From f97cdc1ae53afe0487e0b6a45cd2887f4e64f9b3 Mon Sep 17 00:00:00 2001 From: Brandon Thomas Date: Fri, 31 Dec 2021 05:11:07 -0500 Subject: [PATCH] tree integrity checks --- .../moderation/categories/edit_category.rs | 26 +++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/crates/app/storyteller_web/src/http_server/endpoints/moderation/categories/edit_category.rs b/crates/app/storyteller_web/src/http_server/endpoints/moderation/categories/edit_category.rs index cb8bad069d..cb80ae1927 100644 --- a/crates/app/storyteller_web/src/http_server/endpoints/moderation/categories/edit_category.rs +++ b/crates/app/storyteller_web/src/http_server/endpoints/moderation/categories/edit_category.rs @@ -27,6 +27,7 @@ use sqlx::error::Error::Database; use sqlx::mysql::MySqlDatabaseError; use std::fmt; use std::sync::Arc; +use crate::database::queries::categories::get_category_by_token::get_category_by_token; // =============== Request =============== @@ -127,6 +128,31 @@ pub async fn edit_category_handler( return Err(EditCategoryError::NotAuthorized); } + // Category tree integrity + if let Some(parent_category_token) = request.maybe_super_category_token.as_deref() { + if parent_category_token == &path.token { + return Err(EditCategoryError::BadInput( + "category cannot have itself as a parent".to_string())); + } + + let parent_category_lookup + = get_category_by_token(parent_category_token, &server_state.mysql_pool).await; + + match parent_category_lookup { + Ok(Some(parent_category)) => { + if !parent_category.can_have_subcategories { + return Err(EditCategoryError::BadInput( + "parent category cannot have children".to_string())); + } + }, + Ok(None) => return Err(EditCategoryError::NotFound), + Err(err) => { + warn!("Category lookup DB error: {:?}", err); + return Err(EditCategoryError::ServerError) + }, + } + } + let query_result = // We need to store the IP address details. sqlx::query!(