From bcc4f3282033d58ad5efa6b90be8c67eb72b6ebb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Garc=C3=ADa?=
 <dani-garcia@users.noreply.github.com>
Date: Fri, 24 Jul 2026 18:17:04 +0200
Subject: [PATCH] deduplicate send validation

---
 src/api/core/sends.rs | 30 ++++++++----------------------
 src/auth/send.rs      | 14 ++------------
 src/db/models/send.rs | 16 ++++++++++++++++
 3 files changed, 26 insertions(+), 34 deletions(-)

diff --git a/src/api/core/sends.rs b/src/api/core/sends.rs
index 36cdb1c3..042ce95b 100644
--- a/src/api/core/sends.rs
+++ b/src/api/core/sends.rs
@@ -453,6 +453,9 @@ async fn post_access(headers: SendHeaders, conn: DbConn, nt: Notify<'_>) -> Json
     let Some(send) = Send::find_by_uuid(&headers.send_id, &conn).await else {
         err_code!(SEND_INACCESSIBLE_MSG, 404)
     };
+    if !send.is_accessible() {
+        err_code!(SEND_INACCESSIBLE_MSG, 404)
+    }
     process_access(send, conn, nt).await
 }
 
@@ -483,17 +486,7 @@ async fn post_access_legacy(
         err_code!(SEND_INACCESSIBLE_MSG, 404);
     }
 
-    if let Some(expiration) = send.expiration_date
-        && Utc::now().naive_utc() >= expiration
-    {
-        err_code!(SEND_INACCESSIBLE_MSG, 404)
-    }
-
-    if Utc::now().naive_utc() >= send.deletion_date {
-        err_code!(SEND_INACCESSIBLE_MSG, 404)
-    }
-
-    if send.disabled {
+    if !send.is_accessible() {
         err_code!(SEND_INACCESSIBLE_MSG, 404)
     }
 
@@ -541,6 +534,9 @@ async fn post_access_file(
     let Some(send) = Send::find_by_uuid(&headers.send_id, &conn).await else {
         err_code!(SEND_INACCESSIBLE_MSG, 404)
     };
+    if !send.is_accessible() {
+        err_code!(SEND_INACCESSIBLE_MSG, 404)
+    }
     process_access_file(send, file_id, host, conn, nt).await
 }
 
@@ -567,17 +563,7 @@ async fn post_access_file_legacy(
         err_code!(SEND_INACCESSIBLE_MSG, 404)
     }
 
-    if let Some(expiration) = send.expiration_date
-        && Utc::now().naive_utc() >= expiration
-    {
-        err_code!(SEND_INACCESSIBLE_MSG, 404)
-    }
-
-    if Utc::now().naive_utc() >= send.deletion_date {
-        err_code!(SEND_INACCESSIBLE_MSG, 404)
-    }
-
-    if send.disabled {
+    if !send.is_accessible() {
         err_code!(SEND_INACCESSIBLE_MSG, 404)
     }
 
diff --git a/src/auth/send.rs b/src/auth/send.rs
index 00ede0ed..2554488a 100644
--- a/src/auth/send.rs
+++ b/src/auth/send.rs
@@ -85,18 +85,8 @@ impl SendTokens {
             return Self::invalid_error(&format!("Send {send_id}, max access reached"), "send_id_invalid", true);
         }
 
-        if let Some(expiration) = send.expiration_date
-            && Utc::now().naive_utc() >= expiration
-        {
-            return Self::invalid_error(&format!("Send {send_id}, expired"), "send_id_invalid", true);
-        }
-
-        if Utc::now().naive_utc() >= send.deletion_date {
-            return Self::invalid_error(&format!("Send {send_id}, past deletion"), "send_id_invalid", true);
-        }
-
-        if send.disabled {
-            return Self::invalid_error(&format!("Send {send_id}, disabled"), "send_id_invalid", true);
+        if !send.is_accessible() {
+            return Self::invalid_error(&format!("Send {send_id}, not accessible"), "send_id_invalid", true);
         }
 
         if send.password_hash.is_some() {
diff --git a/src/db/models/send.rs b/src/db/models/send.rs
index 616479ed..c5bc98c4 100644
--- a/src/db/models/send.rs
+++ b/src/db/models/send.rs
@@ -262,6 +262,22 @@ impl Send {
         Ok(true)
     }
 
+    /// Whether the Send is currently within its validity window: not disabled, not past its
+    /// expiration date, and not past its deletion date. Does not consider `max_access_count`
+    /// (consumed at token issuance) or the password.
+    pub fn is_accessible(&self) -> bool {
+        let now = Utc::now().naive_utc();
+        if self.disabled {
+            return false;
+        }
+        if let Some(expiration) = self.expiration_date
+            && now >= expiration
+        {
+            return false;
+        }
+        now < self.deletion_date
+    }
+
     pub async fn delete(&self, conn: &DbConn) -> EmptyResult {
         self.update_users_revision(conn).await;