(20250122) User-info fetching mistake.

api/blueprints/message/mail/send/send.py

@@ -233,26 +233,27 @@ async def send_one_mail(
     # ┗┛┗┻┛┛┗┗ ┛ ┛┛┗┗┣┛  ┗┛┛┗┗ ┗┛┗
     #                ┛
 
-    # We test ownership only in API calls made from outside:
+    # Get the token based on the key:
+    auth_token = await current_app.mail_controller.get_token_from_key(
+        mongo_data_conn = current_app.data_mongo,
+        token_key = inbound_data.tokenKey
+    )
+
+    # Get the user's info:
     if inbound_headers["Remote-IP"] not in current_app.whitelisted_ips:
-
-        # Get the token based on the key:
-        auth_token = await current_app.mail_controller.get_token_from_key(
-            mongo_data_conn = current_app.data_mongo,
-            token_key = inbound_data.tokenKey
-        )
         user_info = CoreUserInfoModel(**kwargs["session_info"])
+    else: user_info = auth_token.user
 
-        # We check if the token that was used to fetch the mail is owned by this user:
+    # We check if the token that was used to fetch the mail is owned by this user:
-        if not await token_check.is_authorized(
+    if not await token_check.is_authorized(
-                mongo_data_conn = current_app.data_mongo,
+            mongo_data_conn = current_app.data_mongo,
-                user_info = user_info,
+            user_info = user_info,
-                token_ids = [auth_token.authTokenId]
+            token_ids = [auth_token.authTokenId]
-        ): return ResponseModel(
+    ): return ResponseModel(
-            status_code = StatusCodes.FAILED,
+        status_code = StatusCodes.FAILED,
-            http_code = HttpCodes.UNAUTHORIZED,
+        http_code = HttpCodes.UNAUTHORIZED,
-            message = "The account does not belong to this user."
+        message = "The account does not belong to this user."
-        )
+    )
 
     # ┏┓     ┓  ┳┳┓  •┓
     # ┗┓┏┓┏┓┏┫  ┃┃┃┏┓┓┃