Stackteam/hwhub
3
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: make member removal check rls-safe

Browse source
This commit is contained in:
Lukas Müllner 2026-03-05 11:40:30 +01:00
parent d03e276ddf
commit da9981d297
1 changed files with 10 additions and 20 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

30
lib/services/collection_service.dart
View file

@ -374,8 +374,9 @@ class CollectionService {
throw Exception('Collection owner cannot be removed.'); throw Exception('Collection owner cannot be removed.');
} }
final members = await getMembers(collectionId); final membersBefore = await getMembers(collectionId);
final targetMembership = members.where((member) => member.userId == memberUserId); final targetMembership =
membersBefore.where((member) => member.userId == memberUserId);
if (targetMembership.isEmpty) { if (targetMembership.isEmpty) {
throw Exception('Member not found in this collection.'); throw Exception('Member not found in this collection.');
@ -385,28 +386,17 @@ class CollectionService {
throw Exception('Collection owner cannot be removed.'); throw Exception('Collection owner cannot be removed.');
} }
final deleted = await supabase await supabase
.from('collection_members') .from('collection_members')
.delete() .delete()
.eq('collection_id', collectionId) .eq('collection_id', collectionId)
.eq('user_id', memberUserId) .eq('user_id', memberUserId);
.select('id');
if (deleted.isEmpty) { final membersAfter = await getMembers(collectionId);
throw Exception( final stillExists =
'Member could not be removed (blocked by database policy).', membersAfter.any((member) => member.userId == memberUserId);
); if (stillExists) {
} throw Exception('Member removal did not persist. Please check RLS delete policy.');
final stillExists = await supabase
.from('collection_members')
.select('id')
.eq('collection_id', collectionId)
.eq('user_id', memberUserId)
.maybeSingle();
if (stillExists != null) {
throw Exception('Member removal did not persist. Please try again.');
} }
} }