Talon/chat_grid
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Require targetUserId for item transfers

Browse Source
This commit is contained in:
Jage9
2026-02-28 20:26:40 -05:00
parent daab7bb759
commit 449f2c9530
5 changed files with 16 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
server/app/models.py
View File

@@ -140,8 +140,7 @@ class ItemDeletePacket(BasePacket):
class ItemTransferPacket(BasePacket):
type: Literal["item_transfer"]
itemId: str
targetId: str | None = None
targetUserId: str | None = None
targetUserId: str
class ItemTransferTargetsPacket(BasePacket):

6
server/app/server.py
View File

@@ -2545,11 +2545,7 @@ class SignalingServer:
if not can_transfer_any and not can_transfer_own:
await self._send_item_result(client, False, "transfer", "Not authorized to transfer this item.", item.id)
return
target_user_id = str(packet.targetUserId or "").strip()
if not target_user_id and packet.targetId:
target = self._get_client_by_id(packet.targetId)
if target and target.authenticated and target.user_id:
target_user_id = target.user_id
target_user_id = str(packet.targetUserId).strip()
if not target_user_id:
await self._send_item_result(client, False, "transfer", "Target user is not available.", item.id)
return

15
server/tests/test_server_message_handling.py
View File

@@ -377,7 +377,10 @@ async def test_item_transfer_updates_item_owner(monkeypatch: pytest.MonkeyPatch)
monkeypatch.setattr(server, "_broadcast_item", fake_broadcast_item)
monkeypatch.setattr(server, "_broadcast", fake_broadcast)
await server._handle_message(owner, json.dumps({"type": "item_transfer", "itemId": item.id, "targetId": target.id}))
await server._handle_message(
owner,
json.dumps({"type": "item_transfer", "itemId": item.id, "targetUserId": target.user_id}),
)
assert item.createdBy == target.user_id
assert item.createdByName == target.username
@@ -439,7 +442,10 @@ async def test_item_transfer_allows_self_target_for_transfer_any(monkeypatch: py
monkeypatch.setattr(server, "_send", fake_send)
monkeypatch.setattr(server, "_broadcast_item", fake_broadcast_item)
await server._handle_message(actor, json.dumps({"type": "item_transfer", "itemId": item.id, "targetId": actor.id}))
await server._handle_message(
actor,
json.dumps({"type": "item_transfer", "itemId": item.id, "targetUserId": actor.user_id}),
)
assert item.createdBy == actor.user_id
assert item.createdByName == actor.username
@@ -677,7 +683,10 @@ async def test_item_transfer_rejects_when_not_authorized(monkeypatch: pytest.Mon
monkeypatch.setattr(server, "_send", fake_send)
await server._handle_message(owner, json.dumps({"type": "item_transfer", "itemId": item.id, "targetId": target.id}))
await server._handle_message(
owner,
json.dumps({"type": "item_transfer", "itemId": item.id, "targetUserId": target.user_id}),
)
assert item.createdBy == owner.user_id
assert send_payloads