From 4fbd77660517c7ce5169bbd46bf1ccb52fa71293 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 24 Feb 2026 19:18:27 +0000
Subject: [PATCH] Add client-side ownership checks to update and delete methods

Co-authored-by: derkauzigekoala <79001016+derkauzigekoala@users.noreply.github.com>
---
 lib/services/collection_service.dart | 30 ++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/lib/services/collection_service.dart b/lib/services/collection_service.dart
index 9fd93dd..f59705c 100644
--- a/lib/services/collection_service.dart
+++ b/lib/services/collection_service.dart
@@ -170,6 +170,21 @@ class CollectionService {
     required String name,
     String? description,
   }) async {
+    final userId = supabase.auth.currentUser!.id;
+
+    final collection = await supabase
+        .from('collections')
+        .select('owner_id')
+        .eq('id', collectionId)
+        .maybeSingle();
+
+    if (collection == null) {
+      throw Exception('Collection not found.');
+    }
+    if (collection['owner_id'] != userId) {
+      throw Exception('Only the collection owner can perform this action.');
+    }
+
     await supabase.from('collections').update({
       'name': name,
       'description': description,
@@ -178,6 +193,21 @@ class CollectionService {
 
   /// Delete a collection. Owner only. Cascade deletes members & items.
   static Future<void> delete(String collectionId) async {
+    final userId = supabase.auth.currentUser!.id;
+
+    final collection = await supabase
+        .from('collections')
+        .select('owner_id')
+        .eq('id', collectionId)
+        .maybeSingle();
+
+    if (collection == null) {
+      throw Exception('Collection not found.');
+    }
+    if (collection['owner_id'] != userId) {
+      throw Exception('Only the collection owner can perform this action.');
+    }
+
     await supabase.from('collections').delete().eq('id', collectionId);
   }