@openneuro/server 4.47.5 → 4.47.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openneuro/server",
-  "version": "4.47.5",
+  "version": "4.47.7",
   "description": "Core service for the OpenNeuro platform.",
   "license": "MIT",
   "main": "src/server.js",
@@ -21,7 +21,7 @@
     "@elastic/elasticsearch": "8.13.1",
     "@graphql-tools/schema": "^10.0.0",
     "@keyv/redis": "^4.5.0",
-    "@openneuro/search": "^4.47.5",
+    "@openneuro/search": "^4.47.7",
     "@sentry/node": "^10.37.0",
     "@sentry/profiling-node": "^10.37.0",
     "base64url": "^3.0.0",
@@ -89,5 +89,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "aad83019a0fe480d21d5997a58c8c7fe6c39cfdb"
+  "gitHead": "af17c267fa700dff5b13d1b31aaf4f89c0853165"
 }

package/src/datalad/__tests__/dataset.spec.ts

@@ -1,4 +1,3 @@
-/* eslint-disable @typescript-eslint/no-explicit-any */
 import { vi } from "vitest"
 import request from "superagent"
 import { createDataset, datasetsFilter, testBlacklist } from "../dataset"

package/src/graphql/resolvers/__tests__/user.spec.ts

@@ -10,7 +10,8 @@ import {
 import { MongoMemoryServer } from "mongodb-memory-server"
 import mongoose, { Types } from "mongoose"
 import User from "../../../models/user"
-import { users } from "../user.js"
+import DatasetEvent from "../../../models/datasetEvents"
+import { notifications, user, users } from "../user.js"
 import type { GraphQLContext } from "../user.js"
 
 vi.mock("ioredis")
@@ -132,6 +133,27 @@ describe("user resolvers", () => {
     await User.insertMany(testUsersSeedData)
   })
 
+  describe("user()", () => {
+    it("does not crash when userInfo is undefined (anonymous request)", async () => {
+      const result = await user(null, { id: "u1" }, {})
+      expect(result).not.toBeNull()
+      expect(result!.id).toBe("u1")
+      // Email should be hidden for anonymous users
+      expect(result!.email).toBeUndefined()
+    })
+
+    it("does not crash when context is completely missing", async () => {
+      const result = await user(null, { id: "u1" }, undefined)
+      expect(result).not.toBeNull()
+      expect(result!.id).toBe("u1")
+    })
+
+    it("returns null for non-existent user", async () => {
+      const result = await user(null, { id: "nonexistent" }, {})
+      expect(result).toBeNull()
+    })
+  })
+
   describe("users()", () => {
     it("returns sanitized data for non-admin context", async () => {
       const result = await users(null, {}, nonAdminContext)
@@ -364,4 +386,57 @@ describe("user resolvers", () => {
       expect(result.totalCount).toBe(3) // u1, u4, u6 are admins
     })
   })
+
+  describe("notifications()", () => {
+    it("returns empty array for reviewer users", async () => {
+      const result = await notifications(
+        { id: "reviewer" },
+        null,
+        { userInfo: { reviewer: true, admin: false, blocked: false } },
+      )
+      expect(result).toEqual([])
+    })
+
+    it("does not crash when userInfo is undefined", async () => {
+      await expect(
+        notifications({ id: "u1" }, null, { userInfo: undefined }),
+      ).rejects.toThrow("Not authorized to view these notifications.")
+    })
+
+    it("returns notifications for a user viewing their own", async () => {
+      await DatasetEvent.create({
+        id: "event-1",
+        datasetId: "ds000001",
+        userId: "u1",
+        timestamp: new Date(),
+        event: {
+          type: "contributorCitation",
+          datasetId: "ds000001",
+          addedBy: "u2",
+          targetUserId: "u1",
+          contributorData: { name: "Test User" },
+        },
+        success: true,
+        note: "Added as contributor",
+      })
+      const result = await notifications(
+        { id: "u1" },
+        null,
+        { userInfo: { id: "u1", admin: false, userId: "u1" } },
+      )
+      expect(result.length).toBe(1)
+      expect(result[0].id).toBe("event-1")
+      expect(result[0].notificationStatus.status).toBe("UNREAD")
+    })
+
+    it("throws authorization error for regular user viewing another user's notifications", async () => {
+      await expect(
+        notifications(
+          { id: "u1" },
+          null,
+          { userInfo: { id: "u2", admin: false, userId: "u2" } },
+        ),
+      ).rejects.toThrow("Not authorized to view these notifications.")
+    })
+  })
 })

package/src/graphql/resolvers/user.ts

@@ -34,7 +34,7 @@ export async function user(
   { id },
   { userInfo }: { userInfo?: Record<string, unknown> } = {},
 ): Promise<Partial<GraphQLUserType> | null> {
-  if (userInfo.reviewer) {
+  if (userInfo?.reviewer) {
     const oneWeekAgo = new Date()
     oneWeekAgo.setDate(oneWeekAgo.getDate() - 7)
     return {
@@ -279,7 +279,7 @@ export async function notifications(obj, _, { userInfo }) {
   const userId = obj.id
 
   // Reviewers never have notifications
-  if (userInfo.reviewer) {
+  if (userInfo?.reviewer) {
     return []
   }