fix disk monitor preferences profile ownership

pytorrent/services/preferences.py

@@ -296,17 +296,39 @@ def legacy_disk_monitor_preferences(user_id: int | None = None) -> dict:
     return _normalize_disk_monitor(row)
 
 
+def _disk_monitor_owner_label(row: dict | None) -> str:
+    if not row:
+        return ""
+    return str(row.get("owner_display_name") or row.get("owner_username") or row.get("owner_email") or (f"user #{row.get('user_id')}" if row.get("user_id") else "")).strip()
+
+
 def get_disk_monitor_preferences(profile_id: int | None = None, user_id: int | None = None) -> dict:
     user_id = user_id or auth.current_user_id() or default_user_id()
     profile_id = int(profile_id or _active_profile_id_for_user(user_id) or 0)
     if not profile_id:
         return legacy_disk_monitor_preferences(user_id)
+    if not auth.can_access_profile(profile_id, user_id):
+        return legacy_disk_monitor_preferences(user_id)
     with connect() as conn:
-        row = conn.execute("SELECT * FROM disk_monitor_preferences WHERE user_id=? AND profile_id=?", (user_id, profile_id)).fetchone()
+        row = conn.execute(
+            """
+            SELECT d.*, u.username AS owner_username, u.display_name AS owner_display_name, u.email AS owner_email
+            FROM disk_monitor_preferences d
+            LEFT JOIN users u ON u.id=d.user_id
+            WHERE d.profile_id=?
+            """,
+            (profile_id,),
+        ).fetchone()
     if row:
-        return _normalize_disk_monitor(row)
+        clean = _normalize_disk_monitor(row)
+        clean["disk_monitor_owner_user_id"] = int(row.get("user_id") or 0)
+        clean["disk_monitor_owner_label"] = _disk_monitor_owner_label(row)
+        return clean
     # Backward-compatible seed: existing global disk monitor values become defaults for first use of a profile.
-    return legacy_disk_monitor_preferences(user_id)
+    clean = legacy_disk_monitor_preferences(user_id)
+    clean["disk_monitor_owner_user_id"] = 0
+    clean["disk_monitor_owner_label"] = ""
+    return clean
 
 
 def save_disk_monitor_preferences(profile_id: int | None, data: dict, user_id: int | None = None) -> dict:
@@ -314,6 +336,8 @@ def save_disk_monitor_preferences(profile_id: int | None, data: dict, user_id: i
     profile_id = int(profile_id or _active_profile_id_for_user(user_id) or 0)
     if not profile_id:
         return legacy_disk_monitor_preferences(user_id)
+    if not auth.can_write_profile(profile_id, user_id):
+        raise PermissionError("No write access to profile")
     current = get_disk_monitor_preferences(profile_id, user_id)
     merged = dict(current)
     for key in ("disk_monitor_paths_json", "disk_monitor_mode", "disk_monitor_selected_path", "disk_monitor_stop_enabled", "disk_monitor_stop_threshold"):
@@ -323,10 +347,14 @@ def save_disk_monitor_preferences(profile_id: int | None, data: dict, user_id: i
     now = utcnow()
     with connect() as conn:
         conn.execute(
-            "INSERT INTO disk_monitor_preferences(user_id,profile_id,paths_json,mode,selected_path,stop_enabled,stop_threshold,created_at,updated_at) VALUES(?,?,?,?,?,?,?,?,?) "
-            "ON CONFLICT(user_id,profile_id) DO UPDATE SET paths_json=excluded.paths_json, mode=excluded.mode, selected_path=excluded.selected_path, stop_enabled=excluded.stop_enabled, stop_threshold=excluded.stop_threshold, updated_at=excluded.updated_at",
-            (user_id, profile_id, clean["disk_monitor_paths_json"], clean["disk_monitor_mode"], clean["disk_monitor_selected_path"], clean["disk_monitor_stop_enabled"], clean["disk_monitor_stop_threshold"], now, now),
+            "INSERT INTO disk_monitor_preferences(profile_id,user_id,paths_json,mode,selected_path,stop_enabled,stop_threshold,created_at,updated_at) VALUES(?,?,?,?,?,?,?,?,?) "
+            "ON CONFLICT(profile_id) DO UPDATE SET user_id=excluded.user_id, paths_json=excluded.paths_json, mode=excluded.mode, selected_path=excluded.selected_path, stop_enabled=excluded.stop_enabled, stop_threshold=excluded.stop_threshold, updated_at=excluded.updated_at",
+            (profile_id, user_id, clean["disk_monitor_paths_json"], clean["disk_monitor_mode"], clean["disk_monitor_selected_path"], clean["disk_monitor_stop_enabled"], clean["disk_monitor_stop_threshold"], now, now),
         )
+    clean["disk_monitor_owner_user_id"] = int(user_id)
+    with connect() as conn:
+        row = conn.execute("SELECT display_name AS owner_display_name, username AS owner_username, email AS owner_email, id AS user_id FROM users WHERE id=?", (user_id,)).fetchone()
+    clean["disk_monitor_owner_label"] = _disk_monitor_owner_label(row)
     return clean