1 files changed, 43 insertions, 23 deletions
diff --git a/server/src/Persistence/Payment.hs b/server/src/Persistence/Payment.hs
index 3d8f129..b3f2b2e 100644
--- a/server/src/Persistence/Payment.hs
+++ b/server/src/Persistence/Payment.hs
@@ -129,33 +129,53 @@ createMany payments =
       (map InsertRow payments)
   )
 
-edit :: UserId -> PaymentId -> Text -> Int -> Day -> Frequency -> Query Bool
-edit userId paymentId paymentName paymentCost paymentDate paymentFrequency =
+edit :: UserId -> PaymentId -> Text -> Int -> Day -> Frequency -> Query (Maybe Payment)
+edit userId paymentId name cost date frequency =
   Query (\conn -> do
     mbPayment <- fmap (\(Row p) -> p) . listToMaybe <$>
-      SQLite.query conn "SELECT * FROM payment WHERE id = ?" (Only paymentId)
+      SQLite.query
+        conn
+        "SELECT * FROM payment WHERE id = ? and userId = ?"
+        (paymentId, userId)
     case mbPayment of
-      Just payment ->
-        if _payment_user payment == userId
-          then do
-            now <- getCurrentTime
-            SQLite.execute
-              conn
-              (SQLite.Query $ T.intercalate " "
-                [ "UPDATE payment"
-                , "SET edited_at = ?,"
-                , "    name = ?,"
-                , "    cost = ?,"
-                , "    date = ?,"
-                , "    frequency = ?"
-                , "WHERE id = ?"
-                ])
-              (now, paymentName, paymentCost, paymentDate, FrequencyField paymentFrequency, paymentId)
-            return True
-          else
-            return False
+      Just payment -> do
+        now <- getCurrentTime
+        SQLite.execute
+          conn
+          (SQLite.Query $ T.intercalate " "
+            [ "UPDATE"
+            , "  payment"
+            , "SET"
+            , "  edited_at = ?,"
+            , "  name = ?,"
+            , "  cost = ?,"
+            , "  date = ?,"
+            , "  frequency = ?"
+            , "WHERE"
+            , "  id = ?"
+            , "  AND user_id = ?"
+            ])
+          ( now
+          , name
+          , cost
+          , date
+          , FrequencyField frequency
+          , paymentId
+          , userId
+          )
+        return . Just $ Payment
+          { _payment_id        = paymentId
+          , _payment_user      = userId
+          , _payment_name      = name
+          , _payment_cost      = cost
+          , _payment_date      = date
+          , _payment_frequency = frequency
+          , _payment_createdAt = _payment_createdAt payment
+          , _payment_editedAt  = Just now
+          , _payment_deletedAt = Nothing
+          }
       Nothing ->
-        return False
+        return Nothing
   )
 
 delete :: UserId -> PaymentId -> Query ()