@openneuro/server 4.47.4 → 4.47.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openneuro/server",
-  "version": "4.47.4",
+  "version": "4.47.6",
   "description": "Core service for the OpenNeuro platform.",
   "license": "MIT",
   "main": "src/server.js",
@@ -21,7 +21,7 @@
     "@elastic/elasticsearch": "8.13.1",
     "@graphql-tools/schema": "^10.0.0",
     "@keyv/redis": "^4.5.0",
-    "@openneuro/search": "^4.47.4",
+    "@openneuro/search": "^4.47.6",
     "@sentry/node": "^10.37.0",
     "@sentry/profiling-node": "^10.37.0",
     "base64url": "^3.0.0",
@@ -89,5 +89,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "fee430e60d713799a1c304676d0eaa758fa578ff"
+  "gitHead": "e00e369a538900524544a396e7fd60e5e41d715e"
 }

package/src/datalad/__tests__/dataset.spec.ts

@@ -1,4 +1,3 @@
-/* eslint-disable @typescript-eslint/no-explicit-any */
 import { vi } from "vitest"
 import request from "superagent"
 import { createDataset, datasetsFilter, testBlacklist } from "../dataset"

package/src/graphql/resolvers/__tests__/user.spec.ts

@@ -10,7 +10,7 @@ import {
 import { MongoMemoryServer } from "mongodb-memory-server"
 import mongoose, { Types } from "mongoose"
 import User from "../../../models/user"
-import { users } from "../user.js"
+import { user, users } from "../user.js"
 import type { GraphQLContext } from "../user.js"
 
 vi.mock("ioredis")
@@ -132,6 +132,27 @@ describe("user resolvers", () => {
     await User.insertMany(testUsersSeedData)
   })
 
+  describe("user()", () => {
+    it("does not crash when userInfo is undefined (anonymous request)", async () => {
+      const result = await user(null, { id: "u1" }, {})
+      expect(result).not.toBeNull()
+      expect(result!.id).toBe("u1")
+      // Email should be hidden for anonymous users
+      expect(result!.email).toBeUndefined()
+    })
+
+    it("does not crash when context is completely missing", async () => {
+      const result = await user(null, { id: "u1" }, undefined)
+      expect(result).not.toBeNull()
+      expect(result!.id).toBe("u1")
+    })
+
+    it("returns null for non-existent user", async () => {
+      const result = await user(null, { id: "nonexistent" }, {})
+      expect(result).toBeNull()
+    })
+  })
+
   describe("users()", () => {
     it("returns sanitized data for non-admin context", async () => {
       const result = await users(null, {}, nonAdminContext)

package/src/graphql/resolvers/user.ts

@@ -34,7 +34,7 @@ export async function user(
   { id },
   { userInfo }: { userInfo?: Record<string, unknown> } = {},
 ): Promise<Partial<GraphQLUserType> | null> {
-  if (userInfo.reviewer) {
+  if (userInfo?.reviewer) {
     const oneWeekAgo = new Date()
     oneWeekAgo.setDate(oneWeekAgo.getDate() - 7)
     return {