timothyandClaude Opus 4.8
59edec1e85
Hardening from adversarial review of the #153 playlist API: - PUT /api/playlists/{id}: guard IsSystem in the controller after the existence pre-check -> 422, so a system (generated) playlist can no longer be renamed/wiped. ReplacePlaylistItems is never sent for it. - PUT /api/playlists/groups/{id}: add controller existence pre-check (404 for missing, mirroring DeleteGroup) plus an IsSystem 422 guard; RenamePlaylistGroupHandler also gains a system guard (defense-in-depth for the Blazor path). Missing/system are now distinct outcomes despite LanguageExtensions.Apply collapsing NotFoundError to a plain BaseError. - POST /api/playlists/preview: validate each draft item at the controller boundary (the id required for its collection type must be present) -> 422 before the shared PreviewPlaylistPlayoutHandler runs, preventing a NRE/500 in the playout builder. Logic lives in ReplacePlaylistRequest so it stays parallel with ReplacePlaylistItemsHandler's PUT-path check. Tests: controller cases for system-playlist PUT, system-group PUT, missing-group 404, and invalid-preview 422 (each asserting the handler is not invoked); handler tests for RenamePlaylistGroup system/missing/success. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
61 lines
2.7 KiB
C#
61 lines
2.7 KiB
C#
using ErsatzTV.Core;
|
|
using ErsatzTV.Core.Domain;
|
|
using ErsatzTV.Core.Errors;
|
|
using ErsatzTV.Infrastructure.Data;
|
|
using ErsatzTV.Infrastructure.Extensions;
|
|
using Microsoft.EntityFrameworkCore;
|
|
|
|
namespace ErsatzTV.Application.MediaCollections;
|
|
|
|
public class RenamePlaylistGroupHandler(IDbContextFactory<TvContext> dbContextFactory)
|
|
: IRequestHandler<RenamePlaylistGroup, Either<BaseError, PlaylistGroupViewModel>>
|
|
{
|
|
public async Task<Either<BaseError, PlaylistGroupViewModel>> Handle(
|
|
RenamePlaylistGroup request,
|
|
CancellationToken cancellationToken)
|
|
{
|
|
await using TvContext dbContext = await dbContextFactory.CreateDbContextAsync(cancellationToken);
|
|
Validation<BaseError, PlaylistGroup> validation = await Validate(dbContext, request, cancellationToken);
|
|
return await validation.Apply(playlistGroup => Persist(dbContext, request, playlistGroup));
|
|
}
|
|
|
|
private static async Task<PlaylistGroupViewModel> Persist(
|
|
TvContext dbContext,
|
|
RenamePlaylistGroup request,
|
|
PlaylistGroup playlistGroup)
|
|
{
|
|
playlistGroup.Name = request.Name;
|
|
await dbContext.SaveChangesAsync();
|
|
return Mapper.ProjectToViewModel(playlistGroup);
|
|
}
|
|
|
|
private static Task<Validation<BaseError, PlaylistGroup>> Validate(
|
|
TvContext dbContext,
|
|
RenamePlaylistGroup request,
|
|
CancellationToken cancellationToken) =>
|
|
PlaylistGroupMustExist(dbContext, request, cancellationToken)
|
|
.BindT(PlaylistGroupMustNotBeSystem)
|
|
.BindT(playlistGroup => ValidateName(request).Map(_ => playlistGroup));
|
|
|
|
private static Task<Validation<BaseError, PlaylistGroup>> PlaylistGroupMustExist(
|
|
TvContext dbContext,
|
|
RenamePlaylistGroup request,
|
|
CancellationToken cancellationToken) =>
|
|
dbContext.PlaylistGroups
|
|
.Include(pg => pg.Playlists)
|
|
.SelectOneAsync(pg => pg.Id, pg => pg.Id == request.PlaylistGroupId, cancellationToken)
|
|
.Map(o => o.ToValidation<BaseError>(
|
|
new NotFoundError($"PlaylistGroup {request.PlaylistGroupId} does not exist.")));
|
|
|
|
// Plain BaseError (NOT NotFoundError) so it maps to 422, mirroring DeletePlaylistGroupHandler's
|
|
// system-group guard. A missing group still surfaces as NotFoundError (404) from PlaylistGroupMustExist.
|
|
private static Validation<BaseError, PlaylistGroup> PlaylistGroupMustNotBeSystem(PlaylistGroup playlistGroup) =>
|
|
playlistGroup.IsSystem
|
|
? BaseError.New("Cannot rename system playlist group")
|
|
: playlistGroup;
|
|
|
|
private static Validation<BaseError, string> ValidateName(RenamePlaylistGroup request) =>
|
|
request.NotEmpty(x => x.Name)
|
|
.Bind(_ => request.NotLongerThan(50)(x => x.Name));
|
|
}
|