From a8dc24569e77e0026dd0cfcb34806eeba300f646 Mon Sep 17 00:00:00 2001
From: Petitminion <petitminion@riseup.net>
Date: Tue, 11 Mar 2025 17:48:30 +0100
Subject: [PATCH] make sure we got the good lib in bulk upload endpoint

---
 api/funkwhale_api/music/serializers.py |  7 +++++--
 api/tests/music/test_views.py          | 27 ++++++++++++++++++++++++++
 2 files changed, 32 insertions(+), 2 deletions(-)

diff --git a/api/funkwhale_api/music/serializers.py b/api/funkwhale_api/music/serializers.py
index b79ec146e..eb2fd2f6b 100644
--- a/api/funkwhale_api/music/serializers.py
+++ b/api/funkwhale_api/music/serializers.py
@@ -549,9 +549,12 @@ class UploadBulkUpdateSerializer(serializers.Serializer):
             raise serializers.ValidationError(
                 f"Upload with uuid {data['uuid']} does not exist"
             )
-        upload.library = upload.library.actor.libraries.get(
+        if lib := upload.library.actor.libraries.filter(
             privacy_level=data["privacy_level"], name=data["privacy_level"]
-        )
+        ).exclude(playlist__isnull=False):
+            upload.library = lib
+        else:
+            raise serializers.ValidationError("Built-in library not found.")
         return upload
 
 
diff --git a/api/tests/music/test_views.py b/api/tests/music/test_views.py
index a8f714d2f..1c168bcce 100644
--- a/api/tests/music/test_views.py
+++ b/api/tests/music/test_views.py
@@ -1587,3 +1587,30 @@ def test_can_patch_upload_list(factories, logged_in_api_client):
 
     assert response.status_code == 200
     assert upload.library.privacy_level == "everyone"
+
+
+def test_upload_list_wont_use_playlist_lib(factories, logged_in_api_client):
+    url = reverse("api:v1:uploads-bulk-update")
+    actor = logged_in_api_client.user.create_actor()
+    upload = factories["music.Upload"](library__actor=actor)
+    upload2 = factories["music.Upload"](library__actor=actor)
+    playlist = factories["playlists.Playlist"]()
+    lib = factories["music.Library"](
+        actor=actor,
+        privacy_level="everyone",
+        name="everyone",
+    )
+    playlist.library = lib
+    playlist.save()
+    response = logged_in_api_client.patch(
+        url,
+        [
+            {"uuid": upload.uuid, "privacy_level": "everyone"},
+            {"uuid": upload2.uuid, "privacy_level": "everyone"},
+        ],
+        format="json",
+    )
+    upload.refresh_from_db()
+    upload2.refresh_from_db()
+
+    assert response.status_code == 400