fix issue with remove item api call (#102)

* fix issue with remove item api call * bump dep ver * bump ver Co-authored-by: Kevin <[email protected]>
51ngul4r1ty · May 29, 2020 · da9b7a3 · da9b7a3
1 parent e5f41c0
commit da9b7a3
Show file tree

Hide file tree

Showing 3 changed files with 21 additions and 8 deletions.
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "atoll",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "author": {
     "name": "Kevin Berry",
     "email": "[email protected]"
@@ -59,7 +59,7 @@
     "check": "node ./scripts/check-package-json.js"
   },
   "dependencies": {
-    "@atoll/shared": "0.8.0",
+    "@atoll/shared": "0.8.1",
     "@flopflip/memory-adapter": "1.6.0",
     "@flopflip/react-broadcast": "10.1.11",
     "axios": "0.19.2",

diff --git a/src/server/api/handlers/backlogItems.ts b/src/server/api/handlers/backlogItems.ts
@@ -87,7 +87,7 @@ export const backlogItemsDeleteHandler = async (req: Request, res: Response) =>
         transaction = await sequelize.transaction({ isolationLevel: Transaction.ISOLATION_LEVELS.SERIALIZABLE });
         await sequelize.query('SET CONSTRAINTS "backlogitemrank_backlogitemId_fkey" DEFERRED;', { transaction });
         await sequelize.query('SET CONSTRAINTS "backlogitemrank_nextbacklogitemId_fkey" DEFERRED;', { transaction });
-        const id = req.params.backlogItemId;
+        const id = req.params.itemId;
         let abort = true;
         let backlogItem: BacklogItemModel = null;
         let backlogItemTyped: ApiBacklogItem = null;
@@ -244,9 +244,22 @@ export const backlogItemsPostHandler = async (req: Request, res: Response) => {
 };
 
 export const backlogItemPutHandler = async (req: Request, res: Response) => {
+    const queryParamItemId = req.params.itemId;
+    if (!queryParamItemId) {
+        respondWithFailedValidation(res, "Item ID is required in URI path for this operation");
+        return;
+    }
+    const bodyItemId = req.body.id;
+    if (queryParamItemId != bodyItemId) {
+        respondWithFailedValidation(
+            res,
+            `Item ID in URI path (${queryParamItemId}) should match Item ID in payload (${bodyItemId})`
+        );
+        return;
+    }
     try {
         const backlogItem = await BacklogItemModel.findOne({
-            where: { id: req.body.id }
+            where: { id: bodyItemId }
         });
         if (!backlogItem) {
             respondWithNotFound(res, `Unable to find item to update with ID ${req.body.id}`);