            #line 60 "..\..\Views\User\UserParts\_Flags.cshtml"
                             }
                         }
                         else if (fa.Item1.CanRemove())
@@ -466,7 +459,7 @@ WriteLiteral(" class=\"button small remove\"");
 WriteLiteral(">Remove</a>\r\n");
 
             
-            #line 72 "..\..\Views\User\UserParts\_Flags.cshtml"
+            #line 65 "..\..\Views\User\UserParts\_Flags.cshtml"
                         }
 
             
@@ -475,7 +468,7 @@ WriteLiteral(">Remove</a>\r\n");
 WriteLiteral("                    </td>\r\n                </tr>\r\n");
 
             
-            #line 75 "..\..\Views\User\UserParts\_Flags.cshtml"
+            #line 68 "..\..\Views\User\UserParts\_Flags.cshtml"
             }
 
             
@@ -494,15 +487,29 @@ WriteLiteral(" title=\"Remove this flag from the user?\"");
 WriteLiteral(">\r\n");
 
             
-            #line 78 "..\..\Views\User\UserParts\_Flags.cshtml"
+            #line 71 "..\..\Views\User\UserParts\_Flags.cshtml"
             
             
             #line default
             #line hidden
             
-            #line 78 "..\..\Views\User\UserParts\_Flags.cshtml"
+            #line 71 "..\..\Views\User\UserParts\_Flags.cshtml"
              using (Html.BeginForm(MVC.API.UserFlagAssignment.RemoveUser()))
             {
+                
+            
+            #line default
+            #line hidden
+            
+            #line 73 "..\..\Views\User\UserParts\_Flags.cshtml"
+           Write(Html.AntiForgeryToken());
+
+            
+            #line default
+            #line hidden
+            
+            #line 73 "..\..\Views\User\UserParts\_Flags.cshtml"
+                                        
 
             
             #line default
@@ -526,7 +533,7 @@ WriteLiteral(" class=\"fa fa-exclamation-triangle fa-lg\"");
 WriteLiteral("></i>&nbsp;Are you sure?\r\n                </p>\r\n");
 
             
-            #line 84 "..\..\Views\User\UserParts\_Flags.cshtml"
+            #line 78 "..\..\Views\User\UserParts\_Flags.cshtml"
             }
 
             
@@ -545,15 +552,29 @@ WriteLiteral(" title=\"Edit the Comments\"");
 WriteLiteral(">\r\n");
 
             
-            #line 87 "..\..\Views\User\UserParts\_Flags.cshtml"
+            #line 81 "..\..\Views\User\UserParts\_Flags.cshtml"
             
             
             #line default
             #line hidden
             
-            #line 87 "..\..\Views\User\UserParts\_Flags.cshtml"
+            #line 81 "..\..\Views\User\UserParts\_Flags.cshtml"
              using (Html.BeginForm(MVC.API.UserFlagAssignment.UpdateComments()))
             {
+                
+            
+            #line default
+            #line hidden
+            
+            #line 83 "..\..\Views\User\UserParts\_Flags.cshtml"
+           Write(Html.AntiForgeryToken());
+
+            
+            #line default
+            #line hidden
+            
+            #line 83 "..\..\Views\User\UserParts\_Flags.cshtml"
+                                        
 
             
             #line default
@@ -593,7 +614,7 @@ WriteLiteral(" class=\"block\"");
 WriteLiteral("></textarea>\r\n                </p>\r\n");
 
             
-            #line 95 "..\..\Views\User\UserParts\_Flags.cshtml"
+            #line 90 "..\..\Views\User\UserParts\_Flags.cshtml"
             }
 
             
@@ -651,7 +672,7 @@ WriteLiteral(">\r\n            $(function () {\r\n                var userFlags
 ";\r\n            });\r\n        </script>\r\n");
 
             
-            #line 174 "..\..\Views\User\UserParts\_Flags.cshtml"
+            #line 169 "..\..\Views\User\UserParts\_Flags.cshtml"
     }
     else
     {
@@ -666,7 +687,7 @@ WriteLiteral(" class=\"none\"");
 WriteLiteral(">This user has no associated flags</div>\r\n");
 
             
-            #line 178 "..\..\Views\User\UserParts\_Flags.cshtml"
+            #line 173 "..\..\Views\User\UserParts\_Flags.cshtml"
     }
 
             
@@ -676,7 +697,7 @@ WriteLiteral("    <script>\r\n        $(\'#UserDetailTabItems\').append(\'<li><a
 "b-Flags\">Flags [");
 
             
-            #line 180 "..\..\Views\User\UserParts\_Flags.cshtml"
+            #line 175 "..\..\Views\User\UserParts\_Flags.cshtml"
                                                                               Write(activeAssignmentCount);
 
             

Disco.Web/Views/User/UserParts/_Subject.cshtml

@@ -236,12 +236,13 @@
                                 </script>
                             }
                         }
-                        @if (Model.User.CanAddUserFlags() && Model.AvailableUserFlags != null && Model.AvailableUserFlags.Count > 0)
+                        @if (Model.AvailableUserFlags != null && Model.AvailableUserFlags.Count > 0)
                         {
-                            @Html.ActionLinkSmallButton("Add Flag", MVC.API.UserFlagAssignment.AddUser(), "User_Show_Details_Actions_AddFlag_Button")
+                            <button id="User_Show_Details_Actions_AddFlag_Button" type="button" class="button small">Add Flag</button>
                             <div id="User_Show_Details_Actions_AddFlag_Dialog" class="dialog" title="Add User Flag">
                                 @using (Html.BeginForm(MVC.API.UserFlagAssignment.AddUser()))
                                 {
+                                    @Html.AntiForgeryToken()
                                     <input id="User_Show_Details_Actions_AddFlag_Dialog_Id" type="hidden" name="id" />
                                     <input id="User_Show_Details_Actions_AddFlag_Dialog_UserId" type="hidden" name="UserId" value="@Model.User.UserId" />
                                     <div class="flagPicker">
@@ -265,7 +266,6 @@
                                 $(function () {
                                     const button = $('#User_Show_Details_Actions_AddFlag_Button');
                                     let buttonDialog = null;
-                                    const buttonLink = button.attr('href');
 
                                     let flagPicker = null;
                                     let flagAddId = null;
@@ -285,7 +285,7 @@
                                         flagAddComments.focus().select();
                                     }
 
-                                    button.attr('href', '#').click(function (e) {
+                                    button.click(function (e) {
                                         e.preventDefault();
 
                                         if (!buttonDialog) {
@@ -302,10 +302,9 @@
                                                     },
                                                     "Add Flag": function () {
                                                         if (!!flagAddId.val()) {
-                                                            const $this = $(this);
-                                                            $this.dialog("disable");
-                                                            $this.dialog("option", "buttons", null);
-                                                            buttonDialog.find('form').submit();
+                                                            buttonDialog
+                                                                .dialog("option", "buttons", null)
+                                                                .find('form').submit();
                                                         } else {
                                                             alert('Select a User Flag');
                                                         }
@@ -437,20 +436,22 @@
                                                             <span class="User_Show_AssignedDevices_CurrentAssignment_Assigned">@CommonHelpers.FriendlyDate(assignment.AssignedDate)</span>
                                                         </td>
                                                     </tr>
-                                                    @if (Authorization.Has(Claims.Device.ShowFlagAssignments) &&
-                                                        assignment.Device.DeviceFlagAssignments.Any(a => a.RemovedDate.HasValue))
+                                                    @if (assignment.Device.DeviceFlagAssignments.CanShowAny())
                                                     {
                                                         <tr>
                                                             <td colspan="2">
                                                                 <div class="User_Show_Assigned_Devices_CurrentAssignment_Flags">
                                                                     @foreach (var flag in assignment.Device.DeviceFlagAssignments.Where(f => !f.RemovedDate.HasValue).Select(f => Tuple.Create(f, DeviceFlagService.GetDeviceFlag(f.DeviceFlagId))))
                                                                     {
-                                                                        <i class="flag fa fa-@(flag.Item2.Icon) fa-fw d-@(flag.Item2.IconColour)">
-                                                                            <span class="details">
-                                                                                <span class="name">@flag.Item2.Name</span>@if (flag.Item1.Comments != null)
-                                                                                {<span class="comments">@flag.Item1.Comments.ToHtmlComment()</span>}<span class="added">@CommonHelpers.FriendlyDateAndUser(flag.Item1.AddedDate, flag.Item1.AddedUserId)</span>
-                                                                            </span>
-                                                                        </i>
+                                                                        if (flag.Item2.permission.CanShow())
+                                                                        {
+                                                                            <i class="flag fa fa-@(flag.Item2.flag.Icon) fa-fw d-@(flag.Item2.flag.IconColour)">
+                                                                                <span class="details">
+                                                                                    <span class="name">@flag.Item2.flag.Name</span>@if (flag.Item1.Comments != null)
+                                                                                    {<span class="comments">@flag.Item1.Comments.ToHtmlComment()</span>}<span class="added">@CommonHelpers.FriendlyDateAndUser(flag.Item1.AddedDate, flag.Item1.AddedUserId)</span>
+                                                                                </span>
+                                                                            </i>
+                                                                        }
                                                                     }
                                                                     <script type="text/javascript">
                                                                         $(function () {

Disco.Web/Views/User/UserParts/_Subject.generated.cs

@@ -893,26 +893,22 @@ WriteLiteral("                        ");
 
             
             #line 239 "..\..\Views\User\UserParts\_Subject.cshtml"
-                         if (Model.User.CanAddUserFlags() && Model.AvailableUserFlags != null && Model.AvailableUserFlags.Count > 0)
+                         if (Model.AvailableUserFlags != null && Model.AvailableUserFlags.Count > 0)
                         {
-                            
-            
-            #line default
-            #line hidden
-            
-            #line 241 "..\..\Views\User\UserParts\_Subject.cshtml"
-                       Write(Html.ActionLinkSmallButton("Add Flag", MVC.API.UserFlagAssignment.AddUser(), "User_Show_Details_Actions_AddFlag_Button"));
 
             
             #line default
             #line hidden
-            
-            #line 241 "..\..\Views\User\UserParts\_Subject.cshtml"
-                                                                                                                                                     
+WriteLiteral("                            <button");
+
+WriteLiteral(" id=\"User_Show_Details_Actions_AddFlag_Button\"");
+
+WriteLiteral(" type=\"button\"");
+
+WriteLiteral(" class=\"button small\"");
+
+WriteLiteral(">Add Flag</button>\r\n");
 
-            
-            #line default
-            #line hidden
 WriteLiteral("                            <div");
 
 WriteLiteral(" id=\"User_Show_Details_Actions_AddFlag_Dialog\"");
@@ -933,6 +929,20 @@ WriteLiteral(">\r\n");
             #line 243 "..\..\Views\User\UserParts\_Subject.cshtml"
                                  using (Html.BeginForm(MVC.API.UserFlagAssignment.AddUser()))
                                 {
+                                    
+            
+            #line default
+            #line hidden
+            
+            #line 245 "..\..\Views\User\UserParts\_Subject.cshtml"
+                               Write(Html.AntiForgeryToken());
+
+            
+            #line default
+            #line hidden
+            
+            #line 245 "..\..\Views\User\UserParts\_Subject.cshtml"
+                                                            
 
             
             #line default
@@ -955,14 +965,14 @@ WriteLiteral(" type=\"hidden\"");
 
 WriteLiteral(" name=\"UserId\"");
 
-WriteAttribute("value", Tuple.Create(" value=\"", 16008), Tuple.Create("\"", 16034)
+WriteAttribute("value", Tuple.Create(" value=\"", 16023), Tuple.Create("\"", 16049)
             
-            #line 246 "..\..\Views\User\UserParts\_Subject.cshtml"
-                                                  , Tuple.Create(Tuple.Create("", 16016), Tuple.Create<System.Object, System.Int32>(Model.User.UserId
+            #line 247 "..\..\Views\User\UserParts\_Subject.cshtml"
+                                                  , Tuple.Create(Tuple.Create("", 16031), Tuple.Create<System.Object, System.Int32>(Model.User.UserId
             
             #line default
             #line hidden
-, 16016), false)
+, 16031), false)
 );
 
 WriteLiteral(" />\r\n");
@@ -984,13 +994,13 @@ WriteLiteral(" autocomplete=\"off\"");
 WriteLiteral(" />\r\n");
 
             
-            #line 249 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 250 "..\..\Views\User\UserParts\_Subject.cshtml"
                                         
             
             #line default
             #line hidden
             
-            #line 249 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 250 "..\..\Views\User\UserParts\_Subject.cshtml"
                                          foreach (var userFlag in Model.AvailableUserFlags.OrderBy(jq => jq.Name))
                                         {
 
@@ -1004,7 +1014,7 @@ WriteLiteral(" class=\"flag\"");
 WriteLiteral(" data-userflagid=\"");
 
             
-            #line 251 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 252 "..\..\Views\User\UserParts\_Subject.cshtml"
                                                                            Write(userFlag.Id);
 
             
@@ -1015,7 +1025,7 @@ WriteLiteral("\"");
 WriteLiteral(" data-userflagname=\"");
 
             
-            #line 251 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 252 "..\..\Views\User\UserParts\_Subject.cshtml"
                                                                                                              Write(userFlag.Name);
 
             
@@ -1025,32 +1035,32 @@ WriteLiteral("\"");
 
 WriteLiteral(">\r\n                                                <i");
 
-WriteAttribute("class", Tuple.Create(" class=\"", 16599), Tuple.Create("\"", 16666)
-, Tuple.Create(Tuple.Create("", 16607), Tuple.Create("fa", 16607), true)
-, Tuple.Create(Tuple.Create(" ", 16609), Tuple.Create("fa-", 16610), true)
+WriteAttribute("class", Tuple.Create(" class=\"", 16614), Tuple.Create("\"", 16681)
+, Tuple.Create(Tuple.Create("", 16622), Tuple.Create("fa", 16622), true)
+, Tuple.Create(Tuple.Create(" ", 16624), Tuple.Create("fa-", 16625), true)
             
-            #line 252 "..\..\Views\User\UserParts\_Subject.cshtml"
-, Tuple.Create(Tuple.Create("", 16613), Tuple.Create<System.Object, System.Int32>(userFlag.Icon
+            #line 253 "..\..\Views\User\UserParts\_Subject.cshtml"
+, Tuple.Create(Tuple.Create("", 16628), Tuple.Create<System.Object, System.Int32>(userFlag.Icon
             
             #line default
             #line hidden
-, 16613), false)
-, Tuple.Create(Tuple.Create(" ", 16629), Tuple.Create("fa-fw", 16630), true)
-, Tuple.Create(Tuple.Create(" ", 16635), Tuple.Create("fa-lg", 16636), true)
-, Tuple.Create(Tuple.Create(" ", 16641), Tuple.Create("d-", 16642), true)
+, 16628), false)
+, Tuple.Create(Tuple.Create(" ", 16644), Tuple.Create("fa-fw", 16645), true)
+, Tuple.Create(Tuple.Create(" ", 16650), Tuple.Create("fa-lg", 16651), true)
+, Tuple.Create(Tuple.Create(" ", 16656), Tuple.Create("d-", 16657), true)
             
-            #line 252 "..\..\Views\User\UserParts\_Subject.cshtml"
-               , Tuple.Create(Tuple.Create("", 16644), Tuple.Create<System.Object, System.Int32>(userFlag.IconColour
+            #line 253 "..\..\Views\User\UserParts\_Subject.cshtml"
+               , Tuple.Create(Tuple.Create("", 16659), Tuple.Create<System.Object, System.Int32>(userFlag.IconColour
             
             #line default
             #line hidden
-, 16644), false)
+, 16659), false)
 );
 
 WriteLiteral("></i>");
 
             
-            #line 252 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 253 "..\..\Views\User\UserParts\_Subject.cshtml"
                                                                                                                       Write(userFlag.Name);
 
             
@@ -1059,7 +1069,7 @@ WriteLiteral("></i>");
 WriteLiteral("\r\n                                            </div>\r\n");
 
             
-            #line 254 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 255 "..\..\Views\User\UserParts\_Subject.cshtml"
                                         }
 
             
@@ -1083,7 +1093,7 @@ WriteLiteral("></textarea>\r\n                                        </div>\r\n
 "                 </div>\r\n");
 
             
-            #line 262 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 263 "..\..\Views\User\UserParts\_Subject.cshtml"
                                 }
 
             
@@ -1097,72 +1107,69 @@ WriteLiteral(" type=\"text/javascript\"");
 
 WriteLiteral(">\r\n                                $(function () {\r\n                             " +
 "       const button = $(\'#User_Show_Details_Actions_AddFlag_Button\');\r\n         " +
-"                           let buttonDialog = null;\r\n                           " +
-"         const buttonLink = button.attr(\'href\');\r\n\r\n                            " +
-"        let flagPicker = null;\r\n                                    let flagAddI" +
-"d = null;\r\n                                    let flagAddComments = null;\r\n    " +
-"                                let details = null;\r\n\r\n                         " +
-"           function flagSelected() {\r\n                                        co" +
-"nst flag = $(this);\r\n\r\n                                        flagPicker.childr" +
-"en().removeClass(\'selected\');\r\n                                        flag.addC" +
-"lass(\'selected\');\r\n\r\n                                        flagAddId.val(flag." +
-"attr(\'data-userflagid\'));\r\n\r\n                                        details.sho" +
-"w();\r\n\r\n                                        flagAddComments.focus().select()" +
-";\r\n                                    }\r\n\r\n                                    " +
-"button.attr(\'href\', \'#\').click(function (e) {\r\n                                 " +
-"       e.preventDefault();\r\n\r\n                                        if (!butto" +
-"nDialog) {\r\n                                            buttonDialog = $(\'#User_" +
-"Show_Details_Actions_AddFlag_Dialog\');\r\n                                        " +
-"    buttonDialog.dialog({\r\n                                                width" +
-": 600,\r\n                                                height: 410,\r\n          " +
-"                                      resizable: false,\r\n                       " +
-"                         modal: true,\r\n                                         " +
-"       autoOpen: false,\r\n                                                buttons" +
-": {\r\n                                                    Cancel: function () {\r\n" +
-"                                                        $(this).dialog(\"close\");" +
-"\r\n                                                    },\r\n                      " +
-"                              \"Add Flag\": function () {\r\n                       " +
-"                                 if (!!flagAddId.val()) {\r\n                     " +
-"                                       const $this = $(this);\r\n                 " +
-"                                           $this.dialog(\"disable\");\r\n           " +
-"                                                 $this.dialog(\"option\", \"buttons" +
-"\", null);\r\n                                                            buttonDia" +
-"log.find(\'form\').submit();\r\n                                                    " +
-"    } else {\r\n                                                            alert(" +
-"\'Select a User Flag\');\r\n                                                        " +
-"}\r\n                                                    }\r\n                      " +
-"                          }\r\n                                            });\r\n\r\n" +
-"                                            flagAddId = $(\'#User_Show_Details_Ac" +
-"tions_AddFlag_Dialog_Id\');\r\n                                            flagAddC" +
-"omments = buttonDialog.find(\'#User_Show_Details_Actions_AddFlag_Dialog_Comments\'" +
-");\r\n                                            flagPicker = buttonDialog.find(\'" +
-".flagPicker\');\r\n                                            details = buttonDial" +
-"og.find(\'.details\');\r\n\r\n                                            $(\'#User_Sho" +
-"w_Details_Actions_AddFlag_Dialog_Filter\').on(\'keyup\', function (e) {\r\n          " +
-"                                      const filter = $(e.currentTarget).val().to" +
-"LowerCase();\r\n                                                if (filter) {\r\n   " +
-"                                                 flagPicker.children(\'div.flag\')" +
-".each(function () {\r\n                                                        con" +
-"st $this = $(this);\r\n                                                        if " +
-"($this.attr(\'data-userflagname\').toLowerCase().indexOf(filter) >= 0) {\r\n        " +
-"                                                    $this.css(\'display\', \'block\'" +
-");\r\n                                                        } else {\r\n          " +
-"                                                  $this.css(\'display\', \'none\');\r" +
-"\n                                                        }\r\n                    " +
-"                                });\r\n                                           " +
-"     } else {\r\n                                                    flagPicker.ch" +
-"ildren(\'div.flag\').each(function () { $(this).css(\'display\', \'block\'); });\r\n    " +
-"                                            }\r\n                                 " +
-"           });\r\n\r\n                                            flagPicker.on(\'cli" +
-"ck\', \'div.flag\', flagSelected);\r\n                                        }\r\n\r\n  " +
-"                                      $(\'#User_Show_Details_Actions_AddFlag_Dial" +
-"og_Filter\').val(\'\');\r\n                                        buttonDialog.dialo" +
-"g(\'open\');\r\n                                        return false;\r\n             " +
-"                       });\r\n                                });\r\n               " +
-"             </script>\r\n");
+"                           let buttonDialog = null;\r\n\r\n                         " +
+"           let flagPicker = null;\r\n                                    let flagA" +
+"ddId = null;\r\n                                    let flagAddComments = null;\r\n " +
+"                                   let details = null;\r\n\r\n                      " +
+"              function flagSelected() {\r\n                                       " +
+" const flag = $(this);\r\n\r\n                                        flagPicker.chi" +
+"ldren().removeClass(\'selected\');\r\n                                        flag.a" +
+"ddClass(\'selected\');\r\n\r\n                                        flagAddId.val(fl" +
+"ag.attr(\'data-userflagid\'));\r\n\r\n                                        details." +
+"show();\r\n\r\n                                        flagAddComments.focus().selec" +
+"t();\r\n                                    }\r\n\r\n                                 " +
+"   button.click(function (e) {\r\n                                        e.preven" +
+"tDefault();\r\n\r\n                                        if (!buttonDialog) {\r\n   " +
+"                                         buttonDialog = $(\'#User_Show_Details_Ac" +
+"tions_AddFlag_Dialog\');\r\n                                            buttonDialo" +
+"g.dialog({\r\n                                                width: 600,\r\n       " +
+"                                         height: 410,\r\n                         " +
+"                       resizable: false,\r\n                                      " +
+"          modal: true,\r\n                                                autoOpen" +
+": false,\r\n                                                buttons: {\r\n          " +
+"                                          Cancel: function () {\r\n               " +
+"                                         $(this).dialog(\"close\");\r\n             " +
+"                                       },\r\n                                     " +
+"               \"Add Flag\": function () {\r\n                                      " +
+"                  if (!!flagAddId.val()) {\r\n                                    " +
+"                        buttonDialog\r\n                                          " +
+"                      .dialog(\"option\", \"buttons\", null)\r\n                      " +
+"                                          .find(\'form\').submit();\r\n             " +
+"                                           } else {\r\n                           " +
+"                                 alert(\'Select a User Flag\');\r\n                 " +
+"                                       }\r\n                                      " +
+"              }\r\n                                                }\r\n            " +
+"                                });\r\n\r\n                                         " +
+"   flagAddId = $(\'#User_Show_Details_Actions_AddFlag_Dialog_Id\');\r\n             " +
+"                               flagAddComments = buttonDialog.find(\'#User_Show_D" +
+"etails_Actions_AddFlag_Dialog_Comments\');\r\n                                     " +
+"       flagPicker = buttonDialog.find(\'.flagPicker\');\r\n                         " +
+"                   details = buttonDialog.find(\'.details\');\r\n\r\n                 " +
+"                           $(\'#User_Show_Details_Actions_AddFlag_Dialog_Filter\')" +
+".on(\'keyup\', function (e) {\r\n                                                con" +
+"st filter = $(e.currentTarget).val().toLowerCase();\r\n                           " +
+"                     if (filter) {\r\n                                            " +
+"        flagPicker.children(\'div.flag\').each(function () {\r\n                    " +
+"                                    const $this = $(this);\r\n                    " +
+"                                    if ($this.attr(\'data-userflagname\').toLowerC" +
+"ase().indexOf(filter) >= 0) {\r\n                                                 " +
+"           $this.css(\'display\', \'block\');\r\n                                     " +
+"                   } else {\r\n                                                   " +
+"         $this.css(\'display\', \'none\');\r\n                                        " +
+"                }\r\n                                                    });\r\n    " +
+"                                            } else {\r\n                          " +
+"                          flagPicker.children(\'div.flag\').each(function () { $(t" +
+"his).css(\'display\', \'block\'); });\r\n                                             " +
+"   }\r\n                                            });\r\n\r\n                       " +
+"                     flagPicker.on(\'click\', \'div.flag\', flagSelected);\r\n        " +
+"                                }\r\n\r\n                                        $(\'" +
+"#User_Show_Details_Actions_AddFlag_Dialog_Filter\').val(\'\');\r\n                   " +
+"                     buttonDialog.dialog(\'open\');\r\n                             " +
+"           return false;\r\n                                    });\r\n             " +
+"                   });\r\n                            </script>\r\n");
 
             
-            #line 346 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 345 "..\..\Views\User\UserParts\_Subject.cshtml"
                         }
 
             
@@ -1171,13 +1178,13 @@ WriteLiteral(">\r\n                                $(function () {\r\n
 WriteLiteral("                    </div>\r\n                </div>\r\n            </td>\r\n");
 
             
-            #line 350 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 349 "..\..\Views\User\UserParts\_Subject.cshtml"
             
             
             #line default
             #line hidden
             
-            #line 350 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 349 "..\..\Views\User\UserParts\_Subject.cshtml"
              if (Authorization.Has(Claims.User.ShowAssignments))
             {
 
@@ -1195,13 +1202,13 @@ WriteLiteral(" id=\"User_Show_AssignedDevices_Active\"");
 WriteLiteral(">\r\n                            <h3>Current Device Assignments</h3>\r\n");
 
             
-            #line 356 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 355 "..\..\Views\User\UserParts\_Subject.cshtml"
                             
             
             #line default
             #line hidden
             
-            #line 356 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 355 "..\..\Views\User\UserParts\_Subject.cshtml"
                              if (currentDeviceAssignments.Count > 0)
                             {
                                 foreach (var assignment in currentDeviceAssignments)
@@ -1217,7 +1224,7 @@ WriteLiteral(" class=\"User_Show_AssignedDevices_CurrentAssignment clearfix\"");
 WriteLiteral(" data-deviceserialnumber=\"");
 
             
-            #line 360 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 359 "..\..\Views\User\UserParts\_Subject.cshtml"
                                                                                                                           Write(assignment.DeviceSerialNumber);
 
             
@@ -1228,13 +1235,13 @@ WriteLiteral("\"");
 WriteLiteral(">\r\n");
 
             
-            #line 361 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 360 "..\..\Views\User\UserParts\_Subject.cshtml"
                                         
             
             #line default
             #line hidden
             
-            #line 361 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 360 "..\..\Views\User\UserParts\_Subject.cshtml"
                                          if (Authorization.Has(Claims.Device.Show))
                                         {
 
@@ -1243,14 +1250,14 @@ WriteLiteral(">\r\n");
             #line hidden
 WriteLiteral("                                            <a");
 
-WriteAttribute("href", Tuple.Create(" href=\"", 23450), Tuple.Create("\"", 23517)
+WriteAttribute("href", Tuple.Create(" href=\"", 23264), Tuple.Create("\"", 23331)
             
-            #line 363 "..\..\Views\User\UserParts\_Subject.cshtml"
-, Tuple.Create(Tuple.Create("", 23457), Tuple.Create<System.Object, System.Int32>(Url.Action(MVC.Device.Show(assignment.Device.SerialNumber))
+            #line 362 "..\..\Views\User\UserParts\_Subject.cshtml"
+, Tuple.Create(Tuple.Create("", 23271), Tuple.Create<System.Object, System.Int32>(Url.Action(MVC.Device.Show(assignment.Device.SerialNumber))
             
             #line default
             #line hidden
-, 23457), false)
+, 23271), false)
 );
 
 WriteLiteral(">\r\n                                                <img");
@@ -1259,20 +1266,20 @@ WriteLiteral(" class=\"User_Show_AssignedDevices_CurrentAssignment_Image\"");
 
 WriteLiteral(" alt=\"Model Image\"");
 
-WriteAttribute("src", Tuple.Create(" src=\"", 23649), Tuple.Create("\"", 23770)
+WriteAttribute("src", Tuple.Create(" src=\"", 23463), Tuple.Create("\"", 23584)
             
-            #line 364 "..\..\Views\User\UserParts\_Subject.cshtml"
-                                                     , Tuple.Create(Tuple.Create("", 23655), Tuple.Create<System.Object, System.Int32>(Url.Action(MVC.API.DeviceModel.Image(assignment.Device.DeviceModel.Id, assignment.Device.DeviceModel.ImageHash()))
+            #line 363 "..\..\Views\User\UserParts\_Subject.cshtml"
+                                                     , Tuple.Create(Tuple.Create("", 23469), Tuple.Create<System.Object, System.Int32>(Url.Action(MVC.API.DeviceModel.Image(assignment.Device.DeviceModel.Id, assignment.Device.DeviceModel.ImageHash()))
             
             #line default
             #line hidden
-, 23655), false)
+, 23469), false)
 );
 
 WriteLiteral(" />\r\n                                            </a>\r\n");
 
             
-            #line 366 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 365 "..\..\Views\User\UserParts\_Subject.cshtml"
                                         }
                                         else
                                         {
@@ -1286,20 +1293,20 @@ WriteLiteral(" class=\"User_Show_AssignedDevices_CurrentAssignment_Image\"");
 
 WriteLiteral(" alt=\"Model Image\"");
 
-WriteAttribute("src", Tuple.Create(" src=\"", 24082), Tuple.Create("\"", 24203)
+WriteAttribute("src", Tuple.Create(" src=\"", 23896), Tuple.Create("\"", 24017)
             
-            #line 369 "..\..\Views\User\UserParts\_Subject.cshtml"
-                                                 , Tuple.Create(Tuple.Create("", 24088), Tuple.Create<System.Object, System.Int32>(Url.Action(MVC.API.DeviceModel.Image(assignment.Device.DeviceModel.Id, assignment.Device.DeviceModel.ImageHash()))
+            #line 368 "..\..\Views\User\UserParts\_Subject.cshtml"
+                                                 , Tuple.Create(Tuple.Create("", 23902), Tuple.Create<System.Object, System.Int32>(Url.Action(MVC.API.DeviceModel.Image(assignment.Device.DeviceModel.Id, assignment.Device.DeviceModel.ImageHash()))
             
             #line default
             #line hidden
-, 24088), false)
+, 23902), false)
 );
 
 WriteLiteral(" />\r\n");
 
             
-            #line 370 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 369 "..\..\Views\User\UserParts\_Subject.cshtml"
                                         }
 
             
@@ -1327,13 +1334,13 @@ WriteLiteral(" class=\"User_Show_AssignedDevices_CurrentAssignment_SerialNumber\
 WriteLiteral(" data-clipboard>\r\n");
 
             
-            #line 380 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 379 "..\..\Views\User\UserParts\_Subject.cshtml"
                                                                 
             
             #line default
             #line hidden
             
-            #line 380 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 379 "..\..\Views\User\UserParts\_Subject.cshtml"
                                                                  if (Authorization.Has(Claims.Device.Show))
                                                                 {
                                                                     
@@ -1341,14 +1348,14 @@ WriteLiteral(" data-clipboard>\r\n");
             #line default
             #line hidden
             
-            #line 382 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 381 "..\..\Views\User\UserParts\_Subject.cshtml"
                                                                Write(Html.ActionLink(assignment.Device.SerialNumber, MVC.Device.Show(assignment.Device.SerialNumber)));
 
             
             #line default
             #line hidden
             
-            #line 382 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 381 "..\..\Views\User\UserParts\_Subject.cshtml"
                                                                                                                                                                      
                                                                 }
                                                                 else
@@ -1358,14 +1365,14 @@ WriteLiteral(" data-clipboard>\r\n");
             #line default
             #line hidden
             
-            #line 386 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 385 "..\..\Views\User\UserParts\_Subject.cshtml"
                                                                Write(assignment.Device.SerialNumber);
 
             
             #line default
             #line hidden
             
-            #line 386 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 385 "..\..\Views\User\UserParts\_Subject.cshtml"
                                                                                                    
                                                                 }
 
@@ -1375,13 +1382,13 @@ WriteLiteral(" data-clipboard>\r\n");
 WriteLiteral("                                                            </span>\r\n");
 
             
-            #line 389 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 388 "..\..\Views\User\UserParts\_Subject.cshtml"
                                                             
             
             #line default
             #line hidden
             
-            #line 389 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 388 "..\..\Views\User\UserParts\_Subject.cshtml"
                                                              if (!string.IsNullOrWhiteSpace(assignment.Device.ComputerName))
                                                             {
 
@@ -1397,7 +1404,7 @@ WriteLiteral(" class=\"User_Show_AssignedDevices_CurrentAssignment_ComputerName\
 WriteLiteral(" data-clipboard>");
 
             
-            #line 391 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 390 "..\..\Views\User\UserParts\_Subject.cshtml"
                                                                                                                                                         Write(assignment.Device.ComputerName);
 
             
@@ -1408,7 +1415,7 @@ WriteLiteral("</span>)");
 WriteLiteral("\r\n");
 
             
-            #line 392 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 391 "..\..\Views\User\UserParts\_Subject.cshtml"
                                                             }
 
             
@@ -1418,13 +1425,13 @@ WriteLiteral("                                                        </td>\r\n
 "                                  </tr>\r\n");
 
             
-            #line 395 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 394 "..\..\Views\User\UserParts\_Subject.cshtml"
                                                     
             
             #line default
             #line hidden
             
-            #line 395 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 394 "..\..\Views\User\UserParts\_Subject.cshtml"
                                                      if (!string.IsNullOrEmpty(assignment.Device.AssetNumber))
                                                     {
 
@@ -1441,7 +1448,7 @@ WriteLiteral(" class=\"User_Show_AssignedDevices_CurrentAssignment_Asset\"");
 WriteLiteral(" data-clipboard>");
 
             
-            #line 400 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 399 "..\..\Views\User\UserParts\_Subject.cshtml"
                                                                                                                                           Write(assignment.Device.AssetNumber);
 
             
@@ -1451,7 +1458,7 @@ WriteLiteral("</span>\r\n
 "                                                   </tr>\r\n");
 
             
-            #line 403 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 402 "..\..\Views\User\UserParts\_Subject.cshtml"
                                                     }
 
             
@@ -1460,7 +1467,7 @@ WriteLiteral("</span>\r\n
 WriteLiteral("                                                    ");
 
             
-            #line 404 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 403 "..\..\Views\User\UserParts\_Subject.cshtml"
                                                      if (assignment.Device.DeviceModelId.HasValue)
                                                     {
 
@@ -1479,7 +1486,7 @@ WriteLiteral(" class=\"User_Show_AssignedDevices_CurrentAssignment_Model\"");
 WriteLiteral(">");
 
             
-            #line 411 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 410 "..\..\Views\User\UserParts\_Subject.cshtml"
                                                                                                                            Write(assignment.Device.DeviceModel.ToString());
 
             
@@ -1489,7 +1496,7 @@ WriteLiteral("</span>\r\n
 "                                                   </tr>\r\n");
 
             
-            #line 414 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 413 "..\..\Views\User\UserParts\_Subject.cshtml"
                                                     }
 
             
@@ -1507,7 +1514,7 @@ WriteLiteral(" class=\"User_Show_AssignedDevices_CurrentAssignment_Profile\"");
 WriteLiteral(">");
 
             
-            #line 420 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 419 "..\..\Views\User\UserParts\_Subject.cshtml"
                                                                                                                          Write(assignment.Device.DeviceProfile.ToString());
 
             
@@ -1517,13 +1524,13 @@ WriteLiteral("</span>\r\n
 "                                           </tr>\r\n");
 
             
-            #line 423 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 422 "..\..\Views\User\UserParts\_Subject.cshtml"
                                                     
             
             #line default
             #line hidden
             
-            #line 423 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 422 "..\..\Views\User\UserParts\_Subject.cshtml"
                                                      if (assignment.Device.DeviceBatchId.HasValue)
                                                     {
 
@@ -1542,7 +1549,7 @@ WriteLiteral(" class=\"User_Show_AssignedDevices_CurrentAssignment_Batch\"");
 WriteLiteral(">");
 
             
-            #line 430 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 429 "..\..\Views\User\UserParts\_Subject.cshtml"
                                                                                                                            Write(assignment.Device.DeviceBatch.ToString());
 
             
@@ -1552,7 +1559,7 @@ WriteLiteral("</span>\r\n
 "                                                   </tr>\r\n");
 
             
-            #line 433 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 432 "..\..\Views\User\UserParts\_Subject.cshtml"
                                                     }
 
             
@@ -1568,7 +1575,7 @@ WriteLiteral(" class=\"User_Show_AssignedDevices_CurrentAssignment_Assigned\"");
 WriteLiteral(">");
 
             
-            #line 437 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 436 "..\..\Views\User\UserParts\_Subject.cshtml"
                                                                                                                           Write(CommonHelpers.FriendlyDate(assignment.AssignedDate));
 
             
@@ -1578,15 +1585,14 @@ WriteLiteral("</span>\r\n
 "                                           </tr>\r\n");
 
             
-            #line 440 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 439 "..\..\Views\User\UserParts\_Subject.cshtml"
                                                     
             
             #line default
             #line hidden
             
-            #line 440 "..\..\Views\User\UserParts\_Subject.cshtml"
-                                                     if (Authorization.Has(Claims.Device.ShowFlagAssignments) &&
-                                                        assignment.Device.DeviceFlagAssignments.Any(a => a.RemovedDate.HasValue))
+            #line 439 "..\..\Views\User\UserParts\_Subject.cshtml"
+                                                     if (assignment.Device.DeviceFlagAssignments.CanShowAny())
                                                     {
 
             
@@ -1604,50 +1610,52 @@ WriteLiteral(" class=\"User_Show_Assigned_Devices_CurrentAssignment_Flags\"");
 WriteLiteral(">\r\n");
 
             
-            #line 446 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 444 "..\..\Views\User\UserParts\_Subject.cshtml"
                                                                     
             
             #line default
             #line hidden
             
-            #line 446 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 444 "..\..\Views\User\UserParts\_Subject.cshtml"
                                                                      foreach (var flag in assignment.Device.DeviceFlagAssignments.Where(f => !f.RemovedDate.HasValue).Select(f => Tuple.Create(f, DeviceFlagService.GetDeviceFlag(f.DeviceFlagId))))
                                                                     {
+                                                                        if (flag.Item2.permission.CanShow())
+                                                                        {
 
             
             #line default
             #line hidden
-WriteLiteral("                                                                        <i");
+WriteLiteral("                                                                            <i");
 
-WriteAttribute("class", Tuple.Create(" class=\"", 30837), Tuple.Create("\"", 30907)
-, Tuple.Create(Tuple.Create("", 30845), Tuple.Create("flag", 30845), true)
-, Tuple.Create(Tuple.Create(" ", 30849), Tuple.Create("fa", 30850), true)
-, Tuple.Create(Tuple.Create(" ", 30852), Tuple.Create("fa-", 30853), true)
+WriteAttribute("class", Tuple.Create(" class=\"", 30707), Tuple.Create("\"", 30787)
+, Tuple.Create(Tuple.Create("", 30715), Tuple.Create("flag", 30715), true)
+, Tuple.Create(Tuple.Create(" ", 30719), Tuple.Create("fa", 30720), true)
+, Tuple.Create(Tuple.Create(" ", 30722), Tuple.Create("fa-", 30723), true)
             
             #line 448 "..\..\Views\User\UserParts\_Subject.cshtml"
-             , Tuple.Create(Tuple.Create("", 30856), Tuple.Create<System.Object, System.Int32>(flag.Item2.Icon
+                 , Tuple.Create(Tuple.Create("", 30726), Tuple.Create<System.Object, System.Int32>(flag.Item2.flag.Icon
             
             #line default
             #line hidden
-, 30856), false)
-, Tuple.Create(Tuple.Create(" ", 30874), Tuple.Create("fa-fw", 30875), true)
-, Tuple.Create(Tuple.Create(" ", 30880), Tuple.Create("d-", 30881), true)
+, 30726), false)
+, Tuple.Create(Tuple.Create(" ", 30749), Tuple.Create("fa-fw", 30750), true)
+, Tuple.Create(Tuple.Create(" ", 30755), Tuple.Create("d-", 30756), true)
             
             #line 448 "..\..\Views\User\UserParts\_Subject.cshtml"
-                                        , Tuple.Create(Tuple.Create("", 30883), Tuple.Create<System.Object, System.Int32>(flag.Item2.IconColour
+                                                 , Tuple.Create(Tuple.Create("", 30758), Tuple.Create<System.Object, System.Int32>(flag.Item2.flag.IconColour
             
             #line default
             #line hidden
-, 30883), false)
+, 30758), false)
 );
 
-WriteLiteral(">\r\n                                                                            <s" +
-"pan");
+WriteLiteral(">\r\n                                                                              " +
+"  <span");
 
 WriteLiteral(" class=\"details\"");
 
 WriteLiteral(">\r\n                                                                              " +
-"  <span");
+"      <span");
 
 WriteLiteral(" class=\"name\"");
 
@@ -1655,7 +1663,7 @@ WriteLiteral(">");
 
             
             #line 450 "..\..\Views\User\UserParts\_Subject.cshtml"
-                                                                                              Write(flag.Item2.Name);
+                                                                                                  Write(flag.Item2.flag.Name);
 
             
             #line default
@@ -1664,8 +1672,8 @@ WriteLiteral("</span>");
 
             
             #line 450 "..\..\Views\User\UserParts\_Subject.cshtml"
-                                                                                                                           if (flag.Item1.Comments != null)
-                                                                                {
+                                                                                                                                    if (flag.Item1.Comments != null)
+                                                                                    {
             
             #line default
             #line hidden
@@ -1677,7 +1685,7 @@ WriteLiteral(">");
 
             
             #line 451 "..\..\Views\User\UserParts\_Subject.cshtml"
-                                                                                                   Write(flag.Item1.Comments.ToHtmlComment());
+                                                                                                       Write(flag.Item1.Comments.ToHtmlComment());
 
             
             #line default
@@ -1686,7 +1694,7 @@ WriteLiteral("</span>");
 
             
             #line 451 "..\..\Views\User\UserParts\_Subject.cshtml"
-                                                                                                                                                   }
+                                                                                                                                                       }
             
             #line default
             #line hidden
@@ -1698,17 +1706,18 @@ WriteLiteral(">");
 
             
             #line 451 "..\..\Views\User\UserParts\_Subject.cshtml"
-                                                                                                                                                                   Write(CommonHelpers.FriendlyDateAndUser(flag.Item1.AddedDate, flag.Item1.AddedUserId));
+                                                                                                                                                                       Write(CommonHelpers.FriendlyDateAndUser(flag.Item1.AddedDate, flag.Item1.AddedUserId));
 
             
             #line default
             #line hidden
 WriteLiteral("</span>\r\n                                                                        " +
-"    </span>\r\n                                                                   " +
-"     </i>\r\n");
+"        </span>\r\n                                                               " +
+"             </i>\r\n");
 
             
             #line 454 "..\..\Views\User\UserParts\_Subject.cshtml"
+                                                                        }
                                                                     }
 
             
@@ -1761,7 +1770,7 @@ WriteLiteral(">\r\n
 "           </tr>\r\n");
 
             
-            #line 488 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 489 "..\..\Views\User\UserParts\_Subject.cshtml"
                                                     }
 
             
@@ -1772,7 +1781,7 @@ WriteLiteral("                                                </tbody>\r\n
 "                                   </div>\r\n");
 
             
-            #line 493 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 494 "..\..\Views\User\UserParts\_Subject.cshtml"
                                 }
                             }
                             else
@@ -1788,7 +1797,7 @@ WriteLiteral(" class=\"smallMessage\"");
 WriteLiteral(">No Current Device Assignments</span>\r\n");
 
             
-            #line 498 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 499 "..\..\Views\User\UserParts\_Subject.cshtml"
                             }
 
             
@@ -1798,7 +1807,7 @@ WriteLiteral("                        </div>\r\n                    </div>\r\n
 "\r\n");
 
             
-            #line 502 "..\..\Views\User\UserParts\_Subject.cshtml"
+            #line 503 "..\..\Views\User\UserParts\_Subject.cshtml"
             }
 
             

Disco.Web/Views/User/_UserTable.cshtml

@@ -42,22 +42,22 @@
                             {
                                 @item.FriendlyId
                             }
-                            @if (Authorization.Has(Claims.User.ShowFlagAssignments))
+                            @if (item.UserFlagAssignments.CanShowAny())
                             {
-                                @if (item.UserFlagAssignments != null && item.UserFlagAssignments.Count > 0)
-                                {
-                                    <div class="flags">
-                                        @foreach (var flag in item.UserFlagAssignments.Where(f => !f.RemovedDate.HasValue).Select(f => Tuple.Create(f, UserFlagService.GetUserFlag(f.UserFlagId))))
+                                <div class="flags">
+                                    @foreach (var flag in item.UserFlagAssignments.Where(f => !f.RemovedDate.HasValue).Select(f => Tuple.Create(f, UserFlagService.GetUserFlag(f.UserFlagId))))
+                                    {
+                                        if (flag.Item2.permission.CanShow())
                                         {
-                                            <i class="flag fa fa-@(flag.Item2.Icon) fa-fw d-@(flag.Item2.IconColour)">
+                                            <i class="flag fa fa-@(flag.Item2.flag.Icon) fa-fw d-@(flag.Item2.flag.IconColour)">
                                                 <span class="details">
-                                                    <span class="name">@flag.Item2.Name</span>@if (flag.Item1.Comments != null)
+                                                    <span class="name">@flag.Item2.flag.Name</span>@if (flag.Item1.Comments != null)
                                                     {<span class="comments">@flag.Item1.Comments.ToHtmlComment()</span>}<span class="added">@CommonHelpers.FriendlyDateAndUser(flag.Item1.AddedDate, flag.Item1.AddedUserId)</span>
                                                 </span>
                                             </i>
                                         }
-                                    </div>
-                                }
+                                    }
+                                </div>
                             }
                         </td>
                         <td>

Disco.Web/Views/User/_UserTable.generated.cs

@@ -173,35 +173,29 @@ WriteLiteral("                            ");
 
             
             #line 45 "..\..\Views\User\_UserTable.cshtml"
-                             if (Authorization.Has(Claims.User.ShowFlagAssignments))
+                             if (item.UserFlagAssignments.CanShowAny())
                             {
-                                
-            
-            #line default
-            #line hidden
-            
-            #line 47 "..\..\Views\User\_UserTable.cshtml"
-                                 if (item.UserFlagAssignments != null && item.UserFlagAssignments.Count > 0)
-                                {
 
             
             #line default
             #line hidden
-WriteLiteral("                                    <div");
+WriteLiteral("                                <div");
 
 WriteLiteral(" class=\"flags\"");
 
 WriteLiteral(">\r\n");
 
             
-            #line 50 "..\..\Views\User\_UserTable.cshtml"
-                                        
+            #line 48 "..\..\Views\User\_UserTable.cshtml"
+                                    
             
             #line default
             #line hidden
             
-            #line 50 "..\..\Views\User\_UserTable.cshtml"
-                                         foreach (var flag in item.UserFlagAssignments.Where(f => !f.RemovedDate.HasValue).Select(f => Tuple.Create(f, UserFlagService.GetUserFlag(f.UserFlagId))))
+            #line 48 "..\..\Views\User\_UserTable.cshtml"
+                                     foreach (var flag in item.UserFlagAssignments.Where(f => !f.RemovedDate.HasValue).Select(f => Tuple.Create(f, UserFlagService.GetUserFlag(f.UserFlagId))))
+                                    {
+                                        if (flag.Item2.permission.CanShow())
                                         {
 
             
@@ -209,26 +203,26 @@ WriteLiteral(">\r\n");
             #line hidden
 WriteLiteral("                                            <i");
 
-WriteAttribute("class", Tuple.Create(" class=\"", 2064), Tuple.Create("\"", 2134)
-, Tuple.Create(Tuple.Create("", 2072), Tuple.Create("flag", 2072), true)
-, Tuple.Create(Tuple.Create(" ", 2076), Tuple.Create("fa", 2077), true)
-, Tuple.Create(Tuple.Create(" ", 2079), Tuple.Create("fa-", 2080), true)
+WriteAttribute("class", Tuple.Create(" class=\"", 2015), Tuple.Create("\"", 2095)
+, Tuple.Create(Tuple.Create("", 2023), Tuple.Create("flag", 2023), true)
+, Tuple.Create(Tuple.Create(" ", 2027), Tuple.Create("fa", 2028), true)
+, Tuple.Create(Tuple.Create(" ", 2030), Tuple.Create("fa-", 2031), true)
             
             #line 52 "..\..\Views\User\_UserTable.cshtml"
-, Tuple.Create(Tuple.Create("", 2083), Tuple.Create<System.Object, System.Int32>(flag.Item2.Icon
+, Tuple.Create(Tuple.Create("", 2034), Tuple.Create<System.Object, System.Int32>(flag.Item2.flag.Icon
             
             #line default
             #line hidden
-, 2083), false)
-, Tuple.Create(Tuple.Create(" ", 2101), Tuple.Create("fa-fw", 2102), true)
-, Tuple.Create(Tuple.Create(" ", 2107), Tuple.Create("d-", 2108), true)
+, 2034), false)
+, Tuple.Create(Tuple.Create(" ", 2057), Tuple.Create("fa-fw", 2058), true)
+, Tuple.Create(Tuple.Create(" ", 2063), Tuple.Create("d-", 2064), true)
             
             #line 52 "..\..\Views\User\_UserTable.cshtml"
-             , Tuple.Create(Tuple.Create("", 2110), Tuple.Create<System.Object, System.Int32>(flag.Item2.IconColour
+                  , Tuple.Create(Tuple.Create("", 2066), Tuple.Create<System.Object, System.Int32>(flag.Item2.flag.IconColour
             
             #line default
             #line hidden
-, 2110), false)
+, 2066), false)
 );
 
 WriteLiteral(">\r\n                                                <span");
@@ -243,7 +237,7 @@ WriteLiteral(">");
 
             
             #line 54 "..\..\Views\User\_UserTable.cshtml"
-                                                                  Write(flag.Item2.Name);
+                                                                  Write(flag.Item2.flag.Name);
 
             
             #line default
@@ -252,7 +246,7 @@ WriteLiteral("</span>");
 
             
             #line 54 "..\..\Views\User\_UserTable.cshtml"
-                                                                                               if (flag.Item1.Comments != null)
+                                                                                                    if (flag.Item1.Comments != null)
                                                     {
             
             #line default
@@ -297,20 +291,15 @@ WriteLiteral("</span>\r\n                                                </span>
             
             #line 58 "..\..\Views\User\_UserTable.cshtml"
                                         }
-            
-            #line default
-            #line hidden
-WriteLiteral("\r\n                                    </div>\r\n");
+                                    }
 
             
-            #line 60 "..\..\Views\User\_UserTable.cshtml"
-                                }
-            
             #line default
             #line hidden
+WriteLiteral("                                </div>\r\n");
+
             
-            #line 60 "..\..\Views\User\_UserTable.cshtml"
-                                 
+            #line 61 "..\..\Views\User\_UserTable.cshtml"
                             }