From b52ace49db41c11bed1b05f600cf39a32a67ab14 Mon Sep 17 00:00:00 2001
From: Stephan Richter <s.richter@srsoftware.de>
Date: Thu, 10 Jul 2025 16:49:20 +0200
Subject: [PATCH] added another state check

Signed-off-by: Stephan Richter <s.richter@srsoftware.de>
---
 .../de/srsoftware/umbrella/documents/DocumentApi.java     | 4 ++--
 frontend/src/routes/document/Add.svelte                   | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/documents/src/main/java/de/srsoftware/umbrella/documents/DocumentApi.java b/documents/src/main/java/de/srsoftware/umbrella/documents/DocumentApi.java
index 76de2ad..7470920 100644
--- a/documents/src/main/java/de/srsoftware/umbrella/documents/DocumentApi.java
+++ b/documents/src/main/java/de/srsoftware/umbrella/documents/DocumentApi.java
@@ -72,11 +72,11 @@ public class DocumentApi extends BaseHandler {
 	private boolean deleteDocument(HttpExchange ex, long docId, UmbrellaUser user) throws IOException, UmbrellaException {
 		var doc = db.loadDoc(docId);
 		var companyId = doc.companyId();
-		var company = companies.get(companyId);
 		var members = companies.getMembers(companyId);
 		var isMember = false;
 		for (var member : members) isMember |= user.equals(member);
-		if (!isMember) return sendContent(ex,HTTP_FORBIDDEN,"You are mot a member of company "+doc.companyId());
+		if (!isMember) throw new UmbrellaException(HTTP_FORBIDDEN,"You are mot a member of company {0}",doc.companyId());
+		if (doc.state() != NEW) throw new UmbrellaException(HTTP_BAD_REQUEST,"This document has already been sent");
 		return sendContent(ex,db.deleteDoc(docId));
 	}
 
diff --git a/frontend/src/routes/document/Add.svelte b/frontend/src/routes/document/Add.svelte
index 8900a26..84159df 100644
--- a/frontend/src/routes/document/Add.svelte
+++ b/frontend/src/routes/document/Add.svelte
@@ -6,7 +6,7 @@
 
     let router = useTinyRouter();
     let company = $state(null);
-    let error = null;
+    let error = $state(null);
     let docType = $state(null);
     let document = $state({
         type : +router.query.document_type,
@@ -93,12 +93,12 @@
 </style>
 
 <fieldset>
-    {#if docType}
-    <legend>{t('document.add_new',docType)}</legend>
-    {/if}
     {#if error}
     <span class="error">{error}</span>
     {/if}
+    {#if docType}
+    <legend>{t('document.add_new',docType)}</legend>
+    {/if}
     {#if company}
     Company: {company.name}
     <fieldset>