fixes

internal/api/merch/controller.go

@@ -731,7 +731,7 @@ func (co *controller) deleteZeroPrices(c *gin.Context) {
 		return
 	}
 
-	var payload DeleteZeroPrices
+	var payload []DeleteZeroPrices
 	if err = c.ShouldBindJSON(&payload); err != nil {
 		c.JSON(http.StatusBadRequest, responses.ErrorResponse400{Error: err.Error()})
 		log.WithError(err).Error(logMsg)

internal/api/merch/dto.go

@@ -82,6 +82,7 @@ type LabelLink struct {
 }
 
 type ZeroPrice struct {
+	Id        int       `json:"id"`
 	CreatedAt time.Time `json:"created_at"`
 	MerchUuid string    `json:"merch_uuid"`
 	Name      string    `json:"name"`
@@ -89,5 +90,6 @@ type ZeroPrice struct {
 }
 
 type DeleteZeroPrices struct {
-	MerchUuids []string `json:"merch_uuids"`
+	Id        uint   `json:"id"`
+	MerchUuid string `json:"merch_uuid"`
 }

internal/api/merch/repository.go

@@ -3,6 +3,7 @@ package merch
 import (
 	"database/sql"
 	"errors"
+	"fmt"
 	"gorm.io/gorm"
 	"gorm.io/gorm/clause"
 	"time"
@@ -22,6 +23,7 @@ type repository interface {
 	addMerch(bundle merchBundle) error
 
 	merchRecordExists(userUuid, merchUuid string) (bool, error)
+	userOwnsMerchUuids(userUuid string, merchUuids []string) (bool, error)
 	getSingleMerch(userUuid, merchUuid string) (merchBundle, error)
 	getAllMerch(userUuid string) ([]ListResponse, error)
 
@@ -40,7 +42,7 @@ type prices interface {
 	getDistinctPrices(userUuid, merchUuid string, period time.Time) (prices []Price, err error)
 
 	getZeroPrices(userUuid string) ([]ZeroPrice, error)
-	deleteZeroPrices(userUuid string, list []string) error
+	deleteZeroPrices(list []DeleteZeroPrices) error
 }
 
 type labels interface {
@@ -84,6 +86,22 @@ func (r *Repo) merchRecordExists(userUuid, merchUuid string) (bool, error) {
 	return exists, err
 }
 
+func (r *Repo) userOwnsMerchUuids(userUuid string, merchUuids []string) (bool, error) {
+	var count int64
+
+	err := r.db.Model(&Merch{}).
+		Where("user_uuid = ?", userUuid).
+		Where("merch_uuid IN ?", merchUuids).
+		Where("deleted_at IS NULL").
+		Count(&count).Error
+	fmt.Println("!!!!!!", count)
+	if err != nil {
+		return false, err
+	}
+	fmt.Println("!!!!!!", len(merchUuids))
+	return count == int64(len(merchUuids)), nil
+}
+
 func (r *Repo) getSingleMerch(userUuid, merchUuid string) (merchBundle, error) {
 	var merch Merch
 	if err := r.db.
@@ -320,16 +338,17 @@ func (r *Repo) getZeroPrices(userUuid string) ([]ZeroPrice, error) {
 	if err := r.db.Raw(`
         WITH price_with_neighbors AS (
             SELECT
-				p.created_at, p.merch_uuid, p.price, p.origin, m.name,
+				p.id, p.created_at, p.merch_uuid, p.price, p.origin, m.name,
 				LAG(price) OVER (PARTITION BY p.merch_uuid ORDER BY p.created_at, p.id) AS prev_price,
 				LEAD(price) OVER (PARTITION BY p.merch_uuid ORDER BY p.created_at, p.id) AS next_price
 			FROM prices AS p
 			JOIN merch as m ON m.merch_uuid = p.merch_uuid
 			WHERE p.deleted_at IS NULL
+            AND m.deleted_at IS NULL
 			AND m.user_uuid = ?)
 
 		SELECT
-			created_at, merch_uuid, origin, name
+			id, created_at, merch_uuid, origin, name
 		FROM price_with_neighbors
 		WHERE
 			price = 0
@@ -343,14 +362,13 @@ func (r *Repo) getZeroPrices(userUuid string) ([]ZeroPrice, error) {
 	return priceList, nil
 }
 
-func (r *Repo) deleteZeroPrices(userUuid string, list []string) error {
-	subQuery := r.db.Table("merch").
-		Select("merch_uuid").
-		Where("user_uuid = ?", userUuid)
-
-	return r.db.Model(&Price{}).
-		Where("merch_uuid IN ?", list).
-		Where("merch_uuid IN (?)", subQuery).
-		Update("deleted_at", time.Now().UTC()).
-		Error
+func (r *Repo) deleteZeroPrices(list []DeleteZeroPrices) error {
+	for _, item := range list {
+		if err := r.db.Model(&Price{}).
+			Where("id = ? AND merch_uuid = ?", item.Id, item.MerchUuid).
+			Update("deleted_at", time.Now().UTC()).Error; err != nil {
+			return err
+		}
+	}
+	return nil
 }

internal/api/merch/service.go

@@ -16,6 +16,7 @@ import (
 	is "merch-parser-api/proto/imageStorage"
 	"mime/multipart"
 	"path/filepath"
+	"slices"
 	"strings"
 	"time"
 )
@@ -617,6 +618,26 @@ func (s *service) getZeroPrices(userUuid string) ([]ZeroPrice, error) {
 	return s.repo.getZeroPrices(userUuid)
 }
 
-func (s *service) deleteZeroPrices(userUuid string, list DeleteZeroPrices) error {
-	return s.repo.deleteZeroPrices(userUuid, list.MerchUuids)
+func (s *service) deleteZeroPrices(userUuid string, list []DeleteZeroPrices) error {
+	if len(list) == 0 {
+		return nil
+	}
+
+	ids := make([]string, 0, len(list))
+	for _, item := range list {
+		ids = append(ids, item.MerchUuid)
+		fmt.Println(item.MerchUuid, ids)
+	}
+	slices.Compact(ids)
+
+	owns, err := s.repo.userOwnsMerchUuids(userUuid, ids)
+	if err != nil {
+		return err
+	}
+
+	if !owns {
+		return errors.New("wrong ids")
+	}
+
+	return s.repo.deleteZeroPrices(list)
 }