Kevin L'Hereec
3cc189c534
- Scope update/destroy queries by userId (Computers & Components), matching the pattern already used in index/show/edit - Add missing auth.authenticate() calls on destroy actions - handleComponents now requires userId and scopes component lookups to the current user, preventing cross-user component takeover - handleComponents rejects attaching more than one component of the same 'unique' type to a computer (new InvalidComponentSelectionException, 422) - handlePictures scopes picture lookups by computerId - destroy(Computer) now detaches its components (computerId = null) instead of losing them to cascade delete, and removes the computer's uploads dir - Switch store/update actions to request.validateUsing() for consistency - Fix relative redirects to absolute paths (/computers, /computers/:id) - Untrack .env.production and add it to .gitignore (secrets must not be committed); local file kept on disk
18 lines
653 B
TypeScript
18 lines
653 B
TypeScript
import { Exception } from '@adonisjs/core/exceptions'
|
|
import type { HttpContext } from '@adonisjs/core/http'
|
|
|
|
/**
|
|
* Thrown when a component selection is invalid, either because:
|
|
* - the referenced component does not belong to the current user, or
|
|
* - more than one component of the same "unique" type is being attached
|
|
* to the same computer at once.
|
|
*/
|
|
export default class InvalidComponentSelectionException extends Exception {
|
|
static status = 422
|
|
static code = 'E_INVALID_COMPONENT_SELECTION'
|
|
|
|
handle(error: this, { response }: HttpContext) {
|
|
return response.status(error.status).send({ errors: [{ message: error.message }] })
|
|
}
|
|
}
|