fix: shared link create validation (#30762)

e2e/src/specs/server/api/shared-link.e2e-spec.ts

@@ -313,17 +313,17 @@ describe('/shared-links', () => {
         .send({ type: SharedLinkType.Album });
 
       expect(status).toBe(400);
-      expect(body).toEqual(expect.objectContaining({ message: 'Invalid albumId' }));
+      expect(body).toEqual(errorDto.validationError([{ path: [], message: 'albumId is required for type ALBUM' }]));
     });
 
     it('should require a valid asset id', async () => {
       const { status, body } = await request(app)
         .post('/shared-links')
         .set('Authorization', `Bearer ${user1.accessToken}`)
-        .send({ type: SharedLinkType.Individual, assetId: uuidDto.notFound });
+        .send({ type: SharedLinkType.Individual, assetIds: [uuidDto.notFound] });
 
       expect(status).toBe(400);
-      expect(body).toEqual(expect.objectContaining({ message: 'Invalid assetIds' }));
+      expect(body).toEqual(expect.objectContaining({ message: 'Not found or no asset.share access' }));
     });
 
     it('should create a shared link', async () => {

server/src/controllers/shared-link.controller.spec.ts

@@ -3,7 +3,7 @@ import { Permission, SharedLinkType } from 'src/enum';
 import { SharedLinkService } from 'src/services/shared-link.service';
 import request from 'supertest';
 import { errorDto } from 'test/medium/responses';
-import { factory } from 'test/small.factory';
+import { factory, newUuid } from 'test/small.factory';
 import { ControllerContext, controllerSetup, mockBaseService } from 'test/utils';
 
 describe(SharedLinkController.name, () => {
@@ -43,9 +43,31 @@ describe(SharedLinkController.name, () => {
     it('should allow an null expiresAt', async () => {
       await request(ctx.getHttpServer())
         .post('/shared-links')
-        .send({ expiresAt: null, type: SharedLinkType.Individual });
+        .send({ expiresAt: null, type: SharedLinkType.Individual, assetIds: [newUuid()] });
       expect(service.create).toHaveBeenCalledWith(undefined, expect.objectContaining({ expiresAt: null }));
     });
+
+    it('should not allow an albumId for share type Individual', async () => {
+      const { status, body } = await request(ctx.getHttpServer())
+        .post('/shared-links')
+        .send({ type: SharedLinkType.Individual, assetIds: [newUuid()], albumId: newUuid() });
+      expect(status).toBe(400);
+      expect(body).toEqual(
+        errorDto.validationError([{ path: [], message: 'albumId can only be used with type ALBUM' }]),
+      );
+      expect(service.create).not.toHaveBeenCalled();
+    });
+
+    it('should not allow assetIds for share type Album', async () => {
+      const { status, body } = await request(ctx.getHttpServer())
+        .post('/shared-links')
+        .send({ type: SharedLinkType.Album, assetIds: [newUuid()], albumId: newUuid() });
+      expect(status).toBe(400);
+      expect(body).toEqual(
+        errorDto.validationError([{ path: [], message: 'assetIds can only be used with type INDIVIDUAL' }]),
+      );
+      expect(service.create).not.toHaveBeenCalled();
+    });
   });
 
   describe('DELETE /shared-links/:id/assets', () => {

server/src/dtos/shared-link.dto.ts

@@ -3,7 +3,7 @@ import { SharedLink } from 'src/database';
 import { HistoryBuilder } from 'src/decorators';
 import { AlbumResponseSchema, mapAlbum } from 'src/dtos/album.dto';
 import { AssetResponseSchema, mapAsset } from 'src/dtos/asset-response.dto';
-import { SharedLinkTypeSchema } from 'src/enum';
+import { SharedLinkType, SharedLinkTypeSchema } from 'src/enum';
 import { isoDatetimeToDate } from 'src/validation';
 import z from 'zod';
 
@@ -31,6 +31,29 @@ const SharedLinkCreateSchema = z
     allowDownload: z.boolean().default(true).optional().describe('Allow downloads'),
     showMetadata: z.boolean().default(true).optional().describe('Show metadata'),
   })
+  .superRefine(({ type, albumId, assetIds }, ctx) => {
+    switch (type) {
+      case SharedLinkType.Album: {
+        if (!albumId) {
+          ctx.addIssue(`albumId is required for type ${SharedLinkType.Album}`);
+        }
+        if (assetIds) {
+          ctx.addIssue(`assetIds can only be used with type ${SharedLinkType.Individual}`);
+        }
+        return;
+      }
+      case SharedLinkType.Individual: {
+        if (!assetIds || assetIds.length === 0) {
+          ctx.addIssue(`assetIds are required for type ${SharedLinkType.Individual}`);
+        }
+
+        if (albumId) {
+          ctx.addIssue(`albumId can only be used with type ${SharedLinkType.Album}`);
+        }
+        return;
+      }
+    }
+  })
   .meta({ id: 'SharedLinkCreateDto' });
 
 const SharedLinkEditSchema = z