From 6f77c170035dfdb351c812361ed98a698a023f41 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20FAMIBELLE-PRONZOLA?= <c.pronzola@tuta.io>
Date: Sat, 4 Jul 2026 11:38:02 +0400
Subject: [PATCH] =?UTF-8?q?fix:=20valider=20data.user/data.artistes=20avan?=
 =?UTF-8?q?t=20d=C3=A9r=C3=A9f=C3=A9rencement?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../controllers/__tests__/artiste.test.js     | 11 ++++++++++
 src/api/artiste/controllers/artiste.js        |  4 ++++
 .../controllers/__tests__/commentaire.test.js | 18 +++++++++++++++
 .../commentaire/controllers/commentaire.js    |  4 ++++
 .../controllers/__tests__/parole.test.js      | 22 +++++++++++++++++++
 src/api/parole/controllers/parole.js          |  5 +++++
 6 files changed, 64 insertions(+)

diff --git a/src/api/artiste/controllers/__tests__/artiste.test.js b/src/api/artiste/controllers/__tests__/artiste.test.js
index 7d4ab90..707c474 100644
--- a/src/api/artiste/controllers/__tests__/artiste.test.js
+++ b/src/api/artiste/controllers/__tests__/artiste.test.js
@@ -59,4 +59,15 @@ describe('artiste.create', () => {
 
     expect(artisteDocuments.create).toHaveBeenCalled()
   })
+
+  it('refuse sans planter quand data.user est absent', async () => {
+    const {strapi} = buildStrapi({dbUser})
+    const controller = createController({strapi})
+    const ctx = buildCtx(buildData({user: undefined}))
+
+    await controller.create(ctx)
+
+    expect(ctx.badRequest).toHaveBeenCalled()
+    expect(strapi.documents).not.toHaveBeenCalled()
+  })
 })
diff --git a/src/api/artiste/controllers/artiste.js b/src/api/artiste/controllers/artiste.js
index 90c0ba7..ffa0e5a 100644
--- a/src/api/artiste/controllers/artiste.js
+++ b/src/api/artiste/controllers/artiste.js
@@ -12,6 +12,10 @@ module.exports = createCoreController('api::artiste.artiste', ({strapi}) => ({
     const {body} = ctx.request
     let {data} = body
 
+    if (!data?.user?.documentId) {
+      return ctx.badRequest('Informations manquantes.')
+    }
+
     const user = await strapi.documents('plugin::users-permissions.user').findOne({
       documentId: body.data.user.documentId
     })
diff --git a/src/api/commentaire/controllers/__tests__/commentaire.test.js b/src/api/commentaire/controllers/__tests__/commentaire.test.js
index 960ca94..35fbd55 100644
--- a/src/api/commentaire/controllers/__tests__/commentaire.test.js
+++ b/src/api/commentaire/controllers/__tests__/commentaire.test.js
@@ -81,4 +81,22 @@ describe('commentaire.create', () => {
     await expect(controller.create(ctx)).rejects.toThrow('Texte introuvable.')
     expect(commentaireDocuments.create).not.toHaveBeenCalled()
   })
+
+  it('refuse sans planter quand data.user est absent', async () => {
+    const {strapi, userDbQuery} = buildStrapi()
+    const controller = createController({strapi})
+    const ctx = buildCtx(buildData({user: undefined}))
+
+    await expect(controller.create(ctx)).rejects.toThrow('Informations manquantes.')
+    expect(userDbQuery.findOne).not.toHaveBeenCalled()
+  })
+
+  it('refuse sans planter quand data.parole est absent', async () => {
+    const {strapi, paroleDbQuery} = buildStrapi()
+    const controller = createController({strapi})
+    const ctx = buildCtx(buildData({parole: undefined}))
+
+    await expect(controller.create(ctx)).rejects.toThrow('Informations manquantes.')
+    expect(paroleDbQuery.findOne).not.toHaveBeenCalled()
+  })
 })
diff --git a/src/api/commentaire/controllers/commentaire.js b/src/api/commentaire/controllers/commentaire.js
index 9e33bd8..62b8bd6 100644
--- a/src/api/commentaire/controllers/commentaire.js
+++ b/src/api/commentaire/controllers/commentaire.js
@@ -8,6 +8,10 @@ module.exports = createCoreController('api::commentaire.commentaire', ({strapi})
     const {body} = ctx.request
     let {data} = body
 
+    if (!data?.user?.id || !data?.parole) {
+      throw new ApplicationError('Informations manquantes.')
+    }
+
     const user = await strapi.db.query('plugin::users-permissions.user').findOne({
       where: {id: data.user.id}
     })
diff --git a/src/api/parole/controllers/__tests__/parole.test.js b/src/api/parole/controllers/__tests__/parole.test.js
index 0127440..e333ce1 100644
--- a/src/api/parole/controllers/__tests__/parole.test.js
+++ b/src/api/parole/controllers/__tests__/parole.test.js
@@ -66,4 +66,26 @@ describe('parole.create', () => {
 
     expect(paroleDocuments.create).toHaveBeenCalled()
   })
+
+  it('refuse sans planter quand data.user est absent', async () => {
+    const {strapi, userDocuments} = buildStrapi({dbUser, artiste})
+    const controller = createController({strapi})
+    const ctx = buildCtx(buildData({user: undefined}))
+
+    await controller.create(ctx)
+
+    expect(ctx.badRequest).toHaveBeenCalled()
+    expect(userDocuments.findOne).not.toHaveBeenCalled()
+  })
+
+  it('refuse sans planter quand data.artistes est vide', async () => {
+    const {strapi, artisteDocuments} = buildStrapi({dbUser, artiste})
+    const controller = createController({strapi})
+    const ctx = buildCtx(buildData({artistes: []}))
+
+    await controller.create(ctx)
+
+    expect(ctx.badRequest).toHaveBeenCalled()
+    expect(artisteDocuments.findOne).not.toHaveBeenCalled()
+  })
 })
diff --git a/src/api/parole/controllers/parole.js b/src/api/parole/controllers/parole.js
index 37a0ccf..eb24efb 100644
--- a/src/api/parole/controllers/parole.js
+++ b/src/api/parole/controllers/parole.js
@@ -69,6 +69,11 @@ module.exports = createCoreController('api::parole.parole', ({strapi}) => ({
   async create(ctx) {
     const {body} = ctx.request
     const {data} = body
+
+    if (!data?.user?.documentId || !data?.artistes?.[0]?.documentId) {
+      return ctx.badRequest('Informations manquantes.')
+    }
+
     strapi.service('api::parole.parole').validateParoles(data.titre, data.transcription)
 
     const user = await strapi.documents('plugin::users-permissions.user').findOne({