fix: valider data.user/data.artistes avant déréférencement

src/api/commentaire/controllers/__tests__/commentaire.test.js

@@ -81,4 +81,22 @@ describe('commentaire.create', () => {
     await expect(controller.create(ctx)).rejects.toThrow('Texte introuvable.')
     expect(commentaireDocuments.create).not.toHaveBeenCalled()
   })
+
+  it('refuse sans planter quand data.user est absent', async () => {
+    const {strapi, userDbQuery} = buildStrapi()
+    const controller = createController({strapi})
+    const ctx = buildCtx(buildData({user: undefined}))
+
+    await expect(controller.create(ctx)).rejects.toThrow('Informations manquantes.')
+    expect(userDbQuery.findOne).not.toHaveBeenCalled()
+  })
+
+  it('refuse sans planter quand data.parole est absent', async () => {
+    const {strapi, paroleDbQuery} = buildStrapi()
+    const controller = createController({strapi})
+    const ctx = buildCtx(buildData({parole: undefined}))
+
+    await expect(controller.create(ctx)).rejects.toThrow('Informations manquantes.')
+    expect(paroleDbQuery.findOne).not.toHaveBeenCalled()
+  })
 })

src/api/commentaire/controllers/commentaire.js

@@ -8,6 +8,10 @@ module.exports = createCoreController('api::commentaire.commentaire', ({strapi})
     const {body} = ctx.request
     let {data} = body
 
+    if (!data?.user?.id || !data?.parole) {
+      throw new ApplicationError('Informations manquantes.')
+    }
+
     const user = await strapi.db.query('plugin::users-permissions.user').findOne({
       where: {id: data.user.id}
     })