Fix: Remove files from collections owned by others while hiding selec…

…ted files (#1746)

lib/services/collections_service.dart

@@ -1372,10 +1372,10 @@ class CollectionsService {
   }
 
   Future<void> move(
-    int toCollectionID,
-    int fromCollectionID,
-    List<EnteFile> files,
-  ) async {
+    List<EnteFile> files, {
+    required int toCollectionID,
+    required int fromCollectionID,
+  }) async {
     _validateMoveRequest(toCollectionID, fromCollectionID, files);
     files.removeWhere((element) => element.uploadedFileID == null);
     if (files.isEmpty) {
@@ -1443,9 +1443,19 @@ class CollectionsService {
     int fromCollectionID,
     List<EnteFile> files,
   ) {
+    final int userID = Configuration.instance.getUserID()!;
     if (toCollectionID == fromCollectionID) {
       throw AssertionError("Can't move to same album");
     }
+    final Collection? toCollection = _collectionIDToCollections[toCollectionID];
+    final Collection? fromCollection =
+        _collectionIDToCollections[fromCollectionID];
+    if (toCollection != null && !toCollection.isOwner(userID)) {
+      throw AssertionError("Can't move to a collection you don't own");
+    }
+    if (fromCollection != null && !fromCollection.isOwner(userID)) {
+      throw AssertionError("Can't move from a collection you don't own");
+    }
     for (final file in files) {
       if (file.uploadedFileID == null) {
         throw AssertionError("Can only move uploaded memories");

lib/services/hidden_service.dart

@@ -57,21 +57,25 @@ extension HiddenService on CollectionsService {
   Future<Collection> clubAllDefaultHiddenToOne(
     List<Collection> allDefaultHidden,
   ) async {
-    final Collection result = allDefaultHidden.first;
-
-    for (Collection defaultHidden in allDefaultHidden) {
+    // select first collection as default hidden where all files will be clubbed
+    final Collection defaultHidden = allDefaultHidden.first;
+    for (Collection hidden in allDefaultHidden) {
       try {
-        if (defaultHidden.id == result.id) {
+        if (hidden.id == defaultHidden.id) {
           continue;
         }
         final filesInCollection = (await FilesDB.instance.getFilesInCollection(
-          defaultHidden.id,
+          hidden.id,
           galleryLoadStartTime,
           galleryLoadEndTime,
         ))
             .files;
-        await move(result.id, defaultHidden.id, filesInCollection);
-        await CollectionsService.instance.trashEmptyCollection(defaultHidden);
+        await move(
+          filesInCollection,
+          toCollectionID: defaultHidden.id,
+          fromCollectionID: hidden.id,
+        );
+        await CollectionsService.instance.trashEmptyCollection(hidden);
       } catch (e, s) {
         _logger.severe(
           "One iteration of clubbing all default hidden failed",
@@ -82,7 +86,7 @@ extension HiddenService on CollectionsService {
       }
     }
 
-    return result;
+    return defaultHidden;
   }
 
   // getUncategorizedCollection will return the uncategorized collection
@@ -137,7 +141,18 @@ extension HiddenService on CollectionsService {
           _logger.finest('file already part of hidden collection');
           continue;
         }
-        await move(defaultHiddenCollection.id, entry.key, entry.value);
+        final Collection? c = getCollectionByID(entry.key);
+        // if the collection is not owned by the user, remove the file from the
+        // collection
+        if (c != null && !c.isOwner(userID)) {
+          await removeFromCollection(entry.key, entry.value);
+        } else {
+          await move(
+            entry.value,
+            toCollectionID: defaultHiddenCollection.id,
+            fromCollectionID: entry.key,
+          );
+        }
       }
       Bus.instance.fire(
         LocalPhotosUpdatedEvent(

lib/ui/actions/collection/collection_sharing_actions.dart

@@ -558,9 +558,9 @@ class CollectionActions {
         );
       } else {
         await collectionsService.move(
-          entry.key,
-          collection.id,
           entry.value,
+          toCollectionID: entry.key,
+          fromCollectionID: collection.id,
         );
       }
     }

lib/ui/collections/album/vertical_list.dart

@@ -398,9 +398,9 @@ class AlbumVerticalListWidget extends StatelessWidget {
     try {
       final int fromCollectionID = selectedFiles!.files.first.collectionID!;
       await CollectionsService.instance.move(
-        toCollectionID,
-        fromCollectionID,
         selectedFiles!.files.toList(),
+        toCollectionID: toCollectionID,
+        fromCollectionID: fromCollectionID,
       );
       await dialog.hide();
       unawaited(RemoteSyncService.instance.sync(silently: true));