Stackteam/hwhub
3
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: make member removal check rls-safe

Browse source
This commit is contained in:
Lukas Müllner 2026-03-05 11:40:30 +01:00
parent d03e276ddf
commit da9981d297
1 changed files with 10 additions and 20 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

30
lib/services/collection_service.dart
View file

@ -374,8 +374,9 @@ class CollectionService {
throw Exception('Collection owner cannot be removed.');
}
final members = await getMembers(collectionId);
final targetMembership = members.where((member) => member.userId == memberUserId);
final membersBefore = await getMembers(collectionId);
final targetMembership =
membersBefore.where((member) => member.userId == memberUserId);
if (targetMembership.isEmpty) {
throw Exception('Member not found in this collection.');
@ -385,28 +386,17 @@ class CollectionService {
throw Exception('Collection owner cannot be removed.');
}
final deleted = await supabase
await supabase
.from('collection_members')
.delete()
.eq('collection_id', collectionId)
.eq('user_id', memberUserId)
.select('id');
.eq('user_id', memberUserId);
if (deleted.isEmpty) {
throw Exception(
'Member could not be removed (blocked by database policy).',
);
}
final stillExists = await supabase
.from('collection_members')
.select('id')
.eq('collection_id', collectionId)
.eq('user_id', memberUserId)
.maybeSingle();
if (stillExists != null) {
throw Exception('Member removal did not persist. Please try again.');
final membersAfter = await getMembers(collectionId);
final stillExists =
membersAfter.any((member) => member.userId == memberUserId);
if (stillExists) {
throw Exception('Member removal did not persist. Please check RLS delete policy.');
}
}