From 8fd86f9ec12e41b238c2c93e8666cd477aaf1373 Mon Sep 17 00:00:00 2001
From: eikek <eike.kettner@posteo.de>
Date: Mon, 25 Oct 2021 21:27:23 +0200
Subject: [PATCH] Don't allow shares with fulltext queries

Currently the query implementation cannot combine multiple/nested
fulltext searches within a query. It doesn't seem useful to have
shares based on fulltext searches, so it is disabled for now.

Issue: #446
---
 .../main/scala/docspell/backend/ops/OShare.scala   | 14 ++++++++++++--
 .../docspell/restserver/routes/ShareRoutes.scala   | 11 +++++++++++
 website/site/content/docs/webapp/share.md          |  5 +++++
 3 files changed, 28 insertions(+), 2 deletions(-)

diff --git a/modules/backend/src/main/scala/docspell/backend/ops/OShare.scala b/modules/backend/src/main/scala/docspell/backend/ops/OShare.scala
index ba27ea70..cd0bac69 100644
--- a/modules/backend/src/main/scala/docspell/backend/ops/OShare.scala
+++ b/modules/backend/src/main/scala/docspell/backend/ops/OShare.scala
@@ -16,9 +16,9 @@ import docspell.backend.ops.OItemSearch._
 import docspell.backend.ops.OShare._
 import docspell.backend.ops.OSimpleSearch.StringSearchResult
 import docspell.common._
-import docspell.query.ItemQuery
 import docspell.query.ItemQuery.Expr
 import docspell.query.ItemQuery.Expr.AttachId
+import docspell.query.{FulltextExtract, ItemQuery}
 import docspell.store.Store
 import docspell.store.queries.SearchSummary
 import docspell.store.records._
@@ -133,10 +133,12 @@ object OShare {
     final case class Success(id: Ident) extends ChangeResult
     case object PublishUntilInPast extends ChangeResult
     case object NotFound extends ChangeResult
+    case object QueryWithFulltext extends ChangeResult
 
     def success(id: Ident): ChangeResult = Success(id)
     def publishUntilInPast: ChangeResult = PublishUntilInPast
     def notFound: ChangeResult = NotFound
+    def queryWithFulltext: ChangeResult = QueryWithFulltext
   }
 
   final case class ShareData(share: RShare, user: RUser)
@@ -182,12 +184,13 @@ object OShare {
           )
           res <-
             if (share.publishUntil < curTime) ChangeResult.publishUntilInPast.pure[F]
+            else if (hasFulltext(share.query)) ChangeResult.queryWithFulltext.pure[F]
             else store.transact(RShare.insert(record)).map(_ => ChangeResult.success(id))
         } yield res
 
       def update(
           id: Ident,
-          share: OShare.NewShare,
+          share: NewShare,
           removePassword: Boolean
       ): F[ChangeResult] =
         for {
@@ -207,12 +210,19 @@ object OShare {
           )
           res <-
             if (share.publishUntil < curTime) ChangeResult.publishUntilInPast.pure[F]
+            else if (hasFulltext(share.query)) ChangeResult.queryWithFulltext.pure[F]
             else
               store
                 .transact(RShare.updateData(record, removePassword))
                 .map(n => if (n > 0) ChangeResult.success(id) else ChangeResult.notFound)
         } yield res
 
+      private def hasFulltext(iq: ItemQuery): Boolean =
+        iq.findFulltext match {
+          case FulltextExtract.Result.SuccessNoFulltext(_) => false
+          case _                                           => true
+        }
+
       def findOne(id: Ident, collective: Ident): OptionT[F, ShareData] =
         RShare
           .findOne(id, collective)
diff --git a/modules/restserver/src/main/scala/docspell/restserver/routes/ShareRoutes.scala b/modules/restserver/src/main/scala/docspell/restserver/routes/ShareRoutes.scala
index 4106642f..2b16263b 100644
--- a/modules/restserver/src/main/scala/docspell/restserver/routes/ShareRoutes.scala
+++ b/modules/restserver/src/main/scala/docspell/restserver/routes/ShareRoutes.scala
@@ -130,6 +130,12 @@ object ShareRoutes {
           "Share not found or not owner. Only the owner can update a share.",
           Ident.unsafe("")
         )
+      case OShare.ChangeResult.QueryWithFulltext =>
+        IdResult(
+          false,
+          "Sorry, shares with fulltext queries are currently not supported.",
+          Ident.unsafe("")
+        )
     }
 
   def mkBasicResult(r: OShare.ChangeResult, msg: => String): BasicResult =
@@ -142,6 +148,11 @@ object ShareRoutes {
           false,
           "Share not found or not owner. Only the owner can update a share."
         )
+      case OShare.ChangeResult.QueryWithFulltext =>
+        BasicResult(
+          false,
+          "Sorry, shares with fulltext queries are currently not supported."
+        )
     }
 
   def mkShareDetail(now: Timestamp)(r: OShare.ShareData): ShareDetail =
diff --git a/website/site/content/docs/webapp/share.md b/website/site/content/docs/webapp/share.md
index 861f5fa4..1cd25577 100644
--- a/website/site/content/docs/webapp/share.md
+++ b/website/site/content/docs/webapp/share.md
@@ -61,6 +61,11 @@ needs access to it, for example if you want to share all your tax
 documents with the company/person who helps you with doing you tax
 submission.
 
+## Limitations
+
+Currently, shares that contain fulltext search queries are not
+supported. The query for a share must not use any fulltext search.
+
 # Creating shares
 
 There are the following ways to create a share: