From 988b94fec8db6098ca02e0a729c3dc1da381952d Mon Sep 17 00:00:00 2001
From: thecodrr <thecodrr@protonmail.com>
Date: Mon, 15 Aug 2022 20:35:16 +0500
Subject: [PATCH] fix: throw on delete if attachment is in a locked note

---
 packages/core/collections/attachments.js | 31 ++++++++++++++++--------
 1 file changed, 21 insertions(+), 10 deletions(-)

diff --git a/packages/core/collections/attachments.js b/packages/core/collections/attachments.js
index 9d469e0b7..88a0802b7 100644
--- a/packages/core/collections/attachments.js
+++ b/packages/core/collections/attachments.js
@@ -135,8 +135,8 @@ export default class Attachments extends Collection {
     return JSON.parse(plainData);
   }
 
-  async delete(hash, noteId) {
-    const attachment = this.all.find((a) => a.metadata.hash === hash);
+  async delete(hashOrId, noteId) {
+    const attachment = this.attachment(hashOrId);
     if (!attachment || !deleteItem(attachment.noteIds, noteId)) return;
     if (!attachment.noteIds.length) {
       attachment.dateDeleted = Date.now();
@@ -145,12 +145,16 @@ export default class Attachments extends Collection {
     return await this._collection.updateItem(attachment);
   }
 
-  async remove(hash, localOnly) {
-    const attachment = this.all.find((a) => a.metadata.hash === hash);
+  async remove(hashOrId, localOnly) {
+    const attachment = this.attachment(hashOrId);
     if (!attachment) return false;
-    if (await this._db.fs.deleteFile(hash, localOnly)) {
+
+    if (!localOnly && !(await this._canDetach(attachment)))
+      throw new Error("This attachment is inside a locked note.");
+
+    if (await this._db.fs.deleteFile(attachment.metadata.hash, localOnly)) {
       if (!localOnly) {
-        await this.detach(hash);
+        await this.detach(attachment);
       }
       await this._collection.removeItem(attachment.id);
       return true;
@@ -158,10 +162,7 @@ export default class Attachments extends Collection {
     return false;
   }
 
-  async detach(hashOrId) {
-    const attachment = this.attachment(hashOrId);
-    if (!attachment) return;
-
+  async detach(attachment) {
     await this._db.notes.init();
     for (let noteId of attachment.noteIds) {
       const note = this._db.notes.note(noteId);
@@ -173,6 +174,16 @@ export default class Attachments extends Collection {
     }
   }
 
+  async _canDetach(attachment) {
+    await this._db.notes.init();
+    for (let noteId of attachment.noteIds) {
+      const note = this._db.notes.note(noteId)._note;
+      if (note.locked) return false;
+    }
+
+    return true;
+  }
+
   /**
    * Get specified type of attachments of a note
    * @param {string} noteId