makiolaj/GearBox
1
0
Fork 0
Code Issues 8 Pull Requests Actions Packages Projects Releases 10 Wiki Activity

feat(16-02): add userId scoping to thread, setup, and auth services

Browse Source 
- All functions accept userId, no more prodDb defaults
- Thread operations verify ownership via and(eq(id), eq(userId))
- Candidate operations verify parent thread ownership before proceeding
- resolveThread includes userId in new item insert and verifies category ownership
- Setup operations use and() for composite id+userId conditions
- syncSetupItems validates both setup and item ownership via inArray
- updateItemClassification and removeSetupItem verify setup ownership
- Auth service: reordered createApiKey params to (db, userId, name)
- verifyApiKey unchanged (already returns { userId } from Plan 01)
This commit is contained in:
Jean-Luc Makiola
2026-04-05 10:43:38 +02:00
parent 8d85d2839e
commit 242cacea7c
3 changed files with 169 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files

118
src/server/services/thread.service.ts
View File

@@ -1,4 +1,4 @@
import { asc, desc, eq, max, sql } from "drizzle-orm";
import { and, asc, desc, eq, max, sql } from "drizzle-orm";
import { db as prodDb } from "../../db/index.ts";
import {
categories,
@@ -11,20 +11,34 @@ import type {
CreateThread,
ReorderCandidates,
} from "../../shared/types.ts";
import { getOrCreateUncategorized } from "./category.service.ts";
type Db = typeof prodDb;
export async function createThread(db: Db = prodDb, data: CreateThread) {
export async function createThread(
db: Db,
userId: number,
data: CreateThread,
) {
const [row] = await db
.insert(threads)
.values({ name: data.name, categoryId: data.categoryId })
.values({ name: data.name, categoryId: data.categoryId, userId })
.returning();
return row;
}
export async function getAllThreads(db: Db = prodDb, includeResolved = false) {
const query = db
export async function getAllThreads(
db: Db,
userId: number,
includeResolved = false,
) {
const baseCondition = eq(threads.userId, userId);
const whereCondition = includeResolved
? baseCondition
: and(baseCondition, eq(threads.status, "active"));
return db
.select({
id: threads.id,
name: threads.name,
@@ -50,22 +64,19 @@ export async function getAllThreads(db: Db = prodDb, includeResolved = false) {
})
.from(threads)
.innerJoin(categories, eq(threads.categoryId, categories.id))
.where(whereCondition)
.orderBy(desc(threads.createdAt));
if (!includeResolved) {
return query.where(eq(threads.status, "active"));
}
return query;
}
export async function getThreadWithCandidates(
db: Db = prodDb,
db: Db,
userId: number,
threadId: number,
) {
const [thread] = await db
.select()
.from(threads)
.where(eq(threads.id, threadId));
.where(and(eq(threads.id, threadId), eq(threads.userId, userId)));
if (!thread) return null;
const candidateList = await db
@@ -97,30 +108,31 @@ export async function getThreadWithCandidates(
}
export async function updateThread(
db: Db = prodDb,
db: Db,
userId: number,
threadId: number,
data: Partial<{ name: string; categoryId: number }>,
) {
const [existing] = await db
.select({ id: threads.id })
.from(threads)
.where(eq(threads.id, threadId));
.where(and(eq(threads.id, threadId), eq(threads.userId, userId)));
if (!existing) return null;
const [row] = await db
.update(threads)
.set({ ...data, updatedAt: new Date() })
.where(eq(threads.id, threadId))
.where(and(eq(threads.id, threadId), eq(threads.userId, userId)))
.returning();
return row;
}
export async function deleteThread(db: Db = prodDb, threadId: number) {
export async function deleteThread(db: Db, userId: number, threadId: number) {
const [thread] = await db
.select()
.from(threads)
.where(eq(threads.id, threadId));
.where(and(eq(threads.id, threadId), eq(threads.userId, userId)));
if (!thread) return null;
// Collect candidate image filenames for cleanup
@@ -131,7 +143,9 @@ export async function deleteThread(db: Db = prodDb, threadId: number) {
.where(eq(threadCandidates.threadId, threadId))
).filter((c) => c.imageFilename != null);
await db.delete(threads).where(eq(threads.id, threadId));
await db
.delete(threads)
.where(and(eq(threads.id, threadId), eq(threads.userId, userId)));
return {
...thread,
@@ -140,7 +154,8 @@ export async function deleteThread(db: Db = prodDb, threadId: number) {
}
export async function createCandidate(
db: Db = prodDb,
db: Db,
userId: number,
threadId: number,
data: Partial<CreateCandidate> & {
name: string;
@@ -149,6 +164,13 @@ export async function createCandidate(
imageSourceUrl?: string;
},
) {
// Verify the parent thread belongs to this user
const [thread] = await db
.select({ id: threads.id })
.from(threads)
.where(and(eq(threads.id, threadId), eq(threads.userId, userId)));
if (!thread) return null;
const [maxRow] = await db
.select({ maxOrder: max(threadCandidates.sortOrder) })
.from(threadCandidates)
@@ -179,7 +201,8 @@ export async function createCandidate(
}
export async function updateCandidate(
db: Db = prodDb,
db: Db,
userId: number,
candidateId: number,
data: Partial<{
name: string;
@@ -195,12 +218,22 @@ export async function updateCandidate(
cons: string;
}>,
) {
// Verify the candidate's parent thread belongs to this user
const [existing] = await db
.select({ id: threadCandidates.id })
.select({
id: threadCandidates.id,
threadId: threadCandidates.threadId,
})
.from(threadCandidates)
.where(eq(threadCandidates.id, candidateId));
if (!existing) return null;
const [thread] = await db
.select({ id: threads.id })
.from(threads)
.where(and(eq(threads.id, existing.threadId), eq(threads.userId, userId)));
if (!thread) return null;
const [row] = await db
.update(threadCandidates)
.set({ ...data, updatedAt: new Date() })
@@ -210,19 +243,33 @@ export async function updateCandidate(
return row;
}
export async function deleteCandidate(db: Db = prodDb, candidateId: number) {
export async function deleteCandidate(
db: Db,
userId: number,
candidateId: number,
) {
// Verify the candidate's parent thread belongs to this user
const [candidate] = await db
.select()
.from(threadCandidates)
.where(eq(threadCandidates.id, candidateId));
if (!candidate) return null;
const [thread] = await db
.select({ id: threads.id })
.from(threads)
.where(
and(eq(threads.id, candidate.threadId), eq(threads.userId, userId)),
);
if (!thread) return null;
await db.delete(threadCandidates).where(eq(threadCandidates.id, candidateId));
return candidate;
}
export async function reorderCandidates(
db: Db = prodDb,
db: Db,
userId: number,
threadId: number,
orderedIds: ReorderCandidates["orderedIds"],
): Promise<{ success: boolean; error?: string }> {
@@ -230,7 +277,7 @@ export async function reorderCandidates(
const [thread] = await tx
.select()
.from(threads)
.where(eq(threads.id, threadId));
.where(and(eq(threads.id, threadId), eq(threads.userId, userId)));
if (!thread) {
return { success: false, error: "Thread not found" };
}
@@ -250,16 +297,17 @@ export async function reorderCandidates(
}
export async function resolveThread(
db: Db = prodDb,
db: Db,
userId: number,
threadId: number,
candidateId: number,
): Promise<{ success: boolean; item?: any; error?: string }> {
return await db.transaction(async (tx) => {
// 1. Check thread is active
// 1. Check thread is active and belongs to user
const [thread] = await tx
.select()
.from(threads)
.where(eq(threads.id, threadId));
.where(and(eq(threads.id, threadId), eq(threads.userId, userId)));
if (!thread || thread.status !== "active") {
return { success: false, error: "Thread not active" };
}
@@ -276,14 +324,21 @@ export async function resolveThread(
return { success: false, error: "Candidate not in thread" };
}
// 3. Verify categoryId still exists, fallback to Uncategorized (id=1)
// 3. Verify categoryId belongs to user, fallback to Uncategorized
const [category] = await tx
.select({ id: categories.id })
.from(categories)
.where(eq(categories.id, candidate.categoryId));
const safeCategoryId = category ? candidate.categoryId : 1;
.where(
and(
eq(categories.id, candidate.categoryId),
eq(categories.userId, userId),
),
);
const safeCategoryId = category
? candidate.categoryId
: await getOrCreateUncategorized(tx as unknown as Db, userId);
// 4. Create collection item from candidate data
// 4. Create collection item from candidate data — with userId
const [newItem] = await tx
.insert(items)
.values({
@@ -291,6 +346,7 @@ export async function resolveThread(
weightGrams: candidate.weightGrams,
priceCents: candidate.priceCents,
categoryId: safeCategoryId,
userId,
notes: candidate.notes,
productUrl: candidate.productUrl,
imageFilename: candidate.imageFilename,