From e2572947956b8101901359ba4e46ff9478b909be Mon Sep 17 00:00:00 2001
From: Markus Kahl <machisuji@gmail.com>
Date: Thu, 23 Mar 2017 13:43:32 +0000
Subject: [PATCH] validate project if set

---
 app/contracts/queries/base_contract.rb            |  6 ++++++
 config/locales/en.yml                             |  2 ++
 spec/requests/api/v3/queries/create_query_spec.rb | 15 +++------------
 3 files changed, 11 insertions(+), 12 deletions(-)

diff --git a/app/contracts/queries/base_contract.rb b/app/contracts/queries/base_contract.rb
index 5bae4e9102..8997ec3107 100644
--- a/app/contracts/queries/base_contract.rb
+++ b/app/contracts/queries/base_contract.rb
@@ -45,10 +45,16 @@ module Queries
 
     attr_reader :user
 
+    validate :validate_project
+
     def initialize(query, user)
       super query
 
       @user = user
     end
+
+    def validate_project
+      errors.add :project, :error_not_found if project_id && !Project.exists?(project_id)
+    end
   end
 end
diff --git a/config/locales/en.yml b/config/locales/en.yml
index c9ef4ca8a9..910a3e5bf1 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -253,6 +253,8 @@ en:
       models:
         "queries/create_contract":
           attributes:
+            project:
+              error_not_found: "not found"
             public:
               error_unauthorized: "- The user has no permission to create public queries."
         "relations/base_contract":
diff --git a/spec/requests/api/v3/queries/create_query_spec.rb b/spec/requests/api/v3/queries/create_query_spec.rb
index 0a6669c7b6..1312ce4e36 100644
--- a/spec/requests/api/v3/queries/create_query_spec.rb
+++ b/spec/requests/api/v3/queries/create_query_spec.rb
@@ -134,22 +134,13 @@ describe "POST /api/v3/queries", type: :request do
       JSON.parse response.body
     end
 
-    it "yields a 404 error given an unknown user" do
-      params[:_links][:user][:href] = "/api/v3/users/#{user.id}352"
-
-      post!
-
-      expect(response.status).to eq 404
-      expect(json["message"]).to eq "User #{user.id}352 not found"
-    end
-
-    it "yields a 404 error given an unknown project" do
+    it "yields a 422 error given an unknown project" do
       params[:_links][:project][:href] = "/api/v3/projects/#{project.id}42"
 
       post!
 
-      expect(response.status).to eq 404
-      expect(json["message"]).to eq "Project #{project.id}42 not found"
+      expect(response.status).to eq 422
+      expect(json["message"]).to eq "Project not found"
     end
 
     it "yields a 422 error given an unknown operator" do