(20241217) Mail tags update also doesn't need token key now.

api/blueprints/mail/tags/update.py

@@ -70,6 +70,7 @@ from shared import constants
 
 # Data Models:
 from models.api.mail.tags import MailUpdateTagsRequestHeaders, MailUpdateTagsRequestData
+from models.core.user import CoreUserInfoModel
 
 # To work with datatypes:
 from typing import Literal
@@ -80,6 +81,9 @@ import asyncio
 # To work with date and time:
 import datetime
 
+# Helpers:
+from api.helpers.user import token_check
+
 
 #   *****************************************************************************************************************
 #  *****                                                                                                          ****
@@ -167,6 +171,32 @@ async def update_mail_tags(
             http_code = HttpCodes.UNAUTHORIZED
         )
 
+    # ┏┓    ┓   ┳┳┓  •┓
+    # ┣ ┏┓╋┏┣┓  ┃┃┃┏┓┓┃
+    # ┻ ┗ ┗┗┛┗  ┛ ┗┗┻┗┗
+
+    # Get the mail:
+    message = await current_app.mail_controller.get_one_mail(
+        mongo_conn = current_app.data_mongo,
+        message_id = inbound_data.messageId
+    )
+
+    # ┏┓          ┓ •    ┏┓┓    ┓
+    # ┃┃┓┏┏┏┓┏┓┏┓┏┣┓┓┏┓  ┃ ┣┓┏┓┏┃┏
+    # ┗┛┗┻┛┛┗┗ ┛ ┛┛┗┗┣┛  ┗┛┛┗┗ ┗┛┗
+    #                ┛
+
+    # We check if the token that was used to fetch the mail is owned by this user:
+    if not await token_check.is_authorized(
+            mongo_conn=current_app.data_mongo,
+            user_info = CoreUserInfoModel(**kwargs["session_info"]),
+            token_ids = [message.tokenId]
+    ): return ResponseModel(
+        status_code = StatusCodes.FAILED,
+        http_code = HttpCodes.UNAUTHORIZED,
+        message = "The message does not belong to this user."
+    )
+
     # ┳┳   ┓       ┳┳┓  •┓
     # ┃┃┏┓┏┫┏┓╋┏┓  ┃┃┃┏┓┓┃
     # ┗┛┣┛┗┻┗┻┗┗   ┛ ┗┗┻┗┗
@@ -175,12 +205,16 @@ async def update_mail_tags(
     # Update the mail:
     success = await current_app.mail_controller.update_tags(
         mongo_conn = current_app.data_mongo,
-        token_id = auth_token.authTokenId,
         message_id = inbound_data.messageId,
         unset_tags = inbound_data.unsetTags,
         set_tags = inbound_data.setTags
     )
 
+    # ┳┓
+    # ┣┫┏┓┏┏┓┏┓┏┓┏┏┓
+    # ┛┗┗ ┛┣┛┗┛┛┗┛┗
+    #      ┛
+
     # Done here:
     return ResponseModel(
         status_code = StatusCodes.OK if success else StatusCodes.FAILED,