From da9981d2975605f61387e58d794b488582a152b8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lukas=20M=C3=BCllner?= Date: Thu, 5 Mar 2026 11:40:30 +0100 Subject: [PATCH] fix: make member removal check rls-safe --- lib/services/collection_service.dart | 30 ++++++++++------------------ 1 file changed, 10 insertions(+), 20 deletions(-) diff --git a/lib/services/collection_service.dart b/lib/services/collection_service.dart index 4e3d261..264313e 100644 --- a/lib/services/collection_service.dart +++ b/lib/services/collection_service.dart @@ -374,8 +374,9 @@ class CollectionService { throw Exception('Collection owner cannot be removed.'); } - final members = await getMembers(collectionId); - final targetMembership = members.where((member) => member.userId == memberUserId); + final membersBefore = await getMembers(collectionId); + final targetMembership = + membersBefore.where((member) => member.userId == memberUserId); if (targetMembership.isEmpty) { throw Exception('Member not found in this collection.'); @@ -385,28 +386,17 @@ class CollectionService { throw Exception('Collection owner cannot be removed.'); } - final deleted = await supabase + await supabase .from('collection_members') .delete() .eq('collection_id', collectionId) - .eq('user_id', memberUserId) - .select('id'); + .eq('user_id', memberUserId); - if (deleted.isEmpty) { - throw Exception( - 'Member could not be removed (blocked by database policy).', - ); - } - - final stillExists = await supabase - .from('collection_members') - .select('id') - .eq('collection_id', collectionId) - .eq('user_id', memberUserId) - .maybeSingle(); - - if (stillExists != null) { - throw Exception('Member removal did not persist. Please try again.'); + final membersAfter = await getMembers(collectionId); + final stillExists = + membersAfter.any((member) => member.userId == memberUserId); + if (stillExists) { + throw Exception('Member removal did not persist. Please check RLS delete policy.'); } }