Scope unit and accessory data to owning users

Signed-off-by: Sean Du <do4suki@gmail.com>

internal/handler/api/profile/info.go

@@ -326,7 +326,7 @@ func getAccessoryInfo(ss *session.Session, targetUserID, unitOwningUserID int) (
 		return nil, nil
 	}
 
-	has, accessoryData := ss.GetAccessoryByAccessoryOwningUserID(accessoryOwningID)
+	has, accessoryData := ss.GetAccessoryByAccessoryOwningUserIDForUser(targetUserID, accessoryOwningID)
 	if !has {
 		return nil, nil
 	}

internal/handler/friend/list.go

@@ -179,7 +179,7 @@ func buildCenterUnitInfo(ss *session.Session, userID, unitOwningUserID, awardID
 		return info, err
 	}
 	if has && accessoryWear.AccessoryOwningUserID > 0 {
-		hasAccessory, accessoryData := ss.GetAccessoryByAccessoryOwningUserID(accessoryWear.AccessoryOwningUserID)
+		hasAccessory, accessoryData := ss.GetAccessoryByAccessoryOwningUserIDForUser(userID, accessoryWear.AccessoryOwningUserID)
 		if hasAccessory {
 			accessoryInfo = friendschema.AccessoryInfo{
 				AccessoryOwningUserID: accessoryWear.AccessoryOwningUserID,

internal/handler/live/live.go

@@ -180,6 +180,7 @@ func matchMemberTag(ss *session.Session, cache map[memberTagMatchKey]bool, unitT
 func loadDeckUnitDataMap(ss *session.Session, unitOwningUserIDs []int) (map[int]unitmodel.UnitDataMap, error) {
 	unitRows := []unitmodel.UnitDataMap{}
 	err := ss.GetBasicUnitInfo().
+		Where("a.user_id = ?", ss.UserID).
 		In("a.unit_owning_user_id", unitOwningUserIDs).
 		Find(&unitRows)
 	if err != nil {
@@ -221,6 +222,7 @@ func loadAccessoryBonusMap(ss *session.Session, userID int, unitOwningUserIDs []
 
 	rows := []accessoryBonusRow{}
 	err = ss.UserEng.Table("user_accessory").
+		Where("user_id = ?", userID).
 		In("accessory_owning_user_id", accessoryIDs).
 		Cols("accessory_owning_user_id,accessory_id").
 		Find(&rows)

internal/handler/notice/common.go

@@ -134,7 +134,7 @@ func getGreetingAccessoryInfo(ss *session.Session, userID, unitOwningUserID int)
 		return nil, nil
 	}
 
-	has, accessoryData := ss.GetAccessoryByAccessoryOwningUserID(accessoryWear.AccessoryOwningUserID)
+	has, accessoryData := ss.GetAccessoryByAccessoryOwningUserIDForUser(userID, accessoryWear.AccessoryOwningUserID)
 	if !has {
 		return nil, nil
 	}

internal/handler/ranking/live.go

@@ -200,7 +200,7 @@ func getRankingAccessoryInfo(ss *session.Session, targetUserID, unitOwningUserID
 		return nil, nil
 	}
 
-	has, accessoryData := ss.GetAccessoryByAccessoryOwningUserID(accessoryOwningID)
+	has, accessoryData := ss.GetAccessoryByAccessoryOwningUserIDForUser(targetUserID, accessoryOwningID)
 	if !has {
 		return nil, nil
 	}

internal/handler/unit/deck.go

@@ -33,13 +33,15 @@ func deck(ctx *gin.Context) {
 	}
 
 	// 删除全部原有队伍成员
-	_, err = ss.UserEng.Table("user_deck_unit").In("user_deck_id", userDeckID).Delete()
+	_, err = ss.UserEng.Table("user_deck_unit").
+		Where("user_id = ?", ss.UserID).In("user_deck_id", userDeckID).Delete()
 	if ss.CheckErr(err) {
 		return
 	}
 
 	// 删除全部原有队伍
-	_, err = ss.UserEng.Table("user_deck").In("id", userDeckID).Delete()
+	_, err = ss.UserEng.Table("user_deck").
+		Where("user_id = ?", ss.UserID).In("id", userDeckID).Delete()
 	if ss.CheckErr(err) {
 		return
 	}
@@ -65,11 +67,15 @@ func deck(ctx *gin.Context) {
 		for _, u := range deck.UnitDeckDetail {
 			// 成员信息
 			unitData := unitmodel.UnitDataMap{}
-			_, err = ss.GetBasicUnitInfo().
+			has, err := ss.GetBasicUnitInfo().
-				Where("a.unit_owning_user_id = ?", u.UnitOwningUserID).Get(&unitData)
+				Where("a.user_id = ? AND a.unit_owning_user_id = ?", ss.UserID, u.UnitOwningUserID).Get(&unitData)
 			if ss.CheckErr(err) {
 				return
 			}
+			if !has {
+				ss.AbortWithStatus(http.StatusNotFound, honokautils.NewNotFoundContent(ctx.Request.URL.Path))
+				return
+			}
 			// fmt.Println("新的成员信息:", unitData)
 
 			// 插入新成员信息

internal/handler/unit/favorite.go

@@ -26,7 +26,8 @@ func favorite(ctx *gin.Context) {
 		FavoriteFlag: req.FavoriteFlag != 0,
 	}
 	_, err = ss.UserEng.Table(new(usermodel.UserUnitData)).
-		ID(req.UnitOwningUserID).Cols("favorite_flag").Update(&data)
+		Where("user_id = ? AND unit_owning_user_id = ?", ss.UserID, req.UnitOwningUserID).
+		Cols("favorite_flag").Update(&data)
 	if ss.CheckErr(err) {
 		return
 	}

internal/handler/unit/removableskillequipment.go

@@ -35,12 +35,21 @@ func removableSkillEquipment(ctx *gin.Context) {
 	// 佩戴宝石
 	for _, v := range req.Equip {
 		// fmt.Println("Equip:", v.UnitOwningUserID, v.UnitRemovableSkillID)
+		exists, err := ss.HasUserUnit(v.UnitOwningUserID)
+		if ss.CheckErr(err) {
+			return
+		}
+		if !exists {
+			ss.AbortWithStatus(http.StatusNotFound, honokautils.NewNotFoundContent(ctx.Request.URL.Path))
+			return
+		}
+
 		data := unitschema.RemovableSkillEquipmentData{
 			UnitRemovableSkillId: v.UnitRemovableSkillID,
 			UnitOwningUserID:     v.UnitOwningUserID,
 			UserID:               ss.UserID,
 		}
-		_, err := ss.UserEng.Table("user_unit_skill_equip").Insert(&data)
+		_, err = ss.UserEng.Table("user_unit_skill_equip").Insert(&data)
 		if ss.CheckErr(err) {
 			return
 		}

internal/handler/unit/sale.go

@@ -29,7 +29,11 @@ func sale(ctx *gin.Context) {
 		salePrice := 1 // TODO: 从 unit_level_up_pattern_m 表获取实际价格
 		totalCoin += salePrice
 
-		_, unitData := ss.GetUserUnitInfo(id)
+		has, unitData := ss.GetUserUnitInfo(id)
+		if !has || unitData == nil {
+			ss.AbortWithStatus(http.StatusNotFound, honokautils.NewNotFoundContent(ctx.Request.URL.Path))
+			return
+		}
 
 		saleDetail = append(saleDetail, unitschema.Detail{
 			UnitOwningUserID: id,
@@ -40,21 +44,21 @@ func sale(ctx *gin.Context) {
 
 		// 卸载宝石
 		_, err = ss.UserEng.Table(new(usermodel.UserUnitSkillEquip)).
-			Where("unit_owning_user_id = ?", id).Delete()
+			Where("user_id = ? AND unit_owning_user_id = ?", ss.UserID, id).Delete()
 		if ss.CheckErr(err) {
 			return
 		}
 
 		// 卸载饰品
 		_, err = ss.UserEng.Table(new(usermodel.UserAccessoryWear)).
-			Where("unit_owning_user_id = ?", id).Delete()
+			Where("user_id = ? AND unit_owning_user_id = ?", ss.UserID, id).Delete()
 		if ss.CheckErr(err) {
 			return
 		}
 
 		// 移除卡片
 		_, err = ss.UserEng.Table(new(usermodel.UserUnitData)).
-			Where("unit_owning_user_id = ?", id).Delete()
+			Where("user_id = ? AND unit_owning_user_id = ?", ss.UserID, id).Delete()
 		if ss.CheckErr(err) {
 			return
 		}

internal/handler/unit/setdisplayrank.go

@@ -26,7 +26,8 @@ func setDisplayRank(ctx *gin.Context) {
 		DisplayRank: req.DisplayRank,
 	}
 	_, err = ss.UserEng.Table(new(usermodel.UserUnitData)).
-		ID(req.UnitOwningUserID).Cols("display_rank").Update(&data)
+		Where("user_id = ? AND unit_owning_user_id = ?", ss.UserID, req.UnitOwningUserID).
+		Cols("display_rank").Update(&data)
 	if ss.CheckErr(err) {
 		return
 	}

internal/handler/unit/wearaccessory.go

@@ -49,6 +49,15 @@ func wearAccessory(ctx *gin.Context) {
 			return
 		}
 
+		exists, err = ss.HasUserUnit(v.UnitOwningUserID)
+		if ss.CheckErr(err) {
+			return
+		}
+		if !exists {
+			ss.CheckErr(errors.New("unit not found for user"))
+			return
+		}
+
 		data := unitschema.WearAccessoryData{
 			AccessoryOwningUserID: v.AccessoryOwningUserID,
 			UnitOwningUserID:      v.UnitOwningUserID,

internal/session/accessory.go

@@ -9,7 +9,7 @@ import (
 func (ss *Session) GetUserAccessoryWearByUnitOwningUserID(unitOwningUserID int) (bool, *usermodel.UserAccessoryWear) {
 	wearData := usermodel.UserAccessoryWear{}
 	has, err := ss.UserEng.Table(new(usermodel.UserAccessoryWear)).
-		Where("unit_owning_user_id = ?", unitOwningUserID).Get(&wearData)
+		Where("user_id = ? AND unit_owning_user_id = ?", ss.UserID, unitOwningUserID).Get(&wearData)
 	if ss.CheckErr(err) {
 		return false, nil
 	}
@@ -18,9 +18,13 @@ func (ss *Session) GetUserAccessoryWearByUnitOwningUserID(unitOwningUserID int)
 }
 
 func (ss *Session) GetUserAccessoryByAccessoryOwningUserID(accessoryOwningUserID int) (bool, *usermodel.UserAccessory) {
+	return ss.GetUserAccessoryByAccessoryOwningUserIDForUser(ss.UserID, accessoryOwningUserID)
+}
+
+func (ss *Session) GetUserAccessoryByAccessoryOwningUserIDForUser(userID, accessoryOwningUserID int) (bool, *usermodel.UserAccessory) {
 	accessoryData := usermodel.UserAccessory{}
 	has, err := ss.UserEng.Table(new(usermodel.UserAccessory)).
-		Where("accessory_owning_user_id = ?", accessoryOwningUserID).
+		Where("user_id = ? AND accessory_owning_user_id = ?", userID, accessoryOwningUserID).
 		Get(&accessoryData)
 	if ss.CheckErr(err) {
 		return false, nil
@@ -30,7 +34,11 @@ func (ss *Session) GetUserAccessoryByAccessoryOwningUserID(accessoryOwningUserID
 }
 
 func (ss *Session) GetAccessoryByAccessoryOwningUserID(accessoryOwningUserID int) (bool, *accessorymodel.Accessory) {
-	has, userAccessoryData := ss.GetUserAccessoryByAccessoryOwningUserID(accessoryOwningUserID)
+	return ss.GetAccessoryByAccessoryOwningUserIDForUser(ss.UserID, accessoryOwningUserID)
+}
+
+func (ss *Session) GetAccessoryByAccessoryOwningUserIDForUser(userID, accessoryOwningUserID int) (bool, *accessorymodel.Accessory) {
+	has, userAccessoryData := ss.GetUserAccessoryByAccessoryOwningUserIDForUser(userID, accessoryOwningUserID)
 	if !has {
 		return false, nil
 	}

internal/session/deck.go

@@ -26,7 +26,7 @@ func (ss *Session) GetUserDeckUnit(deckID int) []usermodel.UserDeckUnit {
 
 	unitData := []usermodel.UserDeckUnit{}
 	err = ss.UserEng.Table("user_deck_unit").
-		Where("user_deck_id = ?", deckData.ID).Find(&unitData)
+		Where("user_deck_id = ? AND user_id = ?", deckData.ID, ss.UserID).Find(&unitData)
 	if ss.CheckErr(err) {
 		return []usermodel.UserDeckUnit{}
 	}

internal/session/unit.go

@@ -36,7 +36,7 @@ func (ss *Session) GetUnitInfo(unitID int) (bool, *unitmodel.CommonUnitData) {
 func (ss *Session) GetUserUnitInfo(unitOwningUserID int) (bool, *unitmodel.CommonUnitData) {
 	var unitID int
 	has, err := ss.UserEng.Table(new(usermodel.UserUnitData)).
-		Where("unit_owning_user_id = ?", unitOwningUserID).
+		Where("user_id = ? AND unit_owning_user_id = ?", ss.UserID, unitOwningUserID).
 		Cols("unit_id").Get(&unitID)
 	if ss.CheckErr(err) {
 		return false, nil
@@ -49,10 +49,16 @@ func (ss *Session) GetUserUnitInfo(unitOwningUserID int) (bool, *unitmodel.Commo
 	return ss.GetUnitInfo(unitID)
 }
 
+func (ss *Session) HasUserUnit(unitOwningUserID int) (bool, error) {
+	return ss.UserEng.Table(new(usermodel.UserUnitData)).
+		Where("user_id = ? AND unit_owning_user_id = ?", ss.UserID, unitOwningUserID).
+		Exist()
+}
+
 func (ss *Session) GetUserUnitSkillEquip(unitOwningUserID int) []usermodel.UserUnitSkillEquip {
 	skill := []usermodel.UserUnitSkillEquip{}
 	err := ss.UserEng.Table("user_unit_skill_equip").
-		Where("unit_owning_user_id = ?", unitOwningUserID).Find(&skill)
+		Where("user_id = ? AND unit_owning_user_id = ?", ss.UserID, unitOwningUserID).Find(&skill)
 	if ss.CheckErr(err) {
 		return []usermodel.UserUnitSkillEquip{}
 	}