i

src/store/article/setEansBySku.js

@@ -1,10 +1,12 @@
 import {
   ADD_EAN as MSSQL_ADD_EAN,
   DELETE_EANS_BY_ARTICLE as MSSQL_DELETE_EANS,
+  EAN_EXISTS_FOR_OTHER_ARTICLE as MSSQL_CHECK_CONFLICT,
 } from '../../providers/mssql/queries/article.js';
 import {
   ADD_EAN as SQLITE_ADD_EAN,
   DELETE_EANS_BY_ARTICLE as SQLITE_DELETE_EANS,
+  EAN_EXISTS_FOR_OTHER_ARTICLE as SQLITE_CHECK_CONFLICT,
 } from '../../providers/sqlite3/queries/article.js';
 import { INSERT as MSSQL_INSERT_HISTORY } from '../../providers/mssql/queries/articlehistory.js';
 import { INSERT as SQLITE_INSERT_HISTORY } from '../../providers/sqlite3/queries/articlehistory.js';
@@ -21,6 +23,7 @@ export default function setEansBySku(provider) {
   const addEanSql = isSqlite ? SQLITE_ADD_EAN : MSSQL_ADD_EAN;
   const deleteEansSql = isSqlite ? SQLITE_DELETE_EANS : MSSQL_DELETE_EANS;
   const insertHistorySql = isSqlite ? SQLITE_INSERT_HISTORY : MSSQL_INSERT_HISTORY;
+  const checkConflictSql = isSqlite ? SQLITE_CHECK_CONFLICT : MSSQL_CHECK_CONFLICT;
 
   /**
    * Replaces the EAN list of an article by its SKU.
@@ -55,7 +58,19 @@ export default function setEansBySku(provider) {
     }
 
     const runSet = async (runner) => {
-      const { articleId, languageId, companyuserId } = await resolve(googleAuthId, sku, runner);
+      const { articleId, languageId, companyuserId, companyId } = await resolve(googleAuthId, sku, runner);
+
+      // Guard: EAN cannot be used by another article in the same company
+      for (const ean of normalized) {
+        const conflict = await runner.query(checkConflictSql, {
+          ean,
+          companyId,
+          articleId,
+        });
+        if (conflict.rows[0]) {
+          throw new Error('EAN already in use');
+        }
+      }
 
       // Read old EANs for history
       const oldEanRes = await runner.query(

src/store/pic/resolvePicAccess.js

@@ -10,11 +10,26 @@ export default function resolvePicAccess(provider) {
   return async (googleAuthId, fullHash, tx) => {
     const result = await makeRunner(provider, tx).query(sql, { hash: fullHash });
 
-    const categoryId = result.rows[0]?.categoryId;
-    if (!categoryId) {
+    if (!result.rows || result.rows.length === 0) {
       throw new Error('Image not found');
     }
 
-    await access(googleAuthId, categoryId, tx);
+    let authorized = false;
+    let lastError = null;
+    for (const row of result.rows) {
+      const categoryId = row.categoryId;
+      if (!categoryId) continue;
+      try {
+        await access(googleAuthId, categoryId, tx);
+        authorized = true;
+        break;
+      } catch (err) {
+        lastError = err;
+      }
+    }
+
+    if (!authorized) {
+      throw lastError || new Error('Not authorized');
+    }
   };
 }