security upgrade

src/db/editor_preferences.rs

@@ -102,7 +102,7 @@ pub async fn load_editor_preferences(
 
 pub async fn save_editor_configuration(
     pool: &Database,
-    user_id: i64,
+    user_id: Option<i64>,
     resource: EditorPreferenceResource,
     preferences: Option<&EditorPreferences>,
     resource_settings: Option<(&str, &str, &ResourceEditorSettings)>,
@@ -110,6 +110,9 @@ pub async fn save_editor_configuration(
     let mut tx = pool.pool().begin().await?;
 
     if let Some(preferences) = preferences {
+        let user_id = user_id.ok_or_else(|| {
+            sqlx::Error::Protocol("user id is required for personal editor preferences".into())
+        })?;
         sqlx::query(queries::get(
             pool.kind(),
             preference_upsert_query(resource),

src/db/mod.rs

@@ -68,6 +68,8 @@ pub struct Note {
     pub owner_map: String,
     pub protected: bool,
     pub created_by: Option<String>,
+    #[serde(skip_serializing)]
+    pub created_by_guest_id: Option<String>,
 }
 
 #[derive(Debug, Clone, FromRow)]
@@ -82,6 +84,7 @@ struct SqliteNote {
     owner_map: String,
     protected: i64,
     created_by: Option<String>,
+    created_by_guest_id: Option<String>,
 }
 
 impl From<SqliteNote> for Note {
@@ -97,6 +100,7 @@ impl From<SqliteNote> for Note {
             owner_map: value.owner_map,
             protected: value.protected != 0,
             created_by: value.created_by,
+            created_by_guest_id: value.created_by_guest_id,
         }
     }
 }
@@ -260,6 +264,7 @@ pub async fn create_note(
     title: &str,
     protected: bool,
     created_by: Option<&str>,
+    created_by_guest_id: Option<&str>,
 ) -> Result<Note, sqlx::Error> {
     sqlx::query(queries::get(pool.kind(), queries::Q005))
         .bind(workspace_id)
@@ -267,6 +272,7 @@ pub async fn create_note(
         .bind(title)
         .bind(protected)
         .bind(created_by)
+        .bind(created_by_guest_id)
         .execute(pool.pool())
         .await?;
 
@@ -388,6 +394,7 @@ pub struct Pad {
     pub updated_at: String,
     pub owner_map: String,
     pub is_private: i64,
+    pub created_by_guest_id: Option<String>,
 }
 
 pub async fn find_pad(pool: &Database, slug: &str) -> Result<Option<Pad>, sqlx::Error> {
@@ -402,6 +409,7 @@ pub async fn create_pad(
     slug: &str,
     title: &str,
     password: Option<&str>,
+    created_by_guest_id: Option<&str>,
 ) -> Result<Pad, sqlx::Error> {
     let password_hash = password
         .filter(|value| !value.is_empty())
@@ -410,6 +418,7 @@ pub async fn create_pad(
         .bind(slug)
         .bind(title)
         .bind(password_hash)
+        .bind(created_by_guest_id)
         .execute(pool.pool())
         .await?;
 
@@ -504,6 +513,7 @@ impl<'r> sqlx::FromRow<'r, AnyRow> for Note {
             owner_map: crate::row_decode::text(row, "owner_map")?,
             protected: protected != 0,
             created_by: crate::row_decode::optional_text(row, "created_by")?,
+            created_by_guest_id: crate::row_decode::optional_text(row, "created_by_guest_id")?,
         })
     }
 }
@@ -530,6 +540,7 @@ impl<'r> sqlx::FromRow<'r, AnyRow> for Pad {
             updated_at: crate::row_decode::text(row, "updated_at")?,
             owner_map: crate::row_decode::text(row, "owner_map")?,
             is_private: row.try_get("is_private")?,
+            created_by_guest_id: crate::row_decode::optional_text(row, "created_by_guest_id")?,
         })
     }
 }