diff --git a/src/VirtoCommerce.ProfileExperienceApiModule.Data/Authorization/ProfileAuthorizationHandler.cs b/src/VirtoCommerce.ProfileExperienceApiModule.Data/Authorization/ProfileAuthorizationHandler.cs index af7122f0..1ad1303b 100644 --- a/src/VirtoCommerce.ProfileExperienceApiModule.Data/Authorization/ProfileAuthorizationHandler.cs +++ b/src/VirtoCommerce.ProfileExperienceApiModule.Data/Authorization/ProfileAuthorizationHandler.cs @@ -170,7 +170,16 @@ protected override async Task HandleRequirementAsync(AuthorizationHandlerContext else if (context.Resource is InviteUserCommand inviteUserCommand && currentContact != null) { var currentUser = await userManager.FindByIdAsync(currentUserId); - result = currentContact.Organizations.Contains(inviteUserCommand.OrganizationId) && currentUser.StoreId.EqualsInvariant(inviteUserCommand.StoreId); + + if (!string.IsNullOrEmpty(inviteUserCommand.OrganizationId) && currentContact != null && currentUser != null) + { + result = currentContact.Organizations.Contains(inviteUserCommand.OrganizationId) + && currentUser.StoreId.EqualsInvariant(inviteUserCommand.StoreId); + } + else if (currentUser != null) + { + result = currentUser.StoreId.EqualsInvariant(inviteUserCommand.StoreId); + } } else if (context.Resource is LockOrganizationContactCommand lockOrganizationContact) {