From 73d41fcd86b5c2ddd597c1c69c94a59789beff74 Mon Sep 17 00:00:00 2001
From: oppiliappan <me@oppi.li>
Date: Mon, 14 Jul 2025 10:34:16 +0100
Subject: [PATCH] appview: harden spindle deletion again

Signed-off-by: oppiliappan <me@oppi.li>
---
 appview/ingester.go          |  9 ++++++---
 appview/spindles/spindles.go | 13 ++++++++-----
 2 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/appview/ingester.go b/appview/ingester.go
index a1f77ee..6677bdb 100644
--- a/appview/ingester.go
+++ b/appview/ingester.go
@@ -492,6 +492,7 @@ func (i *Ingester) ingestSpindle(e *models.Event) error {
 		if err != nil || len(spindles) != 1 {
 			return fmt.Errorf("failed to get spindles: %w, len(spindles) = %d", err, len(spindles))
 		}
+		spindle := spindles[0]
 
 		tx, err := ddb.Begin()
 		if err != nil {
@@ -511,9 +512,11 @@ func (i *Ingester) ingestSpindle(e *models.Event) error {
 			return err
 		}
 
-		err = i.Enforcer.RemoveSpindle(instance)
-		if err != nil {
-			return err
+		if spindle.Verified != nil {
+			err = i.Enforcer.RemoveSpindle(instance)
+			if err != nil {
+				return err
+			}
 		}
 
 		err = tx.Commit()
diff --git a/appview/spindles/spindles.go b/appview/spindles/spindles.go
index 17c7416..250450d 100644
--- a/appview/spindles/spindles.go
+++ b/appview/spindles/spindles.go
@@ -316,11 +316,14 @@ func (s *Spindles) delete(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	err = s.Enforcer.RemoveSpindle(instance)
-	if err != nil {
-		l.Error("failed to update ACL", "err", err)
-		fail()
-		return
+	// delete from enforcer
+	if spindles[0].Verified != nil {
+		err = s.Enforcer.RemoveSpindle(instance)
+		if err != nil {
+			l.Error("failed to update ACL", "err", err)
+			fail()
+			return
+		}
 	}
 
 	client, err := s.OAuth.AuthorizedClient(r)
-- 
2.51.2