From 9c8b72100e1bee65f90960849d158e8b225bb0dc Mon Sep 17 00:00:00 2001
From: seve12 <severihirvonen578@gmail.com>
Date: Tue, 21 Oct 2025 21:07:29 +0300
Subject: [PATCH] fixed #5909

---
 models/cards.js | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/models/cards.js b/models/cards.js
index 69a34ad32..b78605cb8 100644
--- a/models/cards.js
+++ b/models/cards.js
@@ -2058,6 +2058,29 @@ Cards.mutations({
     Cards.update(this._id, {
       $set: mutatedFields,
     });
+    // Update attachments metadata so access permissions follow the card
+    // Only do this on server to avoid permission issues and to keep DB updates atomic
+    if (Meteor.isServer) {
+      try {
+        const updateMeta = {};
+        if (mutatedFields.boardId !== undefined) updateMeta['meta.boardId'] = mutatedFields.boardId;
+        if (mutatedFields.listId !== undefined) updateMeta['meta.listId'] = mutatedFields.listId;
+        if (mutatedFields.swimlaneId !== undefined) updateMeta['meta.swimlaneId'] = mutatedFields.swimlaneId;
+
+        if (Object.keys(updateMeta).length > 0) {
+          // Attachments is a FilesCollection; underlying Mongo collection is accessible via .collection
+          Attachments.collection.update(
+            { 'meta.cardId': this._id },
+            { $set: updateMeta },
+            { multi: true },
+          );
+        }
+      } catch (err) {
+        // don't block the move if attachment update fails, but log for debugging
+        // eslint-disable-next-line no-console
+        console.error('Failed to update attachments metadata after moving card', this._id, err);
+      }
+    }
   },
 
   addLabel(labelId) {