Verify data file owner when creating/updating corpus

Author: pmachapman

src/Serval/src/Serval.DataFiles/Features/Corpora/CreateCorpus.cs

@@ -30,21 +30,25 @@ public async Task<CreateCorpusResponse> HandleAsync(CreateCorpus request, Cancel
             Owner = request.Owner,
             Name = request.CorpusConfig.Name,
             Language = request.CorpusConfig.Language,
-            Files = await MapFilesAsync(request.CorpusConfig.Files, cancellationToken),
+            Files = await MapFilesAsync(request.Owner, request.CorpusConfig.Files, cancellationToken),
         };
         await corpora.InsertAsync(corpus, cancellationToken);
         return new(mapper.Map(corpus));
     }
 
     private async Task<IReadOnlyList<CorpusFile>> MapFilesAsync(
+        string owner,
         IReadOnlyList<CorpusFileConfigDto> files,
         CancellationToken cancellationToken
     )
     {
         var corpusFiles = new List<CorpusFile>();
         foreach (CorpusFileConfigDto file in files)
         {
-            DataFile? dataFile = await dataFiles.GetAsync(file.FileId, cancellationToken);
+            DataFile? dataFile = await dataFiles.GetAsync(
+                e => e.Id == file.FileId && e.Owner == owner,
+                cancellationToken
+            );
             if (dataFile is null)
                 throw new EntityNotFoundException($"Could not find the DataFile '{file.FileId}'.");
             corpusFiles.Add(new CorpusFile { FileRef = file.FileId, TextId = file.TextId });

src/Serval/src/Serval.DataFiles/Features/Corpora/UpdateCorpus.cs

@@ -17,7 +17,7 @@ public async Task<UpdateCorpusResponse> HandleAsync(UpdateCorpus request, Cancel
     {
         await corpora.CheckOwnerAsync(request.CorpusId, request.Owner, cancellationToken);
 
-        IReadOnlyList<CorpusFile> files = await MapFilesAsync(request.Files, cancellationToken);
+        IReadOnlyList<CorpusFile> files = await MapFilesAsync(request.Owner, request.Files, cancellationToken);
 
         Corpus corpus = await dataAccessContext.WithTransactionAsync(
             async ct =>
@@ -29,7 +29,7 @@ public async Task<UpdateCorpusResponse> HandleAsync(UpdateCorpus request, Cancel
                 );
                 if (updated is null)
                     throw new EntityNotFoundException($"Could not find the Corpus '{request.CorpusId}'.");
-                HashSet<string> corpusFileIds = updated.Files.Select(f => f.FileRef).ToHashSet();
+                HashSet<string> corpusFileIds = [.. updated.Files.Select(f => f.FileRef)];
                 IDictionary<string, DataFile> corpusDataFilesDict = (
                     await dataFiles.GetAllAsync(f => corpusFileIds.Contains(f.Id), ct)
                 ).ToDictionary(f => f.Id);
@@ -54,14 +54,18 @@ await eventRouter.PublishAsync(
     }
 
     private async Task<IReadOnlyList<CorpusFile>> MapFilesAsync(
+        string owner,
         IReadOnlyList<CorpusFileConfigDto> files,
         CancellationToken cancellationToken
     )
     {
         var corpusFiles = new List<CorpusFile>();
         foreach (CorpusFileConfigDto file in files)
         {
-            DataFile? dataFile = await dataFiles.GetAsync(file.FileId, cancellationToken);
+            DataFile? dataFile = await dataFiles.GetAsync(
+                e => e.Id == file.FileId && e.Owner == owner,
+                cancellationToken
+            );
             if (dataFile is null)
                 throw new EntityNotFoundException($"Could not find the DataFile '{file.FileId}'.");
             corpusFiles.Add(new CorpusFile { FileRef = file.FileId, TextId = file.TextId });