From 07ead08d7314e2b9061ec45a8a815ed357b46756 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thorben=20G=C3=BCnther?= <admin@xenrox.net>
Date: Sun, 7 Nov 2021 01:11:47 +0100
Subject: [PATCH] mutation: Further improve queueing logic

A queue can only get cancelled if the user actually was in it.
---
 graph/schema.resolvers.go | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/graph/schema.resolvers.go b/graph/schema.resolvers.go
index 1cac9e4..5c85ae2 100644
--- a/graph/schema.resolvers.go
+++ b/graph/schema.resolvers.go
@@ -141,12 +141,21 @@ func (r *mutationResolver) CancelQueue(ctx context.Context, id int) (int, error)
 	query := `
 		UPDATE "User"
 		SET queueing = false
-		WHERE id = $1`
-	_, err := database.DB.Exec(query, id)
+		WHERE id = $1 AND queueing`
+	result, err := database.DB.Exec(query, id)
 	if err != nil {
 		return -1, err
 	}
 
+	count, err := result.RowsAffected()
+	if err != nil {
+		return -1, err
+	}
+
+	if count != 1 {
+		return -1, errors.New("user not in queue")
+	}
+
 	players, err := database.PlayersInQueue()
 	return players, err
 }
-- 
2.44.0