diff --git a/server/src/services/partner.service.spec.ts b/server/src/services/partner.service.spec.ts index 029462a865..b947f3795a 100644 --- a/server/src/services/partner.service.spec.ts +++ b/server/src/services/partner.service.spec.ts @@ -54,6 +54,7 @@ describe(PartnerService.name, () => { const auth = AuthFactory.create({ id: user1.id }); mocks.partner.get.mockResolvedValue(void 0); + mocks.user.get.mockResolvedValue(user2); mocks.partner.create.mockResolvedValue(getForPartner(partner)); await expect(sut.create(auth, { sharedWithId: user2.id })).resolves.toBeDefined(); @@ -76,6 +77,19 @@ describe(PartnerService.name, () => { expect(mocks.partner.create).not.toHaveBeenCalled(); }); + + it('should throw an error when sharedWithId does not resolve to an existing (non-deleted) user', async () => { + const user1 = UserFactory.create(); + const user2 = UserFactory.create(); + const auth = AuthFactory.create({ id: user1.id }); + + mocks.partner.get.mockResolvedValue(void 0); + mocks.user.get.mockResolvedValue(void 0); + + await expect(sut.create(auth, { sharedWithId: user2.id })).rejects.toBeInstanceOf(BadRequestException); + + expect(mocks.partner.create).not.toHaveBeenCalled(); + }); }); describe('remove', () => { diff --git a/server/src/services/partner.service.ts b/server/src/services/partner.service.ts index cc950edb5b..26d7701077 100644 --- a/server/src/services/partner.service.ts +++ b/server/src/services/partner.service.ts @@ -16,6 +16,12 @@ export class PartnerService extends BaseService { throw new BadRequestException(`Partner already exists`); } + const user = await this.userRepository.get(sharedWithId, {}); + if (!user) { + this.logger.debug('Partner creation failed: user not found'); + throw new BadRequestException('Invalid user'); + } + const partner = await this.partnerRepository.create(partnerId); return this.mapPartner(partner, PartnerDirection.SharedBy); }