Verify deletion request is valid for specified object/file before sav…

…ing WorkItem.

pgmodels/deletion_request.go

@@ -96,6 +96,26 @@ func DeletionRequestSelect(query *Query) ([]*DeletionRequest, error) {
 	return requests, err
 }
 
+// DeletionRequestIncludesFile returns true if the deletion request with the
+// specified ID includes the generic file with the specified ID.
+func DeletionRequestIncludesFile(requestID, gfID int64) (bool, error) {
+	db := common.Context().DB
+	var count int
+	query := `SELECT count(*) FROM deletion_requests_generic_files where deletion_request_id = ? and generic_file_id = ?`
+	_, err := db.Model((*DeletionRequestsGenericFiles)(nil)).QueryOne(pg.Scan(&count), query, requestID, gfID)
+	return count > 0, err
+}
+
+// DeletionRequestIncludesObject returns true if the deletion request with the
+// specified ID includes the intellectual object with the specified ID.
+func DeletionRequestIncludesObject(requestID, objID int64) (bool, error) {
+	db := common.Context().DB
+	var count int
+	query := `SELECT count(*) FROM deletion_requests_intellectual_objects where deletion_request_id = ? and intellectual_object_id = ?`
+	_, err := db.Model((*DeletionRequestsGenericFiles)(nil)).QueryOne(pg.Scan(&count), query, requestID, objID)
+	return count > 0, err
+}
+
 // Save saves this requestitution to the database. This will peform an insert
 // if DeletionRequest.ID is zero. Otherwise, it updates.
 func (request *DeletionRequest) Save() error {

pgmodels/deletion_request_test.go

@@ -2,11 +2,13 @@ package pgmodels_test
 
 import (
 	"testing"
+	"time"
 
 	"github.com/APTrust/registry/common"
 	"github.com/APTrust/registry/constants"
 	"github.com/APTrust/registry/db"
 	"github.com/APTrust/registry/pgmodels"
+	"github.com/APTrust/registry/web/testutil"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -232,6 +234,60 @@ func TestDeletionRequestAddObject(t *testing.T) {
 	assert.Equal(t, req.IntellectualObjects[0], req.FirstObject())
 }
 
+func TestDeletionRequestIncludesFilesAndObjects(t *testing.T) {
+	defer db.ForceFixtureReload()
+
+	// Create a deletion request
+	req, err := pgmodels.NewDeletionRequest()
+	require.Nil(t, err)
+	require.NotNil(t, req)
+
+	// Add the requestor, institution id, etc.
+	inst2Admin := testutil.InitUser(t, "[email protected]")
+	req.RequestedBy = inst2Admin
+	req.RequestedByID = inst2Admin.ID
+	req.InstitutionID = inst2Admin.InstitutionID
+	req.RequestedAt = time.Now().UTC()
+
+	// Now add three objects and three files to the request
+	for i := 0; i < 3; i++ {
+		obj := pgmodels.RandomObject()
+		obj.InstitutionID = inst2Admin.InstitutionID
+		require.NoError(t, obj.Save())
+		req.AddObject(obj)
+
+		gf := pgmodels.RandomGenericFile(obj.ID, obj.Identifier)
+		gf.InstitutionID = inst2Admin.InstitutionID
+		require.NoError(t, gf.Save())
+		req.AddFile(gf)
+	}
+
+	// Save the request, with associated files and objects
+	require.NoError(t, req.Save())
+
+	// Now test the IncludesFile and IncludesObject functions
+	for _, obj := range req.IntellectualObjects {
+		isIncluded, err := pgmodels.DeletionRequestIncludesObject(req.ID, obj.ID)
+		require.NoError(t, err)
+		assert.True(t, isIncluded)
+	}
+	// Random, bogus object should not be included
+	isIncluded, err := pgmodels.DeletionRequestIncludesObject(req.ID, 99999999)
+	require.NoError(t, err)
+	assert.False(t, isIncluded)
+
+	// Check the files
+	for _, gf := range req.GenericFiles {
+		isIncluded, err := pgmodels.DeletionRequestIncludesFile(req.ID, gf.ID)
+		require.NoError(t, err)
+		assert.True(t, isIncluded)
+	}
+	// Random, bogus file should not be included
+	isIncluded, err = pgmodels.DeletionRequestIncludesFile(req.ID, 99999999)
+	require.NoError(t, err)
+	assert.False(t, isIncluded)
+}
+
 func TestDeletionRequestConfirm(t *testing.T) {
 	user, err := pgmodels.UserByID(5)
 	require.Nil(t, err)

pgmodels/work_item.go

@@ -223,6 +223,37 @@ func (item *WorkItem) Validate() *common.ValidationError {
 	if len(errors) > 0 {
 		return &common.ValidationError{Errors: errors}
 	}
+
+	// Inst users and admins can't create or update work items,
+	// but let's say some smarty pants figures out a way to do this.
+	// Prevent malicious users from inserting a deletion request ID
+	// into this work item. For such an insertion to succeed, there
+	// would have to be an existing deletion request that already
+	// includes this file or object.
+	if item.Action == constants.ActionDelete && item.DeletionRequestID != 0 {
+		if item.GenericFileID != 0 {
+			isLegitFileDeletion, err := DeletionRequestIncludesFile(item.DeletionRequestID, item.GenericFileID)
+			if err != nil {
+				common.Context().Log.Error().Msgf("Error checking whether deletion request includes file: %v", err)
+				if !isLegitFileDeletion {
+					errors["DeletionRequestID"] = "Invalid deletion request ID / file"
+				}
+			}
+		} else if item.IntellectualObjectID != 0 {
+			isLegitObjectDeletion, err := DeletionRequestIncludesObject(item.DeletionRequestID, item.IntellectualObjectID)
+			if err != nil {
+				common.Context().Log.Error().Msgf("Error checking whether deletion request includes object: %v", err)
+				if !isLegitObjectDeletion {
+					errors["DeletionRequestID"] = "Invalid deletion request ID / object"
+				}
+			}
+		}
+	}
+
+	if len(errors) > 0 {
+		return &common.ValidationError{Errors: errors}
+	}
+
 	return nil
 }