Skip to content

Enforce user ownership in table existence check. #12

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ormai merged 2 commits into from
Jun 7, 2025
Merged

Enforce user ownership in table existence check. #12

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3d33f5e
Enforce user ownership in table existence check.
icsp-xp Jun 7, 2025
7915202
refactor: rename tableExists to tableExistsForUser and ensureTableExi…
icsp-xp Jun 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 8 additions & 5 deletions backend/src/main/java/com/github/bytestrick/tabula/repository/table/TableDAO.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,20 +85,23 @@ public void deleteTable(UUID tableId) {


/**
* Check to see if the table exists.
* Checks whether a table with the given ID exists and belongs to the specified user.
*
* @param tableId Id to check.
* @return Returns {@code true} if the {@code tableId} is associated with a table.
* @param tableId UUID of the table to check.
* @param userId UUID of the user who should own the table.
* @return {@code true} if a row exists in {@code tbl_table} with {@code id = tableId}
* and {@code user_id = userId}; {@code false} otherwise.
*/
public boolean tableExists(UUID tableId) {
public boolean tableExistsForUser(UUID tableId, UUID userId) {
return jdbcClient.sql("""
SELECT EXISTS(
SELECT 1
FROM tbl_table
WHERE id = :tableId
WHERE id = :tableId and user_id = :userId
)
""")
.param("tableId", tableId)
.param("userId", userId)
.query(Boolean.class)
.single();
}
Expand Down
28 changes: 14 additions & 14 deletions backend/src/main/java/com/github/bytestrick/tabula/service/TableService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,7 +103,7 @@ public TableCreatedDTO createNewTable(TableCreateDTO tableCreateDTO) {

@Transactional
public String updateTable(UUID tableId, TablePutDTO tablePutDTO) {
ensureTableExistsOrThrow(tableId);
ensureTableExistsForAuthUserOrThrow(tableId);

Table table = Table.builder()
.id(tableId)
Expand Down Expand Up @@ -139,13 +139,13 @@ private void ensureDataTypeExistsOrThrow(int dataTypeId) {
}

/**
* Verifies that a table with the given UUID exists; otherwise throws.
* Verifies that a table with the given UUID exists and belongs to auth user; otherwise throws.
*
* @param tableId The UUID of the table to check.
* @throws TableNotFoundException If no table exists for the given {@code tableId}.
*/
private void ensureTableExistsOrThrow(UUID tableId) {
if (!tableDAO.tableExists(tableId)) {
private void ensureTableExistsForAuthUserOrThrow(UUID tableId) {
if (!tableDAO.tableExistsForUser(tableId, getAuthUser().getId())) {
throw new TableNotFoundException(tableId);
}
}
Expand Down Expand Up @@ -204,7 +204,7 @@ private void ensureIndexIsWithinTheBoundsOrThrow(int index, int minBounds, int m
*/
@Transactional
public TableContentDTO getTable(UUID tableId) {
ensureTableExistsOrThrow(tableId);
ensureTableExistsForAuthUserOrThrow(tableId);

TableProxy table = tableDAO.findTableById(tableId);
List<RowDTO> content = new ArrayList<>();
Expand Down Expand Up @@ -237,7 +237,7 @@ public TableContentDTO getTable(UUID tableId) {
*/
@Transactional
public String deleteTable(UUID tableId) {
ensureTableExistsOrThrow(tableId);
ensureTableExistsForAuthUserOrThrow(tableId);
tableDAO.deleteTable(tableId);
return "Table deleted successfully";
}
Expand Down Expand Up @@ -283,7 +283,7 @@ protected RowProxy duplicateRow(UUID tableId, int rowIndex) {
*/
@Transactional
public RowCreatedDTO addNewRow(UUID tableId, RowCreateDTO rowCreateDTO) {
ensureTableExistsOrThrow(tableId);
ensureTableExistsForAuthUserOrThrow(tableId);

RowProxy createdRow;
List<String> cellsValues = new ArrayList<>();
Expand Down Expand Up @@ -357,7 +357,7 @@ protected ColumnProxy duplicateColumn(UUID tableId, int columnIndex) {
*/
@Transactional
public ColumnCreatedDTO addNewColumn(UUID tableId, ColumnCreateDTO columnCreateDTO) {
ensureTableExistsOrThrow(tableId);
ensureTableExistsForAuthUserOrThrow(tableId);
ensureDataTypeExistsOrThrow(columnCreateDTO.dataTypeId());

ColumnProxy createdColumn;
Expand Down Expand Up @@ -410,7 +410,7 @@ public ColumnCreatedDTO addNewColumn(UUID tableId, ColumnCreateDTO columnCreateD
*/
@Transactional
public ColumnPatchedDTO patchHeaderColumn(UUID tableId, UUID columnId, ColumnPatchDTO patchDTO) {
ensureTableExistsOrThrow(tableId);
ensureTableExistsForAuthUserOrThrow(tableId);
ensureColumnExistsOrThrow(tableId, columnId);

if (patchDTO.dataTypeId() != null) {
Expand Down Expand Up @@ -450,7 +450,7 @@ public ColumnPatchedDTO patchHeaderColumn(UUID tableId, UUID columnId, ColumnPat
*/
@Transactional
public List<CellPatchedDTO> updateCellValue(UUID tableId, List<CellPatchDTO> cellsPatchDTO) {
ensureTableExistsOrThrow(tableId);
ensureTableExistsForAuthUserOrThrow(tableId);

List<CellPatchedDTO> cellsPatched = new ArrayList<>();

Expand Down Expand Up @@ -532,7 +532,7 @@ else if (cellPatchDTO.columnId() != null) {
*/
@Transactional
public ColumnsDeletedDTO deleteColumns(UUID tableId, ColumnsDeleteDTO columnsDeleteDTO) {
ensureTableExistsOrThrow(tableId);
ensureTableExistsForAuthUserOrThrow(tableId);

if ((columnDAO.getColumnNumber(tableId) - columnsDeleteDTO.ids().size()) <= 0)
throw new AtLeastOneRowAndOneColumn();
Expand Down Expand Up @@ -560,7 +560,7 @@ public ColumnsDeletedDTO deleteColumns(UUID tableId, ColumnsDeleteDTO columnsDel
*/
@Transactional
public RowsDeletedDTO deleteRows(UUID tableId, RowsDeleteDTO rowsDeleteDTO) {
ensureTableExistsOrThrow(tableId);
ensureTableExistsForAuthUserOrThrow(tableId);

if ((rowDAO.getRowsNumber(tableId) - rowsDeleteDTO.ids().size()) <= 0)
throw new AtLeastOneRowAndOneColumn();
Expand Down Expand Up @@ -785,7 +785,7 @@ private boolean canMoveRowOrColumn(int fromIndex, int toIndex, int totalAmount)
*/
@Transactional
public MovedRowsOrColumnsDTO moveRowsIndexes(UUID tableId, MovesRowsOrColumnsDTO moveRowsDTO) {
ensureTableExistsOrThrow(tableId);
ensureTableExistsForAuthUserOrThrow(tableId);

int rowsAmount = rowDAO.getRowsNumber(tableId);

Expand Down Expand Up @@ -840,7 +840,7 @@ public MovedRowsOrColumnsDTO moveRowsIndexes(UUID tableId, MovesRowsOrColumnsDTO
*/
@Transactional
public MovedRowsOrColumnsDTO moveColumnsIndexes(UUID tableId, MovesRowsOrColumnsDTO moveColumnsDTO) {
ensureTableExistsOrThrow(tableId);
ensureTableExistsForAuthUserOrThrow(tableId);

int columnsAmount = columnDAO.getColumnNumber(tableId);

Expand Down
Loading