diff --git a/backend/app/models/calendar_member.py b/backend/app/models/calendar_member.py index 56f647f..2f7ad26 100644 --- a/backend/app/models/calendar_member.py +++ b/backend/app/models/calendar_member.py @@ -46,8 +46,8 @@ class CalendarMember(Base): ) accepted_at: Mapped[Optional[datetime]] = mapped_column(DateTime, nullable=True) - calendar: Mapped["Calendar"] = relationship(back_populates="members", lazy="selectin") - user: Mapped["User"] = relationship(foreign_keys=[user_id], lazy="selectin") + calendar: Mapped["Calendar"] = relationship(back_populates="members", lazy="raise") + user: Mapped["User"] = relationship(foreign_keys=[user_id], lazy="raise") inviter: Mapped[Optional["User"]] = relationship( - foreign_keys=[invited_by], lazy="selectin" + foreign_keys=[invited_by], lazy="raise" ) diff --git a/backend/app/routers/shared_calendars.py b/backend/app/routers/shared_calendars.py index f84edb7..b9ed123 100644 --- a/backend/app/routers/shared_calendars.py +++ b/backend/app/routers/shared_calendars.py @@ -163,6 +163,16 @@ async def invite_member( target_user_id = connection.connected_user_id + # W-03: Verify bidirectional connection still active + reverse_conn = await db.execute( + select(UserConnection.id).where( + UserConnection.user_id == target_user_id, + UserConnection.connected_user_id == current_user.id, + ) + ) + if not reverse_conn.scalar_one_or_none(): + raise HTTPException(status_code=400, detail="Connection is no longer active") + if target_user_id == calendar.user_id: raise HTTPException(status_code=400, detail="Cannot invite the calendar owner")