Audit sécurité/qualité : corrections critiques, tests, CI et lint #4

Merged
cedric merged 28 commits from fix/audit-2026-07-04 into master 2026-07-04 17:01:30 +00:00
2 changed files with 27 additions and 1 deletions
Showing only changes of commit 4ee7ed3e5e - Show all commits
@@ -56,6 +56,31 @@ function buildData(overrides = {}) {
}
}
describe('parole.findOne', () => {
it('interroge avec le documentId venant de ctx.params.id, pas avec ctx lui-même', async () => {
const paroleDocuments = {
findOne: vi.fn(async ({documentId}) => ({id: 1, documentId, titre: 'Test'}))
}
const strapi = {
contentType: vi.fn(() => ({uid: 'api::parole.parole', kind: 'collectionType'})),
documents: vi.fn(uid => {
if (uid === 'api::parole.parole') return paroleDocuments
throw new Error(`unexpected uid: ${uid}`)
})
}
const controller = createController({strapi})
const ctx = {params: {id: 'doc-123'}}
const result = await controller.findOne(ctx)
expect(paroleDocuments.findOne).toHaveBeenCalledWith({
documentId: 'doc-123',
populate: ['artistes']
})
expect(result).toEqual({id: 1, documentId: 'doc-123', titre: 'Test'})
})
})
describe('parole.create', () => {
it('crée la parole quand le user et l\'artiste existent', async () => {
const {strapi, paroleDocuments} = buildStrapi({dbUser, artiste})
+2 -1
View File
@@ -44,7 +44,8 @@ module.exports = createCoreController('api::parole.parole', ({strapi}) => ({
return ctx.send(result)
},
async findOne(documentId) {
async findOne(ctx) {
const {id: documentId} = ctx.params
const parole = await strapi.documents('api::parole.parole').findOne({
documentId,
populate: ['artistes']