notazof/yavsc
Watch
1
1
Fork
You've already forked yavsc
 0
Code Issues 4 Pull requests Projects 2 Releases 25 Packages Wiki Activity Actions

fix(api): harden billing/blog validation and update rc14 changelog

Browse source
This commit is contained in:
Paul Schneider 2026-09-06 19:16:41 +01:00
commit ad5e9090ee
13 changed files with 168 additions and 53 deletions
Download patch file Download diff file Expand all files Collapse all files

64
src/Yavsc.Api/Controllers/Business/RdvQueryApiController.cs
View file

@ -65,18 +65,17 @@ public class RdvQueryApiController : Controller
public async Task<IActionResult> PostQuery([FromBody] RdvQuery query, CancellationToken cancellationToken)
{
var uid = User.GetUserId();
if (string.IsNullOrWhiteSpace(query.ClientId))
{
query.ClientId = uid;
}
// Security: the caller always posts for themselves.
query.ClientId = uid;
ModelState.Remove("Client");
ModelState.Remove("ClientId");
if (query.ClientId != uid && !User.IsInRole(Constants.AdminGroupName))
{
ModelState.AddModelError("ClientId", "You can only create your own RdvQuery");
return BadRequest(ModelState);
}
ModelState.Remove("UserCreated");
ModelState.Remove("UserModified");
ModelState.Remove("SelectedProfile");
ModelState.Remove("PerformerProfile");
ModelState.Remove("Context");
ModelState.Remove("Regularization");
if (!ModelState.IsValid)
{
@ -123,23 +122,44 @@ public class RdvQueryApiController : Controller
[HttpPut("{id}")]
public async Task<IActionResult> PutQuery([FromRoute] long id, [FromBody] RdvQuery query, CancellationToken cancellationToken)
{
if (!ModelState.IsValid)
{
return BadRequest(ModelState);
}
if (id != query.Id)
{
return BadRequest();
}
var uid = User.GetUserId();
if (query.ClientId != uid && !User.IsInRole(Constants.AdminGroupName))
var existing = await _context.RdvQueries
.Include(q => q.Location)
.SingleOrDefaultAsync(q => q.Id == id, cancellationToken);
if (existing is null)
{
return NotFound();
}
if (existing.ClientId != uid && !User.IsInRole(Constants.AdminGroupName))
{
return Forbid();
}
_context.Entry(query).State = EntityState.Modified;
existing.ActivityCode = query.ActivityCode;
existing.PerformerId = query.PerformerId;
existing.Consent = query.Consent;
existing.EventDate = query.EventDate;
existing.LocationType = query.LocationType;
existing.Reason = query.Reason;
existing.Status = query.Status;
existing.Provisional = query.Provisional;
if (query.Location is not null)
{
var resolvedLocation = await _context.Locations.FirstOrDefaultAsync(
x => x.Address == query.Location.Address
&& x.Longitude == query.Location.Longitude
&& x.Latitude == query.Location.Latitude,
cancellationToken);
existing.Location = resolvedLocation ?? query.Location;
if (resolvedLocation is null)
{
_context.Attach(query.Location);
}
}
try
{