···2323 // Check publication and document ownership in one query
2424 let { data: tokenData } = await supabaseServerClient
2525 .from("permission_tokens")
2626- .select(`
2626+ .select(
2727+ `
2728 id,
2829 leaflets_in_publications(publication, publications!inner(identity_did)),
2930 leaflets_to_documents(document, documents!inner(uri))
3030- `)
3131+ `,
3232+ )
3133 .eq("id", permission_token.id)
3234 .single();
3335···3638 const leafletInPubs = tokenData.leaflets_in_publications || [];
3739 if (leafletInPubs.length > 0) {
3840 if (!identity) {
3939- throw new Error("Unauthorized: You must be logged in to delete a leaflet in a publication");
4141+ throw new Error(
4242+ "Unauthorized: You must be logged in to delete a leaflet in a publication",
4343+ );
4044 }
4145 const isOwner = leafletInPubs.some(
4242- (pub: any) => pub.publications.identity_did === identity.atp_did
4646+ (pub: any) => pub.publications.identity_did === identity.atp_did,
4347 );
4448 if (!isOwner) {
4545- throw new Error("Unauthorized: You must own the publication to delete this leaflet");
4949+ throw new Error(
5050+ "Unauthorized: You must own the publication to delete this leaflet",
5151+ );
4652 }
4753 }
48544955 // Check if there's a standalone published document
5050- const leafletDocs = tokenData.leaflets_to_documents || [];
5151- if (leafletDocs.length > 0) {
5252- if (!identity) {
5353- throw new Error("Unauthorized: You must be logged in to delete a published leaflet");
5656+ const leafletDoc = tokenData.leaflets_to_documents;
5757+ if (leafletDoc && leafletDoc.document) {
5858+ if (!identity || !identity.atp_did) {
5959+ throw new Error(
6060+ "Unauthorized: You must be logged in to delete a published leaflet",
6161+ );
5462 }
5555- for (let leafletDoc of leafletDocs) {
5656- const docUri = leafletDoc.documents?.uri;
5757- // Extract the DID from the document URI (format: at://did:plc:xxx/...)
5858- if (docUri && !docUri.includes(identity.atp_did)) {
5959- throw new Error("Unauthorized: You must own the published document to delete this leaflet");
6060- }
6363+ const docUri = leafletDoc.documents?.uri;
6464+ // Extract the DID from the document URI (format: at://did:plc:xxx/...)
6565+ if (docUri && !docUri.includes(identity.atp_did)) {
6666+ throw new Error(
6767+ "Unauthorized: You must own the published document to delete this leaflet",
6868+ );
6169 }
6270 }
6371 }
···7381 .where(eq(permission_tokens.id, permission_token.id));
74827583 if (!token?.permission_token_rights?.write) return;
7676- await tx
7777- .delete(entities)
7878- .where(eq(entities.set, token.permission_token_rights.entity_set));
8484+ const entitySet = token.permission_token_rights.entity_set;
8585+ if (!entitySet) return;
8686+ await tx.delete(entities).where(eq(entities.set, entitySet));
7987 await tx
8088 .delete(permission_tokens)
8189 .where(eq(permission_tokens.id, permission_token.id));
+8-4
components/PageSWRDataProvider.tsx
···9090 const publishedInPublication = data.leaflets_in_publications?.find(
9191 (l) => l.doc,
9292 );
9393- const publishedStandalone = data.leaflets_to_documents?.find(
9494- (l) => !!l.documents,
9595- );
9393+ const publishedStandalone =
9494+ data.leaflets_to_documents && data.leaflets_to_documents.documents
9595+ ? data.leaflets_to_documents
9696+ : null;
96979798 const documentUri =
9899 publishedInPublication?.documents?.uri ?? publishedStandalone?.document;
99100100101 // Compute the full post URL for sharing
101102 let postShareLink: string | undefined;
102102- if (publishedInPublication?.publications && publishedInPublication.documents) {
103103+ if (
104104+ publishedInPublication?.publications &&
105105+ publishedInPublication.documents
106106+ ) {
103107 // Published in a publication - use publication URL + document rkey
104108 const docUri = new AtUri(publishedInPublication.documents.uri);
105109 postShareLink = `${getPublicationURL(publishedInPublication.publications)}/${docUri.rkey}`;