From 4225fcb36f5b82c9676d3ba3db224f112ee87e8f Mon Sep 17 00:00:00 2001
From: Ninjdai <ninjdai@duck.com>
Date: Thu, 14 Aug 2025 09:23:58 +0200
Subject: [PATCH] feat: check bal timestamps as time cannot go backwards

---
 src/routes/bal.rs | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/src/routes/bal.rs b/src/routes/bal.rs
index a4d4f77..ba7aa1f 100644
--- a/src/routes/bal.rs
+++ b/src/routes/bal.rs
@@ -60,6 +60,7 @@ pub struct BalCreateParams {
     security(("jwt" = [])),
     responses(
         (status = CREATED, body = bal::Model, description = "Successfully created BAL"),
+        (status = BAD_REQUEST, body = bal::Model, description = "Time cannot go backwards in this world"),
     ),
     summary = "Create a new bal",
     description = "Create a new bal",
@@ -70,6 +71,9 @@ pub async fn create_bal(
     claims: Claims,
     Json(instance_payload): Json<BalCreateParams>,
 ) -> (StatusCode, Json<Option<bal::Model>>) {
+    if instance_payload.start_timestamp > instance_payload.end_timestamp {
+        return (StatusCode::BAD_REQUEST, Json(None))
+    }
     let bal = bal::ActiveModel {
         id: NotSet,
         user_id: Set(claims.user_id),
@@ -116,22 +120,28 @@ pub async fn update_bal(
     State(state): State<Arc<AppState>>,
     claims: Claims,
     Path(id): Path<u32>,
-    Json(instance_payload): Json<BalUpdateParams>,
+    Json(payload): Json<BalUpdateParams>,
 ) -> (StatusCode, Json<Option<bal::Model>>) {
     if let Ok(Some(bal)) = Bal::find_by_id(id).one(state.db_conn.as_ref()).await {
         if bal.user_id != claims.user_id {
             return (StatusCode::FORBIDDEN, Json(None));
         }
+        // Timestamp checks
+        if (payload.start_timestamp.is_some() || payload.end_timestamp.is_some())
+            && payload.start_timestamp.unwrap_or(bal.start_timestamp) > payload.end_timestamp.unwrap_or(bal.end_timestamp) {
+            return (StatusCode::BAD_REQUEST, Json(None))
+        }
+
         let mut bal: bal::ActiveModel = bal.into();
-        bal.name = match instance_payload.name {
+        bal.name = match payload.name {
             None => bal.name,
             Some(v) => Set(v)
         };
-        bal.start_timestamp = match instance_payload.start_timestamp {
+        bal.start_timestamp = match payload.start_timestamp {
             None => bal.start_timestamp,
             Some(v) => Set(v)
         };
-        bal.end_timestamp = match instance_payload.end_timestamp {
+        bal.end_timestamp = match payload.end_timestamp {
             None => bal.end_timestamp,
             Some(v) => Set(v)
         };