fix: whitelister les champs autorisés sur create/update (mass assignment)

src/api/commentaire/controllers/__tests__/commentaire.test.js

@@ -99,4 +99,21 @@ describe('commentaire.create', () => {
     await expect(controller.create(ctx)).rejects.toThrow('Informations manquantes.')
     expect(paroleDbQuery.findOne).not.toHaveBeenCalled()
   })
+
+  it('ignore les champs non autorisés du payload (mass assignment)', async () => {
+    const {strapi, commentaireDocuments} = buildStrapi()
+    const controller = createController({strapi})
+    const ctx = buildCtx(buildData({publishedAt: '2020-01-01'}))
+
+    await controller.create(ctx)
+
+    expect(commentaireDocuments.create).toHaveBeenCalledWith({
+      data: {
+        contenu: 'Un commentaire',
+        datePublication: '2026-07-04',
+        user: dbUser.id,
+        parole: dbParole.id
+      }
+    })
+  })
 })