root/geo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(publish): scope desktop publish task list and retry by creator user

Browse Source 
Now that desktop clients can be re-registered with a new id under the
same user, listing/searching publish tasks by client.id missed the user's
older history and the retry path forbade jobs created from a previous
client. Switch the list/count queries to join desktop_publish_jobs and
filter by created_by_user_id, and enforce the same ownership when
retrying via desktop task. Qualify column names with the t. alias so the
join doesn't break the existing ORDER BY clauses.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
liangxu
2026-04-27 20:06:47 +08:00
parent 543fe0635f
commit aa8cc6aff4
2 changed files with 76 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/internal/tenant/app/publish_job_service.go
+30 -2
View File
@@ -281,8 +281,8 @@ func (s *PublishJobService) RetryByDesktopTask(
if task.Kind != "publish" {
return nil, response.ErrBadRequest(40095, "desktop_task_not_publish", "only publish tasks can be retried")
}
if task.TargetClientID != client.ID {
return nil, response.ErrForbidden(40381, "desktop_task_not_target_client", "desktop task is assigned to another desktop client")
if err := s.authorizePublishTaskForClientUser(ctx, client, task); err != nil {
return nil, err
}
if task.Status == "queued" || task.Status == "in_progress" {
return nil, response.ErrConflict(40994, "desktop_task_retry_conflict", "desktop task is still pending or running")
@@ -314,6 +314,34 @@ func (s *PublishJobService) RetryByDesktopTask(
})
}
func (s *PublishJobService) authorizePublishTaskForClientUser(
ctx context.Context,
client *repository.DesktopClient,
task *repository.DesktopTask,
) error {
if client == nil || task == nil {
return response.ErrUnauthorized(40108, "desktop_client_missing", "desktop client context is required")
}
var ownsTask bool
err := s.pool.QueryRow(ctx, `
SELECT EXISTS (
SELECT 1
FROM desktop_publish_jobs
WHERE desktop_id = $1
AND workspace_id = $2
AND created_by_user_id = $3
)
`, task.JobID, client.WorkspaceID, client.UserID).Scan(&ownsTask)
if err != nil {
return response.ErrInternal(50115, "desktop_publish_job_lookup_failed", "failed to validate desktop publish task ownership")
}
if !ownsTask {
return response.ErrForbidden(40384, "desktop_publish_task_not_owned", "desktop publish task belongs to another user")
}
return nil
}
func (s *PublishJobService) resolveRetryArticleID(ctx context.Context, tenantID int64, payload map[string]any) (int64, error) {
if articleID, ok := resolveRetryArticleIDFromPayload(payload); ok {
return articleID, nil