Scope unit and accessory data to owning users

Signed-off-by: Sean Du <do4suki@gmail.com>

internal/handler/unit/deck.go

@@ -33,13 +33,15 @@ func deck(ctx *gin.Context) {
 	}
 
 	// 删除全部原有队伍成员
-	_, err = ss.UserEng.Table("user_deck_unit").In("user_deck_id", userDeckID).Delete()
+	_, err = ss.UserEng.Table("user_deck_unit").
+		Where("user_id = ?", ss.UserID).In("user_deck_id", userDeckID).Delete()
 	if ss.CheckErr(err) {
 		return
 	}
 
 	// 删除全部原有队伍
-	_, err = ss.UserEng.Table("user_deck").In("id", userDeckID).Delete()
+	_, err = ss.UserEng.Table("user_deck").
+		Where("user_id = ?", ss.UserID).In("id", userDeckID).Delete()
 	if ss.CheckErr(err) {
 		return
 	}
@@ -65,11 +67,15 @@ func deck(ctx *gin.Context) {
 		for _, u := range deck.UnitDeckDetail {
 			// 成员信息
 			unitData := unitmodel.UnitDataMap{}
-			_, err = ss.GetBasicUnitInfo().
-				Where("a.unit_owning_user_id = ?", u.UnitOwningUserID).Get(&unitData)
+			has, err := ss.GetBasicUnitInfo().
+				Where("a.user_id = ? AND a.unit_owning_user_id = ?", ss.UserID, u.UnitOwningUserID).Get(&unitData)
 			if ss.CheckErr(err) {
 				return
 			}
+			if !has {
+				ss.AbortWithStatus(http.StatusNotFound, honokautils.NewNotFoundContent(ctx.Request.URL.Path))
+				return
+			}
 			// fmt.Println("新的成员信息:", unitData)
 
 			// 插入新成员信息

internal/handler/unit/favorite.go

@@ -26,7 +26,8 @@ func favorite(ctx *gin.Context) {
 		FavoriteFlag: req.FavoriteFlag != 0,
 	}
 	_, err = ss.UserEng.Table(new(usermodel.UserUnitData)).
-		ID(req.UnitOwningUserID).Cols("favorite_flag").Update(&data)
+		Where("user_id = ? AND unit_owning_user_id = ?", ss.UserID, req.UnitOwningUserID).
+		Cols("favorite_flag").Update(&data)
 	if ss.CheckErr(err) {
 		return
 	}

internal/handler/unit/removableskillequipment.go

@@ -35,12 +35,21 @@ func removableSkillEquipment(ctx *gin.Context) {
 	// 佩戴宝石
 	for _, v := range req.Equip {
 		// fmt.Println("Equip:", v.UnitOwningUserID, v.UnitRemovableSkillID)
+		exists, err := ss.HasUserUnit(v.UnitOwningUserID)
+		if ss.CheckErr(err) {
+			return
+		}
+		if !exists {
+			ss.AbortWithStatus(http.StatusNotFound, honokautils.NewNotFoundContent(ctx.Request.URL.Path))
+			return
+		}
+
 		data := unitschema.RemovableSkillEquipmentData{
 			UnitRemovableSkillId: v.UnitRemovableSkillID,
 			UnitOwningUserID:     v.UnitOwningUserID,
 			UserID:               ss.UserID,
 		}
-		_, err := ss.UserEng.Table("user_unit_skill_equip").Insert(&data)
+		_, err = ss.UserEng.Table("user_unit_skill_equip").Insert(&data)
 		if ss.CheckErr(err) {
 			return
 		}

internal/handler/unit/sale.go

@@ -29,7 +29,11 @@ func sale(ctx *gin.Context) {
 		salePrice := 1 // TODO: 从 unit_level_up_pattern_m 表获取实际价格
 		totalCoin += salePrice
 
-		_, unitData := ss.GetUserUnitInfo(id)
+		has, unitData := ss.GetUserUnitInfo(id)
+		if !has || unitData == nil {
+			ss.AbortWithStatus(http.StatusNotFound, honokautils.NewNotFoundContent(ctx.Request.URL.Path))
+			return
+		}
 
 		saleDetail = append(saleDetail, unitschema.Detail{
 			UnitOwningUserID: id,
@@ -40,21 +44,21 @@ func sale(ctx *gin.Context) {
 
 		// 卸载宝石
 		_, err = ss.UserEng.Table(new(usermodel.UserUnitSkillEquip)).
-			Where("unit_owning_user_id = ?", id).Delete()
+			Where("user_id = ? AND unit_owning_user_id = ?", ss.UserID, id).Delete()
 		if ss.CheckErr(err) {
 			return
 		}
 
 		// 卸载饰品
 		_, err = ss.UserEng.Table(new(usermodel.UserAccessoryWear)).
-			Where("unit_owning_user_id = ?", id).Delete()
+			Where("user_id = ? AND unit_owning_user_id = ?", ss.UserID, id).Delete()
 		if ss.CheckErr(err) {
 			return
 		}
 
 		// 移除卡片
 		_, err = ss.UserEng.Table(new(usermodel.UserUnitData)).
-			Where("unit_owning_user_id = ?", id).Delete()
+			Where("user_id = ? AND unit_owning_user_id = ?", ss.UserID, id).Delete()
 		if ss.CheckErr(err) {
 			return
 		}

internal/handler/unit/setdisplayrank.go

@@ -26,7 +26,8 @@ func setDisplayRank(ctx *gin.Context) {
 		DisplayRank: req.DisplayRank,
 	}
 	_, err = ss.UserEng.Table(new(usermodel.UserUnitData)).
-		ID(req.UnitOwningUserID).Cols("display_rank").Update(&data)
+		Where("user_id = ? AND unit_owning_user_id = ?", ss.UserID, req.UnitOwningUserID).
+		Cols("display_rank").Update(&data)
 	if ss.CheckErr(err) {
 		return
 	}

internal/handler/unit/wearaccessory.go

@@ -49,6 +49,15 @@ func wearAccessory(ctx *gin.Context) {
 			return
 		}
 
+		exists, err = ss.HasUserUnit(v.UnitOwningUserID)
+		if ss.CheckErr(err) {
+			return
+		}
+		if !exists {
+			ss.CheckErr(errors.New("unit not found for user"))
+			return
+		}
+
 		data := unitschema.WearAccessoryData{
 			AccessoryOwningUserID: v.AccessoryOwningUserID,
 			UnitOwningUserID:      v.UnitOwningUserID,