limit collection users with accessall to orgid

src/Core/Models/Data/CollectionUserUserDetails.cs

@@ -6,6 +6,7 @@ namespace Bit.Core.Models.Data
     {
         public Guid? Id { get; set; }
         public Guid OrganizationUserId { get; set; }
+        public Guid? OrganizationId { get; set; }
         public Guid? CollectionId { get; set; }
         public bool AccessAll { get; set; }
         public string Name { get; set; }

src/Sql/dbo/Stored Procedures/CollectionUserUserDetails_ReadByCollectionId.sql

@@ -4,11 +4,17 @@ AS
 BEGIN
     SET NOCOUNT ON
 
+    DECLARE @OrganizationId UNIQUEIDENTIFIER = (SELECT [OrganizationId] FROM [dbo].[Collection] WHERE [Id] = @CollectionId)
+
     SELECT
         *
     FROM
         [dbo].[CollectionUserUserDetailsView]
     WHERE
-        [AccessAll] = 1 
+        [CollectionId] = @CollectionId
-        OR [CollectionId] = @CollectionId
+        OR
-END
+        (
+            [OrganizationId] = @OrganizationId
+            AND [AccessAll] = 1
+        )
+END

src/Sql/dbo/Views/CollectionUserUserDetailsView.sql

@@ -2,6 +2,7 @@
 AS
 SELECT
     OU.[Id] AS [OrganizationUserId],
+    OU.[OrganizationId],
     OU.[AccessAll],
     CU.[Id],
     CU.[CollectionId],