Upload source code

src/server/services/paintingSchemeService.ts

@@ -0,0 +1,72 @@
+import PaintingScheme from '../models/PaintingScheme.js';
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export const createPaintingScheme = async (data: any & { organizationId?: string }) => {
+    const newScheme = new PaintingScheme({ ...data, organizationId: data.organizationId });
+    const saved = await newScheme.save();
+    return { ...saved.toObject(), id: saved._id.toString() };
+};
+
+export const getPaintingSchemesByProject = async (projectId: string, organizationId?: string) => {
+    const query = { projectId, ...(organizationId ? { organizationId } : {}) };
+    const schemes = await PaintingScheme.find(query).lean();
+    return schemes.map(s => ({ ...s, id: s._id.toString() }));
+};
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export const updatePaintingScheme = async (id: string, data: any, organizationId?: string) => {
+    // SECURITY FIX: Allow update if:
+    // 1. Matches ID AND Matches Organization
+    // 2. OR Matches ID AND Record has NO organization (legacy/orphan) -> Adopt it!
+
+    let query: any = { _id: id };
+
+    // First, check if the record exists and what is its state
+    const existing = await PaintingScheme.findById(id);
+
+    if (!existing) return null;
+
+    // Check ownership
+    if (organizationId && existing.organizationId && existing.organizationId !== organizationId) {
+        // Exists but belongs to ANOTHER organization -> Deny
+        console.warn(`Access Denied: Scheme ${id} belongs to ${existing.organizationId}, user is ${organizationId}`);
+        return null; // Return null effectively hides it or acts as fail
+    }
+
+    // If we passed the check, we perform the update.
+    // Ensure we "adopt" the record if it didn't have an orgId
+    if (organizationId && !data.organizationId) {
+        data.organizationId = organizationId;
+    }
+
+    const updated = await PaintingScheme.findOneAndUpdate({ _id: id }, data, { new: true }).lean();
+    if (updated) {
+        return { ...updated, id: updated._id.toString() };
+    }
+    return null;
+};
+
+export const deletePaintingScheme = async (id: string, organizationId?: string) => {
+    // Find first to check permissions
+    const existing = await PaintingScheme.findById(id);
+    if (!existing) return;
+
+    // Permissions:
+    // If user has org, and item has OTHER org, deny.
+    if (organizationId && existing.organizationId && existing.organizationId !== organizationId) {
+        console.warn(`[Delete PaintingScheme] Access Denied. User Org: ${organizationId}, Scheme Org: ${existing.organizationId}`);
+        return;
+    }
+
+    await PaintingScheme.findByIdAndDelete(id);
+};
+
+export const getAllSchemes = async (organizationId?: string) => {
+    const query = organizationId ? { organizationId } : {};
+    const schemes = await PaintingScheme.find(query).lean();
+    return schemes.map(s => ({ ...s, id: s._id.toString() }));
+};
+
+
+