it works!

papermerge · Aug 21, 2024 · afcb635 · afcb635
1 parent 2407c2d
commit afcb635
Show file tree

Hide file tree

Showing 3 changed files with 13 additions and 4 deletions.
diff --git a/papermerge/core/db/doc_ver.py b/papermerge/core/db/doc_ver.py
@@ -31,14 +31,18 @@ def get_last_doc_ver(
 
 def get_doc_ver(
     engine: Engine,
-    id: UUID  # noqa
+    id: UUID,  # noqa
+    user_id: UUID
 ) -> schemas.DocumentVersion:
     """
     Returns last version of the document
     identified by doc_id
     """
     with Session(engine) as session:  # noqa
-        stmt = select(DocumentVersion).where(DocumentVersion.id == id)
+        stmt = select(DocumentVersion).join(Document).where(
+            Document.user_id == user_id,
+            DocumentVersion.id == id
+        )
         db_doc_ver = session.scalars(stmt).one()
         model_doc_ver = schemas.DocumentVersion.model_validate(db_doc_ver)
 

diff --git a/papermerge/core/routers/document_version.py b/papermerge/core/routers/document_version.py
@@ -76,7 +76,8 @@ def document_version_details(
     try:
         doc_ver = db.get_doc_ver(
             engine,
-            id=document_version_id
+            id=document_version_id,
+            user_id=user.id
         )
     except db_exc.PageNotFound:
         raise HTTPException(

diff --git a/papermerge/core/routers/pages.py b/papermerge/core/routers/pages.py
@@ -94,7 +94,11 @@ def get_page_jpg_url(
     """
     try:
         page = db.get_page(engine, id=page_id, user_id=user.id)
-        doc_ver = db.get_doc_ver(engine, id=page.document_version_id)
+        doc_ver = db.get_doc_ver(
+            engine,
+            id=page.document_version_id,
+            user_id=user.id
+        )
     except db_exc.PageNotFound:
         raise HTTPException(
             status_code=404,