Stackteam/hwhub
3
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add client-side ownership checks to update and delete methods

Browse source 
Co-authored-by: derkauzigekoala <79001016+derkauzigekoala@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot] 2026-02-24 19:18:27 +00:00
parent 60d440703b
commit 4fbd776605
1 changed files with 30 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

30
lib/services/collection_service.dart
View file

@ -170,6 +170,21 @@ class CollectionService {
required String name, required String name,
String? description, String? description,
}) async { }) async {
final userId = supabase.auth.currentUser!.id;
final collection = await supabase
.from('collections')
.select('owner_id')
.eq('id', collectionId)
.maybeSingle();
if (collection == null) {
throw Exception('Collection not found.');
}
if (collection['owner_id'] != userId) {
throw Exception('Only the collection owner can perform this action.');
}
await supabase.from('collections').update({ await supabase.from('collections').update({
'name': name, 'name': name,
'description': description, 'description': description,
@ -178,6 +193,21 @@ class CollectionService {
/// Delete a collection. Owner only. Cascade deletes members & items. /// Delete a collection. Owner only. Cascade deletes members & items.
static Future<void> delete(String collectionId) async { static Future<void> delete(String collectionId) async {
final userId = supabase.auth.currentUser!.id;
final collection = await supabase
.from('collections')
.select('owner_id')
.eq('id', collectionId)
.maybeSingle();
if (collection == null) {
throw Exception('Collection not found.');
}
if (collection['owner_id'] != userId) {
throw Exception('Only the collection owner can perform this action.');
}
await supabase.from('collections').delete().eq('id', collectionId); await supabase.from('collections').delete().eq('id', collectionId);
} }