final touch

lib/api/controllers/links/linkId/updateLinkById.ts

@@ -16,6 +16,10 @@ export default async function updateLinkById(
     };
 
   const collectionIsAccessible = await getPermission({ userId, linkId });
+  const targetCollectionIsAccessible = await getPermission({
+    userId,
+    collectionId: data.collection.id,
+  });
 
   const memberHasAccess = collectionIsAccessible?.members.some(
     (e: UsersAndCollections) => e.userId === userId && e.canUpdate
@@ -25,6 +29,28 @@ export default async function updateLinkById(
     collectionIsAccessible?.ownerId === data.collection.ownerId &&
     data.collection.ownerId === userId;
 
+  const targetCollectionsAccessible =
+    targetCollectionIsAccessible?.ownerId === userId;
+
+  const targetCollectionMatchesData = data.collection.id
+    ? data.collection.id === targetCollectionIsAccessible?.id
+    : true && data.collection.name
+      ? data.collection.name === targetCollectionIsAccessible?.name
+      : true && data.collection.ownerId
+        ? data.collection.ownerId === targetCollectionIsAccessible?.ownerId
+        : true;
+
+  if (!targetCollectionsAccessible)
+    return {
+      response: "Target collection is not accessible.",
+      status: 401,
+    };
+  else if (!targetCollectionMatchesData)
+    return {
+      response: "Target collection does not match the data.",
+      status: 401,
+    };
+
   const unauthorizedSwitchCollection =
     !isCollectionOwner && collectionIsAccessible?.id !== data.collection.id;
 

lib/api/getPermission.ts

@@ -3,12 +3,14 @@ import { prisma } from "@/lib/api/db";
 type Props = {
   userId: number;
   collectionId?: number;
+  collectionName?: string;
   linkId?: number;
 };
 
 export default async function getPermission({
   userId,
   collectionId,
+  collectionName,
   linkId,
 }: Props) {
   if (linkId) {
@@ -24,10 +26,11 @@ export default async function getPermission({
     });
 
     return check;
-  } else if (collectionId) {
+  } else if (collectionId || collectionName) {
     const check = await prisma.collection.findFirst({
       where: {
-        id: collectionId,
+        id: collectionId || undefined,
+        name: collectionName || undefined,
         OR: [{ ownerId: userId }, { members: { some: { userId } } }],
       },
       include: { members: true },