user can only access data generated by the same user now

1 files changed, 5 insertions, 1 deletions

diff --git a/item/hooks.go b/item/hooks.go
index 558a8cb..5a27114 100644
--- a/item/hooks.go
+++ b/item/hooks.go
@@ -25,7 +25,8 @@ import (
 func (i *SavedItem) BeforeSave(tx *gorm.DB) error {
 	var err error
 
-	err = checkIfBrandExists(i.BrandID, i.UserID)
+	// also checks if brand actually exists
+	err = checkBrandOwnership(i.BrandID, i.UserID)
 	if err != nil {
 		return err
 	}
@@ -53,5 +54,8 @@ func (b *Brand) BeforeDelete(tx *gorm.DB) error {
 		return errors.ErrNoWhereCondition
 	}
 
+	// delete all items
+	db.Where("brand_id = ? and user_id = ?", b.ID, b.UserID).Delete(&SavedItem{})
+
 	return nil
 }