fix: whitelister les champs autorisés sur create/update (mass assignment)

src/api/artiste/controllers/__tests__/artiste.test.js

@@ -70,4 +70,22 @@ describe('artiste.create', () => {
     expect(ctx.badRequest).toHaveBeenCalled()
     expect(strapi.documents).not.toHaveBeenCalled()
   })
+
+  it('ignore les champs non autorisés du payload (mass assignment)', async () => {
+    const {strapi, artisteDocuments} = buildStrapi({dbUser})
+    const controller = createController({strapi})
+    const ctx = buildCtx(buildData({
+      isExclusiveArtist: true,
+      userAdmin: {id: 999}
+    }))
+
+    await controller.create(ctx)
+
+    expect(artisteDocuments.create).toHaveBeenCalledWith({
+      data: {
+        alias: 'Test Artist',
+        user: dbUser.id
+      }
+    })
+  })
 })