@@ -1317,6 +1317,7 @@ def add_to_library(validated_data):
13171317
13181318 try :
13191319
1320+ current_user_id = get_jwt_identity ()
13201321 if str (validated_data .user_id ) != str (current_user_id ):
13211322 return unauthorized_access_error ("Cannot access another user's library" )
13221323
@@ -1494,6 +1495,7 @@ def update_library_item(item_id, validated_data):
14941495 if not item :
14951496 return not_found_error ("Library item" )
14961497
1498+ current_user_id = get_jwt_identity ()
14971499 if str (item .user_id ) != str (current_user_id ):
14981500 return forbidden_error ("Cannot modify another user's library item" )
14991501
@@ -1540,6 +1542,7 @@ def remove_from_library(item_id):
15401542 if not item :
15411543 return not_found_error ("Library item" )
15421544
1545+ current_user_id = get_jwt_identity ()
15431546 if str (item .user_id ) != str (current_user_id ):
15441547 return forbidden_error ("Cannot delete another user's library item" )
15451548
@@ -2092,6 +2095,7 @@ def verify_auth_session():
20922095def set_reading_goal (validated_data ):
20932096 """Set or update annual reading goal."""
20942097
2098+ current_user_id = get_jwt_identity ()
20952099 if str (validated_data .user_id ) != str (current_user_id ):
20962100 return forbidden_error ("Unauthorized" )
20972101
@@ -2210,6 +2214,7 @@ def get_leaderboard():
22102214def create_collection (validated_data ):
22112215 """Create a new collection."""
22122216
2217+ current_user_id = get_jwt_identity ()
22132218 if str (validated_data .user_id ) != str (current_user_id ):
22142219 return forbidden_error ("Unauthorized" )
22152220
@@ -2283,6 +2288,7 @@ def update_collection(collection_id, validated_data):
22832288 if not collection :
22842289 return jsonify ({"error" : "Collection not found" }), 404
22852290
2291+ current_user_id = get_jwt_identity ()
22862292 if str (collection .user_id ) != str (current_user_id ):
22872293 return forbidden_error ("Unauthorized" )
22882294
@@ -2320,6 +2326,7 @@ def delete_collection(collection_id):
23202326 if not collection :
23212327 return jsonify ({"error" : "Collection not found" }), 404
23222328
2329+ current_user_id = get_jwt_identity ()
23232330 if str (collection .user_id ) != str (current_user_id ):
23242331 return forbidden_error ("Unauthorized" )
23252332
@@ -2332,14 +2339,16 @@ def delete_collection(collection_id):
23322339
23332340@app .route ('/api/v1/collections/<int:collection_id>/books' , methods = ['POST' ])
23342341@jwt_required ()
2335- def add_book_to_collection (collection_id ):
2342+ @validate_schema (AddToCollectionRequest )
2343+ def add_book_to_collection (collection_id , validated_data ):
23362344 """Add a book to a collection."""
23372345
23382346 try :
23392347 collection = Collection .query .get (collection_id )
23402348 if not collection :
23412349 return jsonify ({"error" : "Collection not found" }), 404
23422350
2351+ current_user_id = get_jwt_identity ()
23432352 if str (collection .user_id ) != str (current_user_id ):
23442353 return forbidden_error ("Unauthorized" )
23452354
@@ -2399,6 +2408,7 @@ def remove_book_from_collection(collection_id, book_id):
23992408 if not collection :
24002409 return jsonify ({"error" : "Collection not found" }), 404
24012410
2411+ current_user_id = get_jwt_identity ()
24022412 if str (collection .user_id ) != str (current_user_id ):
24032413 return forbidden_error ("Unauthorized" )
24042414
@@ -2575,6 +2585,7 @@ def create_price_alert(book_id):
25752585 if not is_valid :
25762586 return jsonify (validated_data ), 400
25772587
2588+ current_user_id = get_jwt_identity ()
25782589 if str (validated_data .user_id ) != str (current_user_id ):
25792590 return forbidden_error ("Unauthorized access to another user's alerts" )
25802591
@@ -2738,4 +2749,4 @@ def delete_price_alert(alert_id):
27382749 logger .info (" POST /api/v1/chat - Chat with bookseller (DEPRECATED - Use WebSockets)" )
27392750 logger .info (" GET /api/v1/health - Health check" )
27402751
2741- socketio .run (app , debug = server_config .debug , port = server_config .port , host = server_config .host )
2752+ socketio .run (app , debug = app_config .debug , port = app_config .port , host = app_config .host )
0 commit comments