From 02ac0b512baac5f43282f8e795ac8a1ca2a4fc73 Mon Sep 17 00:00:00 2001 From: Brandon Thomas Date: Mon, 8 Jun 2026 10:26:45 -0400 Subject: [PATCH] fix checks --- .../folder/color_code_folder_handler.rs | 23 +++++++++++++++---- .../folders/folder/rename_folder_handler.rs | 23 +++++++++++++++---- .../folders/folder/star_folder_handler.rs | 23 +++++++++++++++---- 3 files changed, 54 insertions(+), 15 deletions(-) diff --git a/crates/service/web/storyteller_web/src/http_server/endpoints/folders/folder/color_code_folder_handler.rs b/crates/service/web/storyteller_web/src/http_server/endpoints/folders/folder/color_code_folder_handler.rs index 8fcfdb01ac..aaa0509916 100644 --- a/crates/service/web/storyteller_web/src/http_server/endpoints/folders/folder/color_code_folder_handler.rs +++ b/crates/service/web/storyteller_web/src/http_server/endpoints/folders/folder/color_code_folder_handler.rs @@ -8,6 +8,9 @@ use log::warn; use artcraft_api_defs::folders::folder::{ FolderPathInfo, SetFolderColorCodeRequest, SetFolderColorCodeSuccessResponse, }; +use mysql_queries::queries::folders::folder::get_folder_for_owner::{ + get_folder_for_owner, GetFolderForOwnerArgs, +}; use mysql_queries::queries::folders::folder::update_folder_color_code::{ update_folder_color_code, UpdateFolderColorCodeArgs, }; @@ -63,7 +66,21 @@ pub async fn color_code_folder_handler( } } - let rows_affected = update_folder_color_code(UpdateFolderColorCodeArgs { + // Confirm the folder exists + is owned before issuing the update. + // A 404 here is the authoritative "not found" signal — the update + // itself is idempotent and we don't gate on rows_affected. + get_folder_for_owner(GetFolderForOwnerArgs { + folder_token: &path.folder_token, + owner_user_token: &user_session.user_token, + mysql_executor: &mut *conn, + phantom: PhantomData, + }).await.map_err(|err| { + warn!("Folder lookup failed: {:?}", err); + CommonWebError::from_error(err) + })? + .ok_or(CommonWebError::NotFound)?; + + update_folder_color_code(UpdateFolderColorCodeArgs { folder_token: &path.folder_token, owner_user_token: &user_session.user_token, maybe_color_code: trimmed.as_deref(), @@ -74,9 +91,5 @@ pub async fn color_code_folder_handler( CommonWebError::from_error(err) })?; - if rows_affected == 0 { - return Err(CommonWebError::NotFound); - } - Ok(Json(SetFolderColorCodeSuccessResponse { success: true })) } diff --git a/crates/service/web/storyteller_web/src/http_server/endpoints/folders/folder/rename_folder_handler.rs b/crates/service/web/storyteller_web/src/http_server/endpoints/folders/folder/rename_folder_handler.rs index 1353485d85..26ef2b1194 100644 --- a/crates/service/web/storyteller_web/src/http_server/endpoints/folders/folder/rename_folder_handler.rs +++ b/crates/service/web/storyteller_web/src/http_server/endpoints/folders/folder/rename_folder_handler.rs @@ -8,6 +8,9 @@ use log::warn; use artcraft_api_defs::folders::folder::{ FolderPathInfo, RenameFolderRequest, RenameFolderSuccessResponse, }; +use mysql_queries::queries::folders::folder::get_folder_for_owner::{ + get_folder_for_owner, GetFolderForOwnerArgs, +}; use mysql_queries::queries::folders::folder::update_folder_name::{ update_folder_name, UpdateFolderNameArgs, }; @@ -60,7 +63,21 @@ pub async fn rename_folder_handler( )); } - let rows_affected = update_folder_name(UpdateFolderNameArgs { + // Confirm the folder exists + is owned before issuing the update. + // A 404 here is the authoritative "not found" signal — the update + // itself is idempotent and we don't gate on rows_affected. + get_folder_for_owner(GetFolderForOwnerArgs { + folder_token: &path.folder_token, + owner_user_token: &user_session.user_token, + mysql_executor: &mut *conn, + phantom: PhantomData, + }).await.map_err(|err| { + warn!("Folder lookup failed: {:?}", err); + CommonWebError::from_error(err) + })? + .ok_or(CommonWebError::NotFound)?; + + update_folder_name(UpdateFolderNameArgs { folder_token: &path.folder_token, owner_user_token: &user_session.user_token, new_name: &new_name, @@ -71,9 +88,5 @@ pub async fn rename_folder_handler( CommonWebError::from_error(err) })?; - if rows_affected == 0 { - return Err(CommonWebError::NotFound); - } - Ok(Json(RenameFolderSuccessResponse { success: true })) } diff --git a/crates/service/web/storyteller_web/src/http_server/endpoints/folders/folder/star_folder_handler.rs b/crates/service/web/storyteller_web/src/http_server/endpoints/folders/folder/star_folder_handler.rs index f6b6c7296d..3a885464ff 100644 --- a/crates/service/web/storyteller_web/src/http_server/endpoints/folders/folder/star_folder_handler.rs +++ b/crates/service/web/storyteller_web/src/http_server/endpoints/folders/folder/star_folder_handler.rs @@ -8,6 +8,9 @@ use log::warn; use artcraft_api_defs::folders::folder::{ FolderPathInfo, SetFolderStarRequest, SetFolderStarSuccessResponse, }; +use mysql_queries::queries::folders::folder::get_folder_for_owner::{ + get_folder_for_owner, GetFolderForOwnerArgs, +}; use mysql_queries::queries::folders::folder::update_folder_has_star::{ update_folder_has_star, UpdateFolderHasStarArgs, }; @@ -45,7 +48,21 @@ pub async fn star_folder_handler( &http_request, &server_state.session_checker, &mut conn, ).await.map_err(|_| CommonWebError::NotAuthorized)?; - let rows_affected = update_folder_has_star(UpdateFolderHasStarArgs { + // Confirm the folder exists + is owned before issuing the update. + // A 404 here is the authoritative "not found" signal — the update + // itself is idempotent and we don't gate on rows_affected. + get_folder_for_owner(GetFolderForOwnerArgs { + folder_token: &path.folder_token, + owner_user_token: &user_session.user_token, + mysql_executor: &mut *conn, + phantom: PhantomData, + }).await.map_err(|err| { + warn!("Folder lookup failed: {:?}", err); + CommonWebError::from_error(err) + })? + .ok_or(CommonWebError::NotFound)?; + + update_folder_has_star(UpdateFolderHasStarArgs { folder_token: &path.folder_token, owner_user_token: &user_session.user_token, has_star: request.has_star, @@ -56,9 +73,5 @@ pub async fn star_folder_handler( CommonWebError::from_error(err) })?; - if rows_affected == 0 { - return Err(CommonWebError::NotFound); - } - Ok(Json(SetFolderStarSuccessResponse { success: true })) }