fix checks

crates/service/web/storyteller_web/src/http_server/endpoints/folders/folder/color_code_folder_handler.rs

@@ -8,6 +8,9 @@ use log::warn;
 use artcraft_api_defs::folders::folder::{
   FolderPathInfo, SetFolderColorCodeRequest, SetFolderColorCodeSuccessResponse,
 };
+use mysql_queries::queries::folders::folder::get_folder_for_owner::{
+  get_folder_for_owner, GetFolderForOwnerArgs,
+};
 use mysql_queries::queries::folders::folder::update_folder_color_code::{
   update_folder_color_code, UpdateFolderColorCodeArgs,
 };
@@ -63,7 +66,21 @@ pub async fn color_code_folder_handler(
     }
   }
 
-  let rows_affected = update_folder_color_code(UpdateFolderColorCodeArgs {
+  // Confirm the folder exists + is owned before issuing the update.
+  // A 404 here is the authoritative "not found" signal — the update
+  // itself is idempotent and we don't gate on rows_affected.
+  get_folder_for_owner(GetFolderForOwnerArgs {
+    folder_token: &path.folder_token,
+    owner_user_token: &user_session.user_token,
+    mysql_executor: &mut *conn,
+    phantom: PhantomData,
+  }).await.map_err(|err| {
+    warn!("Folder lookup failed: {:?}", err);
+    CommonWebError::from_error(err)
+  })?
+  .ok_or(CommonWebError::NotFound)?;
+
+  update_folder_color_code(UpdateFolderColorCodeArgs {
     folder_token: &path.folder_token,
     owner_user_token: &user_session.user_token,
     maybe_color_code: trimmed.as_deref(),
@@ -74,9 +91,5 @@ pub async fn color_code_folder_handler(
     CommonWebError::from_error(err)
   })?;
 
-  if rows_affected == 0 {
-    return Err(CommonWebError::NotFound);
-  }
-
   Ok(Json(SetFolderColorCodeSuccessResponse { success: true }))
 }

crates/service/web/storyteller_web/src/http_server/endpoints/folders/folder/rename_folder_handler.rs

@@ -8,6 +8,9 @@ use log::warn;
 use artcraft_api_defs::folders::folder::{
   FolderPathInfo, RenameFolderRequest, RenameFolderSuccessResponse,
 };
+use mysql_queries::queries::folders::folder::get_folder_for_owner::{
+  get_folder_for_owner, GetFolderForOwnerArgs,
+};
 use mysql_queries::queries::folders::folder::update_folder_name::{
   update_folder_name, UpdateFolderNameArgs,
 };
@@ -60,7 +63,21 @@ pub async fn rename_folder_handler(
     ));
   }
 
-  let rows_affected = update_folder_name(UpdateFolderNameArgs {
+  // Confirm the folder exists + is owned before issuing the update.
+  // A 404 here is the authoritative "not found" signal — the update
+  // itself is idempotent and we don't gate on rows_affected.
+  get_folder_for_owner(GetFolderForOwnerArgs {
+    folder_token: &path.folder_token,
+    owner_user_token: &user_session.user_token,
+    mysql_executor: &mut *conn,
+    phantom: PhantomData,
+  }).await.map_err(|err| {
+    warn!("Folder lookup failed: {:?}", err);
+    CommonWebError::from_error(err)
+  })?
+  .ok_or(CommonWebError::NotFound)?;
+
+  update_folder_name(UpdateFolderNameArgs {
     folder_token: &path.folder_token,
     owner_user_token: &user_session.user_token,
     new_name: &new_name,
@@ -71,9 +88,5 @@ pub async fn rename_folder_handler(
     CommonWebError::from_error(err)
   })?;
 
-  if rows_affected == 0 {
-    return Err(CommonWebError::NotFound);
-  }
-
   Ok(Json(RenameFolderSuccessResponse { success: true }))
 }

crates/service/web/storyteller_web/src/http_server/endpoints/folders/folder/star_folder_handler.rs

@@ -8,6 +8,9 @@ use log::warn;
 use artcraft_api_defs::folders::folder::{
   FolderPathInfo, SetFolderStarRequest, SetFolderStarSuccessResponse,
 };
+use mysql_queries::queries::folders::folder::get_folder_for_owner::{
+  get_folder_for_owner, GetFolderForOwnerArgs,
+};
 use mysql_queries::queries::folders::folder::update_folder_has_star::{
   update_folder_has_star, UpdateFolderHasStarArgs,
 };
@@ -45,7 +48,21 @@ pub async fn star_folder_handler(
     &http_request, &server_state.session_checker, &mut conn,
   ).await.map_err(|_| CommonWebError::NotAuthorized)?;
 
-  let rows_affected = update_folder_has_star(UpdateFolderHasStarArgs {
+  // Confirm the folder exists + is owned before issuing the update.
+  // A 404 here is the authoritative "not found" signal — the update
+  // itself is idempotent and we don't gate on rows_affected.
+  get_folder_for_owner(GetFolderForOwnerArgs {
+    folder_token: &path.folder_token,
+    owner_user_token: &user_session.user_token,
+    mysql_executor: &mut *conn,
+    phantom: PhantomData,
+  }).await.map_err(|err| {
+    warn!("Folder lookup failed: {:?}", err);
+    CommonWebError::from_error(err)
+  })?
+  .ok_or(CommonWebError::NotFound)?;
+
+  update_folder_has_star(UpdateFolderHasStarArgs {
     folder_token: &path.folder_token,
     owner_user_token: &user_session.user_token,
     has_star: request.has_star,
@@ -56,9 +73,5 @@ pub async fn star_folder_handler(
     CommonWebError::from_error(err)
   })?;
 
-  if rows_affected == 0 {
-    return Err(CommonWebError::NotFound);
-  }
-
   Ok(Json(SetFolderStarSuccessResponse { success: true }))
 }