Files
bookhoard/internal/handlers/filters.go
T
john-okeefe 85964ec932 fix(api): enforce user isolation on saved filters delete operation
Fix critical security issue where admin users could delete other users'
saved filters due to incorrect error handling in DELETE query.

Database Schema Changes:
- Change DeleteSavedFilter from :exec to :one (queries.sql:1747-1750)
- Add RETURNING * to return deleted row for proper error detection
- Regenerate querier.go and queries.sql.go with updated signature

Service Layer (internal/services/filters.go):
- Update DeleteSavedFilter to capture returned row (using _ to discard)
- Properly propagate pgx.ErrNoRows when no rows are deleted
- Error wrapping preserves original error for handler detection

Handler Layer (internal/handlers/filters.go):
- Add errors.Is() check for pgx.ErrNoRows (line 148)
- Return 404 Not Found when filter doesn't exist or belongs to different user
- Return 500 Internal Server Error for other database errors
- Add "errors" import (line 8)

Security Fix Details:
Before: Admin could delete user's filter → 204 No Content (SUCCESS)
After:  Admin tries to delete user's filter → 404 Not Found (DENIED)

The DELETE query uses WHERE id = @id AND user_id = @user_id, which matches
0 rows when attempting to delete another user's filter. The old :exec query
didn't return row count, so 0 affected rows looked like success. The new :one
query with RETURNING * returns pgx.ErrNoRows when no rows match, allowing
the handler to return proper 404 error.

Test Impact:
- TestSavedFilters/User_cannot_access_another_user's_filter now passes
- All 6 integration tests pass with proper user isolation enforcement

Pattern Consistency:
- Matches DeleteLibraryFolder pattern (line 99 in queries.sql)
- Uses same error handling as media handlers (errors.Is + pgx.ErrNoRows)
- Follows user-scoping pattern used throughout codebase

Related: Saved filters implementation user isolation
Security: Prevents unauthorized deletion of user data
2026-03-21 01:24:15 -04:00

193 lines
6.6 KiB
Go

package handlers
import (
"bookhoard/internal/database"
"bookhoard/internal/services"
"encoding/json"
"errors"
"net/http"
"strings"
"time"
"github.com/google/uuid"
"github.com/jackc/pgx/v5"
"github.com/labstack/echo/v5"
)
type FiltersHandler struct {
db *database.Queries
filtersService *services.FiltersService
}
func NewFiltersHandler(db *database.Queries) *FiltersHandler {
return &FiltersHandler{
db: db,
filtersService: services.NewFiltersService(db),
}
}
// CreateSavedFilterRequest - Request body for creating/updating filters
type CreateSavedFilterRequest struct {
Name string `json:"name" validate:"required,min=1,max=100"`
ResourceType string `json:"resource_type" validate:"required,oneof=media-items collections devices"`
Filters map[string]string `json:"filters" validate:"required"`
}
// SavedFilterResponse - Response format (matches database model structure)
type SavedFilterResponse struct {
ID uuid.UUID `json:"id"`
Name string `json:"name"`
ResourceType string `json:"resource_type"`
Filters json.RawMessage `json:"filters"` // JSONB as raw bytes
CreatedAt string `json:"created_at"`
UpdatedAt string `json:"updated_at"`
}
// Helper function to check if request wants HTML response
func wantsHTML(header http.Header) bool {
accept := header.Get("Accept")
return accept != "" && (accept == "text/html" || strings.Contains(accept, "text/html"))
}
// GetSavedFilters - GET /api/saved-filters?resource_type=media-items
// Supports both JSON (API) and HTML (HTMX) responses
func (h *FiltersHandler) GetSavedFilters(c *echo.Context) error {
user := c.Get("user").(database.Users)
userUUID := uuid.UUID(user.ID.Bytes)
resourceType := c.QueryParam("resource_type")
if resourceType == "" {
if wantsHTML(c.Request().Header) {
return c.String(http.StatusBadRequest, "resource_type query parameter is required")
}
return c.JSON(http.StatusBadRequest, map[string]string{
"error": "resource_type query parameter is required",
})
}
filters, err := h.filtersService.GetSavedFilters(c.Request().Context(), userUUID, resourceType)
if err != nil {
return c.JSON(http.StatusInternalServerError, map[string]string{"error": "failed to fetch filters"})
}
// Return JSON for API requests
response := make([]SavedFilterResponse, len(filters))
for i, f := range filters {
response[i] = SavedFilterResponse{
ID: uuid.Must(uuid.FromBytes(f.ID.Bytes[:])),
Name: f.Name,
ResourceType: f.ResourceType,
Filters: json.RawMessage(f.Filters), // Return JSONB as-is
CreatedAt: f.CreatedAt.Time.Format(time.RFC3339),
UpdatedAt: f.UpdatedAt.Time.Format(time.RFC3339),
}
}
return c.JSON(http.StatusOK, response)
}
// CreateSavedFilter - POST /api/saved-filters
// Supports both JSON (API) and HTML (HTMX) responses
func (h *FiltersHandler) CreateSavedFilter(c *echo.Context) error {
user := c.Get("user").(database.Users)
userUUID := uuid.UUID(user.ID.Bytes)
var req CreateSavedFilterRequest
if err := c.Bind(&req); err != nil {
if wantsHTML(c.Request().Header) {
return c.String(http.StatusBadRequest, "Invalid request body")
}
return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid request body"})
}
if req.Name == "" || req.ResourceType == "" {
return c.JSON(http.StatusBadRequest, map[string]string{"error": "name and resource_type are required"})
}
filter, err := h.filtersService.CreateSavedFilter(c.Request().Context(), userUUID, req.Name, req.ResourceType, req.Filters)
if err != nil {
if err.Error() == "filter with name '"+req.Name+"' already exists for this resource type" {
if wantsHTML(c.Request().Header) {
return c.String(http.StatusConflict, "Filter with this name already exists")
}
return c.JSON(http.StatusConflict, map[string]string{"error": err.Error()})
}
return c.JSON(http.StatusInternalServerError, map[string]string{"error": "failed to create filter"})
}
// Return JSON response (JSONB handled automatically)
response := SavedFilterResponse{
ID: uuid.Must(uuid.FromBytes(filter.ID.Bytes[:])),
Name: filter.Name,
ResourceType: filter.ResourceType,
Filters: json.RawMessage(filter.Filters),
CreatedAt: filter.CreatedAt.Time.Format(time.RFC3339),
UpdatedAt: filter.UpdatedAt.Time.Format(time.RFC3339),
}
// Add HX-Redirect for HTMX requests
if c.Request().Header.Get("HX-Request") == "true" {
c.Response().Header().Set("HX-Redirect", "/bookshelf")
}
return c.JSON(http.StatusCreated, response)
}
// DeleteSavedFilter - DELETE /api/saved-filters/:id
// Supports both JSON (API) and HTML (HTMX) responses
func (h *FiltersHandler) DeleteSavedFilter(c *echo.Context) error {
user := c.Get("user").(database.Users)
userUUID := uuid.UUID(user.ID.Bytes)
filterID, err := uuid.Parse(c.Param("id"))
if err != nil {
return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid filter ID"})
}
err = h.filtersService.DeleteSavedFilter(c.Request().Context(), userUUID, filterID)
if err != nil {
if errors.Is(err, pgx.ErrNoRows) {
return c.JSON(http.StatusNotFound, map[string]string{"error": "filter not found"})
}
return c.JSON(http.StatusInternalServerError, map[string]string{"error": "failed to delete filter"})
}
return c.NoContent(http.StatusNoContent)
}
// UpdateSavedFilter - PUT /api/saved-filters/:id
// Supports both JSON (API) and HTML (HTMX) responses
func (h *FiltersHandler) UpdateSavedFilter(c *echo.Context) error {
user := c.Get("user").(database.Users)
userUUID := uuid.UUID(user.ID.Bytes)
filterID, err := uuid.Parse(c.Param("id"))
if err != nil {
return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid filter ID"})
}
var req CreateSavedFilterRequest
if err := c.Bind(&req); err != nil {
return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid request body"})
}
filter, err := h.filtersService.UpdateSavedFilter(c.Request().Context(), userUUID, filterID, req.Name, req.Filters)
if err != nil {
if err.Error() == "filter with name '"+req.Name+"' already exists for this resource type" {
return c.JSON(http.StatusConflict, map[string]string{"error": err.Error()})
}
return c.JSON(http.StatusInternalServerError, map[string]string{"error": "failed to update filter"})
}
response := SavedFilterResponse{
ID: filterID,
Name: filter.Name,
ResourceType: filter.ResourceType,
Filters: json.RawMessage(filter.Filters),
CreatedAt: filter.CreatedAt.Time.Format(time.RFC3339),
UpdatedAt: filter.UpdatedAt.Time.Format(time.RFC3339),
}
return c.JSON(http.StatusOK, response)
}