Stackteam/hwhub
3
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #2 from DieLustigenTierwesen/copilot/sub-pr-1

Browse source 
Add client-side ownership enforcement to CollectionService update/delete
This commit is contained in:
Lukas Müllner 2026-02-24 20:42:55 +01:00 committed by GitHub
commit 9f9a0cb601
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 30 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

30
lib/services/collection_service.dart
View file

@ -170,6 +170,21 @@ class CollectionService {
required String name, required String name,
String? description, String? description,
}) async { }) async {
final userId = supabase.auth.currentUser!.id;
final collection = await supabase
.from('collections')
.select('owner_id')
.eq('id', collectionId)
.maybeSingle();
if (collection == null) {
throw Exception('Collection not found.');
}
if (collection['owner_id'] != userId) {
throw Exception('Only the collection owner can perform this action.');
}
await supabase.from('collections').update({ await supabase.from('collections').update({
'name': name, 'name': name,
if (description != null && description.isNotEmpty) if (description != null && description.isNotEmpty)
@ -179,6 +194,21 @@ class CollectionService {
/// Delete a collection. Owner only. Cascade deletes members & items. /// Delete a collection. Owner only. Cascade deletes members & items.
static Future<void> delete(String collectionId) async { static Future<void> delete(String collectionId) async {
final userId = supabase.auth.currentUser!.id;
final collection = await supabase
.from('collections')
.select('owner_id')
.eq('id', collectionId)
.maybeSingle();
if (collection == null) {
throw Exception('Collection not found.');
}
if (collection['owner_id'] != userId) {
throw Exception('Only the collection owner can perform this action.');
}
await supabase.from('collections').delete().eq('id', collectionId); await supabase.from('collections').delete().eq('id', collectionId);
} }