Repository: Stirling-Tools/Stirling-PDF
File: app/proprietary/src/main/java/stirling/software/proprietary/controller/api/SignatureController.java (Java)

Code before:
                return ResponseEntity.badRequest().build();
            }

            signatureService.updateSignatureLabel(username, signatureId, newLabel);
            log.info("User {} updated label for signature {}", username, signatureId);
            return ResponseEntity.noContent().build();
        } catch (IOException e) {
            log.warn("Failed to update signature label: {}", e.getMessage());
            return ResponseEntity.status(HttpStatus.NOT_FOUND).build();
        }
    }

    /**
     * Delete a signature owned by the authenticated user. Users can delete their own personal
     * signatures. Admins can also delete shared signatures.
     */
    @DeleteMapping("/{signatureId}")
    public ResponseEntity<Void> deleteSignature(@PathVariable String signatureId) {
        try {
            String username = userService.getCurrentUsername();
            boolean isAdmin = userService.isCurrentUserAdmin();

            // Validate filename to prevent path traversal
            if (signatureId.contains("..")
                    || signatureId.contains("/")
                    || signatureId.contains("\\")) {
                log.warn("Invalid signature ID: {}", signatureId);
                return ResponseEntity.badRequest().build();
            }

            // Try to delete from personal folder first
            try {
                signatureService.deleteSignature(username, signatureId);
                log.info("User {} deleted personal signature {}", username, signatureId);
                return ResponseEntity.noContent().build();
            } catch (IOException e) {
                // If not found in personal folder, check if it's in shared folder
                if (isAdmin) {
                    // Admin can delete from shared folder
                    if (deleteFromSharedFolder(signatureId)) {
                        log.info("Admin {} deleted shared signature {}", username, signatureId);
                        return ResponseEntity.noContent().build();
                    }
                }
                // If not admin or not found in shared folder either, return 404
                throw e;
            }
        } catch (IOException e) {
            log.warn("Failed to delete signature {} for user: {}", signatureId, e.getMessage());
            return ResponseEntity.status(HttpStatus.NOT_FOUND).build();
        }

Review comment (refactor):
I'd add this to `updateSignatureLabel` as well. Could also put it into a helper method to avoid duplication

Code after:
                log.warn("Invalid label update request");
                return ResponseEntity.badRequest().build();
            }

            signatureService.updateSignatureLabel(username, signatureId, newLabel);
            log.info("User {} updated label for signature {}", username, signatureId);
            return ResponseEntity.noContent().build();
        } catch (IOException e) {
            log.warn("Failed to update signature label: {}", e.getMessage());
            return ResponseEntity.status(HttpStatus.NOT_FOUND).build();
        }
    }

    /**
     * Delete a signature owned by the authenticated user. Users can delete their own personal
     * signatures. Admins can also delete shared signatures.
     */
    @DeleteMapping("/{signatureId}")
    @PreAuthorize("!hasAuthority('ROLE_DEMO_USER')")
    public ResponseEntity<Void> deleteSignature(@PathVariable String signatureId) {
        try {
            String username = userService.getCurrentUsername();
            boolean isAdmin = userService.isCurrentUserAdmin();

            // Validate filename to prevent path traversal
            if (signatureId.contains("..")
                    || signatureId.contains("/")
                    || signatureId.contains("\\")) {
                log.warn("Invalid signature ID: {}", signatureId);
                return ResponseEntity.badRequest().build();
            }

            // Try to delete from personal folder first
            try {
                signatureService.deleteSignature(username, signatureId);
                log.info("User {} deleted personal signature {}", username, signatureId);
                return ResponseEntity.noContent().build();
            } catch (IOException e) {
                // If not found in personal folder, check if it's in shared folder
                if (isAdmin) {
                    // Admin can delete from shared folder
                    if (deleteFromSharedFolder(signatureId)) {
                        log.info("Admin {} deleted shared signature {}", username, signatureId);
                        return ResponseEntity.noContent().build();
                    }
                }
                // If not admin or not found in shared folder either, return 404
                throw e;
            }
        } catch (IOException e) {
            log.warn("Failed to delete signature {} for user: {}", signatureId, e.getMessage());