Skip to content

Closes 155 - Fix FolderService to prevent deleting root user directory, and bypassing the trash - #158

Draft
vanxa wants to merge 1 commit into
Vault-Web:mainfrom
vanxa:155/folder-delete-fix
Draft

vanxa wants to merge 1 commit into
Vault-Web:mainfrom
vanxa:155/folder-delete-fix

Conversation

@vanxa

@vanxa vanxa commented Oct 2, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Create a util class, FileUtil, and refactor path validation and resolution (was duplicated across two classes)
  • Change FolderService#deleteFolder to call TrashService#moveToTrash
  • Add a check to prevent FolderService from deleting the entire user root directory
  • Add FileUtil tests

Still a DRAFT. TODO:

  • Add tests to the FolderService deleteFolder()
  • Check if code can reuse TrashService#moveToTrash recursively (merge FolderService#deleteFolder with TrashService#moveToTrash)

Linked issue

Closes #155

@vanxa
vanxa marked this pull request as draft October 2, 2026 13:56
@vanxa
vanxa force-pushed the 155/folder-delete-fix branch 3 times, most recently from 905c971 to 4a06710 Compare October 2, 2026 14:00
  resolution (was duplicated across two classes)
- Change FolderService#deleteFolder to call TrashService#moveToTrash
- Add a check to prevent FolderService from deleting the entire user
  root directory
- Add FileUtil tests
@vanxa
vanxa force-pushed the 155/folder-delete-fix branch from 4a06710 to ceca7e0 Compare October 2, 2026 14:02
@vanxa

vanxa commented Oct 2, 2026

Copy link
Copy Markdown
Contributor Author

It should be noted, currently this produces a circular dependency between the TrashService and the FolderService, so it may not compile. Will review and rework.

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agent review

Two blocking problems in FolderService.deleteFolder: a circular bean dependency with TrashService (app won't start) and a trash call that can't work on directories or per-entry paths. Existing tests also still use the old signature. See inline comments.

Generated by Pull Request Review for #158 · copilot · auto · 21.6 AIC · ⌖ 5.07 AIC · ⊞ 7K

private final JaroWinklerSimilarity jaroWinkler = new JaroWinklerSimilarity();
private final TrashService trashService;

public FolderService(TrashService trashService) {

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Circular dependency: TrashService is @RequiredArgsConstructor with a FolderService folderService field (and calls folderService.validatePath). Injecting TrashService into FolderService via constructor creates a cycle, so the Spring context fails to start (BeanCurrentlyInCreationException). The FolderService used to have no dependencies. Move the validation into FileUtil and have TrashService use it, or otherwise break the cycle.

p -> {
try {
Files.delete(p);
trashService.moveToTrash(rootPathString, ownerId, relativeFolderPath);

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wrong behaviour: this runs inside a per-path Files.walk(folder) loop but always passes relativeFolderPath (the folder, not p). TrashService.moveToTrash throws ResourceNotFoundException unless the source is a regular file, so deleting any folder fails on the first iteration (folder is not a regular file). Even if it worked, a folder with N entries would trigger N calls on the same path. Trash each regular file under its own relative path (rootPath.relativize(p)), then delete the remaining empty directories. The existing deleteFolder_* tests in FolderServiceTest still call the old 2-arg signature (compile error) and nothing covers the new behaviour, the root-folder check, or the trash move.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[audit] Folder delete bypasses Trash, and a blank/"." folderPath wipes the whole root including .trash

1 participant