Enforce brewery ownership on update and delete (#267)

web/backend/Features/Features.Breweries/Commands/CreateBrewery/CreateBreweryCommand.cs

@@ -23,3 +23,10 @@ public record CreateBreweryCommand(
     string Description,
     CreateBreweryLocation Location
 ) : IRequest<BreweryDto>;
+
+/// <summary>Request body for <c>POST /api/brewery</c>. <c>PostedById</c> comes from the caller's JWT.</summary>
+public record CreateBreweryRequest(
+    string BreweryName,
+    string Description,
+    CreateBreweryLocation Location
+);

web/backend/Features/Features.Breweries/Commands/CreateBrewery/CreateBreweryHandler.cs

@@ -37,6 +37,17 @@ public class CreateBreweryHandler(IBreweryRepository repository)
         };
 
         await repository.CreateAsync(entity);
-        return entity.ToDto();
+
+        // RowVersion is a DB-computed column, unset on the in-memory entity; re-fetch so callers
+        // get back the value needed for a subsequent optimistic-concurrency update. Uses
+        // CancellationToken.None since the write already committed: cancelling the caller's request
+        // at this point must not turn a successful creation into a thrown exception.
+        BreweryPost created =
+            await repository.GetByIdAsync(entity.BreweryPostId, CancellationToken.None)
+            ?? throw new InvalidOperationException(
+                $"Brewery '{entity.BreweryPostId}' was not found after a successful creation."
+            );
+
+        return created.ToDto();
     }
 }

web/backend/Features/Features.Breweries/Commands/DeleteBrewery/DeleteBreweryCommand.cs

@@ -2,5 +2,5 @@ using MediatR;
 
 namespace Features.Breweries.Commands.DeleteBrewery;
 
-/// <summary>Deletes a brewery post. Bound directly from the route of <c>DELETE /api/brewery/{id}</c>.</summary>
-public record DeleteBreweryCommand(Guid BreweryPostId) : IRequest;
+/// <summary>Deletes a brewery post. <see cref="BreweryPostId" /> is bound from the route of <c>DELETE /api/brewery/{id}</c>.</summary>
+public record DeleteBreweryCommand(Guid BreweryPostId, Guid RequestingUserId) : IRequest;

web/backend/Features/Features.Breweries/Commands/DeleteBrewery/DeleteBreweryHandler.cs

@@ -10,8 +10,17 @@ public class DeleteBreweryHandler(IBreweryRepository repository)
     /// <exception cref="Domain.Exceptions.NotFoundException">
     ///     Thrown when no brewery exists with <paramref name="request" />'s <c>BreweryPostId</c>.
     /// </exception>
-    public Task Handle(DeleteBreweryCommand request, CancellationToken cancellationToken)
+    /// <exception cref="Domain.Exceptions.ForbiddenException">
+    ///     Thrown when <paramref name="request" />'s <c>RequestingUserId</c> did not post the brewery.
+    /// </exception>
+    public async Task Handle(DeleteBreweryCommand request, CancellationToken cancellationToken)
     {
-        return repository.DeleteAsync(request.BreweryPostId);
+        await repository.EnsureCallerOwnsBreweryAsync(
+            request.BreweryPostId,
+            request.RequestingUserId,
+            cancellationToken
+        );
+
+        await repository.DeleteAsync(request.BreweryPostId);
     }
 }

web/backend/Features/Features.Breweries/Commands/UpdateBrewery/UpdateBreweryCommand.cs

@@ -19,16 +19,25 @@ public record UpdateBreweryLocation(
 );
 
 /// <summary>
-///     Updates an existing brewery post. Bound directly from the request body of <c>PUT /api/brewery/{id}</c>.
-///     A <c>null</c> <see cref="Location" /> clears the brewery's location. <see cref="RowVersion" /> must be the
-///     row-version last read for this brewery (e.g. from a prior <c>GET</c>); the update is rejected with a
-///     <c>409 Conflict</c> if the brewery was modified since then.
+///     Updates an existing brewery post. A <c>null</c> <see cref="Location" /> clears the brewery's location.
+///     <see cref="RowVersion" /> must be the row-version last read for this brewery (e.g. from a prior
+///     <c>GET</c>); the update is rejected with a <c>409 Conflict</c> if the brewery was modified since then.
 /// </summary>
 public record UpdateBreweryCommand(
     Guid BreweryPostId,
+    Guid RequestingUserId,
     byte[] RowVersion,
-    Guid PostedById,
     string BreweryName,
     string Description,
     UpdateBreweryLocation? Location
 ) : IRequest<BreweryDto>;
+
+/// <summary>Request body for <c>PUT /api/brewery/{id}</c>.</summary>
+public record UpdateBreweryRequest(
+    Guid BreweryPostId,
+    byte[] RowVersion,
+    string BreweryName,
+    string Description,
+    UpdateBreweryLocation? Location
+);
+

web/backend/Features/Features.Breweries/Commands/UpdateBrewery/UpdateBreweryHandler.cs

@@ -26,13 +26,18 @@ public class UpdateBreweryHandler(IBreweryRepository repository)
         CancellationToken cancellationToken
     )
     {
+        await repository.EnsureCallerOwnsBreweryAsync(
+            request.BreweryPostId,
+            request.RequestingUserId,
+            cancellationToken
+        );
+
         BreweryPost entity = new()
         {
             BreweryPostId = request.BreweryPostId,
-            PostedById = request.PostedById,
+            RowVersion = request.RowVersion,
             BreweryName = request.BreweryName,
             Description = request.Description,
-            RowVersion = request.RowVersion,
             UpdatedAt = DateTime.UtcNow,
             Location = request.Location is null
                 ? null
@@ -48,7 +53,7 @@ public class UpdateBreweryHandler(IBreweryRepository repository)
                 },
         };
 
-        BreweryPost updated = await repository.UpdateAsync(entity);
+        BreweryPost updated = await repository.UpdateAsync(entity, cancellationToken);
         return updated.ToDto();
     }
 }