From d21e19d82849985c45364f59ae09f6b489c02c36 Mon Sep 17 00:00:00 2001
From: Austin Spencer <abspencer2097@gmail.com>
Date: Thu, 17 Oct 2024 08:36:18 -0400
Subject: [PATCH] restrict user ereader updates to devices with sole ownership

---
 client/pages/account.vue           | 5 ++++-
 server/controllers/MeController.js | 2 +-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/client/pages/account.vue b/client/pages/account.vue
index ee95c7d60..28780a3b7 100644
--- a/client/pages/account.vue
+++ b/client/pages/account.vue
@@ -73,7 +73,7 @@
         <ui-btn color="primary flex items-center text-lg" @click="logout"><span class="material-symbols mr-4 icon-text">logout</span>{{ $strings.ButtonLogout }}</ui-btn>
       </div>
 
-      <modals-emails-user-e-reader-device-modal v-model="showEReaderDeviceModal" :existing-devices="ereaderDevices" :ereader-device="selectedEReaderDevice" @update="ereaderDevicesUpdated" />
+      <modals-emails-user-e-reader-device-modal v-model="showEReaderDeviceModal" :existing-devices="revisedEreaderDevices" :ereader-device="selectedEReaderDevice" @update="ereaderDevicesUpdated" />
     </div>
   </div>
 </template>
@@ -126,6 +126,9 @@ export default {
     },
     showEreaderTable() {
       return this.usertype !== 'root' && this.usertype !== 'admin' && this.user.permissions?.createEreader
+    },
+    revisedEreaderDevices() {
+      return this.ereaderDevices.filter((device) => device.users?.length === 1)
     }
   },
   methods: {
diff --git a/server/controllers/MeController.js b/server/controllers/MeController.js
index 507edcf4b..bc3da289d 100644
--- a/server/controllers/MeController.js
+++ b/server/controllers/MeController.js
@@ -413,7 +413,7 @@ class MeController {
     }
 
     const otherDevices = Database.emailSettings.ereaderDevices.filter((device) => {
-      return !Database.emailSettings.checkUserCanAccessDevice(device, req.user)
+      return !Database.emailSettings.checkUserCanAccessDevice(device, req.user) && device.users?.length === 1
     })
     const ereaderDevices = otherDevices.concat(userEReaderDevices)