[PR 2] Add administrative cipher access for Custom Roles (#7938)

* Separate administrative cipher access

* Return NotFound for admin attachments and ungate assigned ciphers

src/api/core/events.rs

@@ -10,7 +10,9 @@ use crate::{
     auth::{AdminHeaders, Headers},
     db::{
         DbConn, DbPool,
-        models::{Cipher, CipherId, Event, EventType, Membership, MembershipId, OrganizationId, UserId},
+        models::{
+            Cipher, CipherAccessScope, CipherId, Event, EventType, Membership, MembershipId, OrganizationId, UserId,
+        },
     },
     error::MapResult,
     util::parse_date,
@@ -220,7 +222,7 @@ async fn post_events_collect(data: Json<Vec<EventCollection>>, headers: Headers,
                 // user can actually access it instead of trusting the provided cipher uuid.
                 if let Some(cipher_uuid) = &event.cipher_id
                     && let Some(cipher) = Cipher::find_by_uuid(cipher_uuid, &conn).await
-                    && cipher.is_accessible_to_user(&headers.user.uuid, &conn).await
+                    && cipher.is_accessible_to_user(&headers.user.uuid, CipherAccessScope::User, &conn).await
                     && let Some(org_id) = cipher.organization_uuid
                 {
                     log_event_impl(