rohskiddo/UMBRA
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

Fix remaining QA warnings: lazy=raise on CalendarMember + bidirectional connection check

Browse Source 
W-03: invite_member now verifies the target user has a reciprocal
UserConnection row before sending the invite.

W-04: CalendarMember relationships changed from lazy="selectin" to
lazy="raise". All queries that access .user, .calendar, or .inviter
already use explicit selectinload() — verified across all routers
and services.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Kyle 2026-03-06 23:45:10 +08:00
parent dd862bfa48
commit cdbf3175aa
2 changed files with 13 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
backend/app/models/calendar_member.py
View File

@ -46,8 +46,8 @@ class CalendarMember(Base):
) )
accepted_at: Mapped[Optional[datetime]] = mapped_column(DateTime, nullable=True) accepted_at: Mapped[Optional[datetime]] = mapped_column(DateTime, nullable=True)
calendar: Mapped["Calendar"] = relationship(back_populates="members", lazy="selectin") calendar: Mapped["Calendar"] = relationship(back_populates="members", lazy="raise")
user: Mapped["User"] = relationship(foreign_keys=[user_id], lazy="selectin") user: Mapped["User"] = relationship(foreign_keys=[user_id], lazy="raise")
inviter: Mapped[Optional["User"]] = relationship( inviter: Mapped[Optional["User"]] = relationship(
foreign_keys=[invited_by], lazy="selectin" foreign_keys=[invited_by], lazy="raise"
) )

10
backend/app/routers/shared_calendars.py
View File

@ -163,6 +163,16 @@ async def invite_member(
target_user_id = connection.connected_user_id target_user_id = connection.connected_user_id
# W-03: Verify bidirectional connection still active
reverse_conn = await db.execute(
select(UserConnection.id).where(
UserConnection.user_id == target_user_id,
UserConnection.connected_user_id == current_user.id,
)
)
if not reverse_conn.scalar_one_or_none():
raise HTTPException(status_code=400, detail="Connection is no longer active")
if target_user_id == calendar.user_id: if target_user_id == calendar.user_id:
raise HTTPException(status_code=400, detail="Cannot invite the calendar owner") raise HTTPException(status_code=400, detail="Cannot invite the calendar owner")