delete files etc ..

backend/internal/db/migrations/012_v3_schema.up.sql

@@ -74,7 +74,7 @@ CREATE INDEX idx_refresh_tokens_token_hash ON refresh_tokens(token_hash);
 CREATE TABLE resource_tags (
     id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
     tag_id UUID NOT NULL REFERENCES tags(id),
-    resource_id UUID NOT NULL REFERENCES resources(id),
+    resource_id UUID NOT NULL REFERENCES resources(id) ON DELETE CASCADE,
     UNIQUE(tag_id, resource_id)
 );
 

backend/internal/db/migrations/015_resource_tags_cascade.down.sql

@@ -0,0 +1,2 @@
+ALTER TABLE resource_tags DROP CONSTRAINT resource_tags_resource_id_fkey,
+    ADD CONSTRAINT resource_tags_resource_id_fkey FOREIGN KEY (resource_id) REFERENCES resources(id);

backend/internal/db/migrations/015_resource_tags_cascade.up.sql

@@ -0,0 +1,2 @@
+ALTER TABLE resource_tags DROP CONSTRAINT resource_tags_resource_id_fkey,
+    ADD CONSTRAINT resource_tags_resource_id_fkey FOREIGN KEY (resource_id) REFERENCES resources(id) ON DELETE CASCADE;

backend/internal/handler/resource.go

@@ -1,6 +1,7 @@
 package handler
 
 import (
+	"errors"
 	"log"
 	"net/http"
 	"os"
@@ -230,28 +231,33 @@ func (h *ResourceHandler) Get(c *gin.Context) {
 	}
 
 	api.Success(c, gin.H{
-		"id":           resource.ID,
-		"name":         resource.Name,
-		"url":          downloadURL,
-		"thumbnailUrl": thumbURL,
-		"size":         resource.Size,
-		"mimeType":     resource.MimeType,
-		"tags":         tags,
-		"createdAt":    resource.CreatedAt,
-		"updatedAt":    resource.UpdatedAt,
-		"ocrText":      resource.OcrText,
-		"isFolder":     resource.IsFolder,
+		"id":               resource.ID,
+		"name":             resource.Name,
+		"url":              downloadURL,
+		"thumbnailUrl":     thumbURL,
+		"size":             resource.Size,
+		"mimeType":         resource.MimeType,
+		"tags":             tags,
+		"createdAt":        resource.CreatedAt,
+		"updatedAt":        resource.UpdatedAt,
+		"ocrText":          resource.OcrText,
+		"isFolder":         resource.IsFolder,
 		"parentResourceId": resource.ParentResourceID,
-		"ownerId":      resource.OwnerID,
-		"variants":     variants,
+		"ownerId":          resource.OwnerID,
+		"variants":         variants,
 	})
 }
 
 func (h *ResourceHandler) Delete(c *gin.Context) {
+	userID := c.GetString(auth.UserIDKey)
 	id := c.Param("id")
 
-	result, err := h.resources.DeleteRecursive(id)
+	result, err := h.resources.DeleteRecursive(id, userID)
 	if err != nil {
+		if errors.Is(err, service.ErrForbidden) {
+			api.Error(c, http.StatusForbidden, "FORBIDDEN", "You do not own this resource")
+			return
+		}
 		api.Error(c, http.StatusInternalServerError, "DB_ERROR", "Failed to delete resource")
 		return
 	}

backend/internal/service/resource.go

@@ -20,6 +20,8 @@ import (
 	"github.com/vaultdrop/backend/internal/model"
 )
 
+var ErrForbidden = errors.New("forbidden")
+
 type ResourceService struct {
 	db      *sql.DB
 	queries *db.Queries
@@ -200,14 +202,22 @@ func (s *ResourceService) Delete(id string) error {
 	return s.queries.DeleteResource(context.Background(), resourceUUID)
 }
 
-func (s *ResourceService) DeleteRecursive(id string) (*DeleteResult, error) {
+func (s *ResourceService) DeleteRecursive(id, userID string) (*DeleteResult, error) {
 	resourceUUID, _ := uuid.Parse(id)
+	ownerUUID, err := uuid.Parse(userID)
+	if err != nil {
+		return nil, ErrForbidden
+	}
 
 	r, err := s.queries.GetResource(context.Background(), resourceUUID)
 	if err != nil {
 		return nil, fmt.Errorf("get resource: %w", err)
 	}
 
+	if r.OwnerID != ownerUUID {
+		return nil, ErrForbidden
+	}
+
 	result := &DeleteResult{}
 
 	if r.IsFolder {
@@ -217,7 +227,7 @@ func (s *ResourceService) DeleteRecursive(id string) (*DeleteResult, error) {
 		}
 
 		for _, child := range children {
-			childResult, err := s.DeleteRecursive(child.ID.String())
+			childResult, err := s.DeleteRecursive(child.ID.String(), userID)
 			if err != nil {
 				return nil, fmt.Errorf("delete child %s: %w", child.ID, err)
 			}