From 08c08df25ae5a6bdb561ad01995703bf7ba5db31 Mon Sep 17 00:00:00 2001
From: Elliot Otchet <otchet@broadinstitute.org>
Date: Mon, 11 May 2026 21:53:26 -0400
Subject: [PATCH] Ensure that FSOs are limited to DAAs for this DAO.

---
 .../consent/http/db/DaaDAO.java               |  8 ++--
 .../consent/http/db/DaaDAOTest.java           | 46 +++++++++++++++++++
 2 files changed, 50 insertions(+), 4 deletions(-)

diff --git a/src/main/java/org/broadinstitute/consent/http/db/DaaDAO.java b/src/main/java/org/broadinstitute/consent/http/db/DaaDAO.java
index b3b8b7765..0770ba746 100644
--- a/src/main/java/org/broadinstitute/consent/http/db/DaaDAO.java
+++ b/src/main/java/org/broadinstitute/consent/http/db/DaaDAO.java
@@ -67,7 +67,7 @@ public interface DaaDAO extends Transactional<DaaDAO> {
                 dac.name,
                 dac.description
           FROM data_access_agreement daa
-          LEFT JOIN file_storage_object fso ON daa.daa_id::text = fso.entity_id
+          LEFT JOIN file_storage_object fso ON daa.daa_id::text = fso.entity_id AND fso.category = 'dataAccessAgreement'
           LEFT JOIN dac_daa dd ON daa.daa_id = dd.daa_id
           LEFT JOIN dac ON dd.dac_id = dac.dac_id AND dac.deleted IS NOT TRUE
       """)
@@ -108,7 +108,7 @@ public interface DaaDAO extends Transactional<DaaDAO> {
                 dac.name,
                 dac.description
           FROM data_access_agreement daa
-          LEFT JOIN file_storage_object fso ON daa.daa_id::text = fso.entity_id
+          LEFT JOIN file_storage_object fso ON daa.daa_id::text = fso.entity_id AND fso.category = 'dataAccessAgreement'
           LEFT JOIN dac_daa dd ON daa.daa_id = dd.daa_id
           LEFT JOIN dac ON dd.dac_id = dac.dac_id AND dac.deleted IS NOT TRUE
           WHERE daa.daa_id = :daaId
@@ -150,7 +150,7 @@ public interface DaaDAO extends Transactional<DaaDAO> {
                 dac.name,
                 dac.description
           FROM data_access_agreement daa
-          LEFT JOIN file_storage_object fso ON daa.daa_id::text = fso.entity_id
+          LEFT JOIN file_storage_object fso ON daa.daa_id::text = fso.entity_id AND fso.category = 'dataAccessAgreement'
           LEFT JOIN dac_daa dd ON daa.daa_id = dd.daa_id
           LEFT JOIN dac ON dd.dac_id = dac.dac_id
           WHERE daa.initial_dac_id = :dacId
@@ -272,7 +272,7 @@ void deleteDacDaaRelation(
                 dac.name,
                 dac.description
           FROM data_access_agreement daa
-          LEFT JOIN file_storage_object fso ON daa.daa_id::text = fso.entity_id
+          LEFT JOIN file_storage_object fso ON daa.daa_id::text = fso.entity_id AND fso.category = 'dataAccessAgreement'
           INNER JOIN dac_daa ON daa.daa_id = dac_daa.daa_id
           INNER JOIN dac ON dac.dac_id = dac_daa.dac_id
           INNER JOIN dataset ON dataset.dac_id = dac.dac_id
diff --git a/src/test/java/org/broadinstitute/consent/http/db/DaaDAOTest.java b/src/test/java/org/broadinstitute/consent/http/db/DaaDAOTest.java
index 1621f4937..7b5773b48 100644
--- a/src/test/java/org/broadinstitute/consent/http/db/DaaDAOTest.java
+++ b/src/test/java/org/broadinstitute/consent/http/db/DaaDAOTest.java
@@ -84,6 +84,44 @@ void testFindAllOneDaa() {
     assertEquals(1, daas.size());
   }
 
+  @Test
+  void testFindAllDacOnlyProperFileCategory() {
+    Integer userId = createUserId();
+    Integer dacId =
+        dacDAO.createDac(randomAlphabetic(5), randomAlphabetic(5), "", createUser().getUserId());
+    Integer daaId = daaDAO.createDaa(userId, Instant.now(), userId, Instant.now(), dacId);
+    fileStorageObjectDAO.insertNewFile(
+        randomAlphabetic(10),
+        FileCategory.ALTERNATIVE_DATA_SHARING_PLAN.getValue(),
+        randomAlphabetic(10),
+        MediaType.TEXT_PLAIN_TYPE.getType(),
+        daaId.toString(),
+        userId,
+        Instant.now());
+    Integer fsoId =
+        fileStorageObjectDAO.insertNewFile(
+            randomAlphabetic(10),
+            FileCategory.DATA_ACCESS_AGREEMENT.getValue(),
+            randomAlphabetic(10),
+            MediaType.TEXT_PLAIN_TYPE.getType(),
+            daaId.toString(),
+            userId,
+            Instant.now());
+    fileStorageObjectDAO.insertNewFile(
+        randomAlphabetic(10),
+        FileCategory.ALTERNATIVE_DATA_SHARING_PLAN.getValue(),
+        randomAlphabetic(10),
+        MediaType.TEXT_PLAIN_TYPE.getType(),
+        daaId.toString(),
+        userId,
+        Instant.now());
+    List<DataAccessAgreement> daa = daaDAO.findAll();
+    assertNotNull(daa);
+    assertEquals(1, daa.size());
+    assertNotNull(daa.getFirst().getFile());
+    assertEquals(fsoId, daa.getFirst().getFile().getFileStorageObjectId());
+  }
+
   @Test
   void testFindAllMultipleDaas() {
     Integer userId = createUserId();
@@ -266,6 +304,14 @@ void testFindWithFileStorageObject() {
             daaId.toString(),
             userId,
             Instant.now());
+    fileStorageObjectDAO.insertNewFile(
+        randomAlphabetic(10),
+        FileCategory.DATA_USE_LETTER.getValue(),
+        randomAlphabetic(10),
+        MediaType.TEXT_PLAIN_TYPE.getType(),
+        daaId.toString(),
+        userId,
+        Instant.now());
     DataAccessAgreement daa = daaDAO.findById(daaId);
     assertNotNull(daa);
     assertNotNull(daa.getFile());