diff --git a/src/features/snapshots/api/delete-snapshot.ts b/src/features/snapshots/api/delete-snapshot.ts index a42cc55..0cbb69c 100644 --- a/src/features/snapshots/api/delete-snapshot.ts +++ b/src/features/snapshots/api/delete-snapshot.ts @@ -2,7 +2,7 @@ import { db } from "@/db"; import { sessionSnapshots } from "@/db/schema"; -import { and, eq } from "drizzle-orm"; +import { and, eq, isNull } from "drizzle-orm"; import { auth } from "@/lib/auth"; export async function deleteSnapshot(id: number) { @@ -10,22 +10,21 @@ export async function deleteSnapshot(id: number) { const rawUserId = (session?.user as any)?.id; const userId = rawUserId ? parseInt(String(rawUserId), 10) : null; - console.log(`[deleteSnapshot] Request for ID: ${id}, Session UserId: ${userId} (raw: ${rawUserId})`); - - if (!userId || isNaN(userId)) { - console.error("[deleteSnapshot] Unauthorized: userId is missing or invalid"); - return { success: false, error: "Non autorisé" }; - } + console.log(`[deleteSnapshot] Request for ID: ${id}, Session UserId: ${userId}`); try { + // Condition de sécurité : match ID ET match le propriétaire (ou anonyme) + const userCondition = userId && !isNaN(userId) + ? eq(sessionSnapshots.userId, userId) + : isNull(sessionSnapshots.userId); + const result = await db.delete(sessionSnapshots) - .where(and(eq(sessionSnapshots.id, id), eq(sessionSnapshots.userId, userId))) + .where(and(eq(sessionSnapshots.id, id), userCondition)) .returning({ deletedId: sessionSnapshots.id }); if (result.length === 0) { - console.warn(`[deleteSnapshot] No rows deleted for ID ${id} and User ${userId}. Maybe the snapshot doesn't belong to the user?`); - // We return success: false to trigger the error modal in UI if nothing was actually deleted - return { success: false, error: "Élément non trouvé ou non autorisé" }; + console.warn(`[deleteSnapshot] No rows deleted for ID ${id}. Snapshot may not exist or belongs to another user.`); + return { success: false, error: "Snapshot non trouvé ou non autorisé" }; } console.log(`[deleteSnapshot] Successfully deleted ID: ${id}`); diff --git a/src/features/snapshots/api/get-snapshots.ts b/src/features/snapshots/api/get-snapshots.ts index 2d488a5..488aef6 100644 --- a/src/features/snapshots/api/get-snapshots.ts +++ b/src/features/snapshots/api/get-snapshots.ts @@ -3,7 +3,7 @@ import { db } from "@/db"; import { sessionSnapshots } from "@/db/schema"; import { auth } from "@/lib/auth"; -import { and, desc, eq } from "drizzle-orm"; +import { and, desc, eq, isNull } from "drizzle-orm"; export async function getSnapshots(type?: "snapshot" | "export") { try { @@ -11,12 +11,13 @@ export async function getSnapshots(type?: "snapshot" | "export") { const rawUserId = (session?.user as any)?.id; const userId = rawUserId ? parseInt(String(rawUserId), 10) : null; - if (!userId || isNaN(userId)) { - console.warn("[getSnapshots] Unauthenticated access attempt"); - return []; - } + // Si on a un userId, on filtre par celui-ci. + // Sinon, on filtre par userId IS NULL (mode anonyme/local) + const userCondition = userId && !isNaN(userId) + ? eq(sessionSnapshots.userId, userId) + : isNull(sessionSnapshots.userId); - const conditions = [eq(sessionSnapshots.userId, userId)]; + const conditions = [userCondition]; if (type) conditions.push(eq(sessionSnapshots.type, type)); return await db.select()