diff --git a/backend/src/graphql/resolver/ContributionResolver.test.ts b/backend/src/graphql/resolver/ContributionResolver.test.ts index 6d3f29280..490f5a4a7 100644 --- a/backend/src/graphql/resolver/ContributionResolver.test.ts +++ b/backend/src/graphql/resolver/ContributionResolver.test.ts @@ -2042,6 +2042,50 @@ describe('ContributionResolver', () => { }), ) }) + + describe('user tries to update admin contribution', () => { + beforeAll(async () => { + await mutate({ + mutation: login, + variables: { email: 'bibi@bloxberg.de', password: 'Aa12345_' }, + }) + }) + + afterAll(async () => { + await mutate({ + mutation: login, + variables: { email: 'peter@lustig.de', password: 'Aa12345_' }, + }) + }) + + it('logs and throws "Cannot update contribution of moderator" error', async () => { + jest.clearAllMocks() + const adminContribution = await Contribution.findOne({ + where: { + moderatorId: admin.id, + userId: bibi.id, + }, + }) + await expect( + mutate({ + mutation: updateContribution, + variables: { + contributionId: (adminContribution && adminContribution.id) || -1, + amount: 100.0, + memo: 'Test Test Test', + creationDate: new Date().toString(), + }, + }), + ).resolves.toMatchObject({ + errors: [new GraphQLError('Cannot update contribution of moderator')], + }) + expect(logger.error).toBeCalledWith( + 'Cannot update contribution of moderator', + expect.any(Object), + bibi.id, + ) + }) + }) }) describe('second creation surpasses the available amount ', () => { diff --git a/backend/src/graphql/resolver/ContributionResolver.ts b/backend/src/graphql/resolver/ContributionResolver.ts index 1d3274b79..5969eaef2 100644 --- a/backend/src/graphql/resolver/ContributionResolver.ts +++ b/backend/src/graphql/resolver/ContributionResolver.ts @@ -201,6 +201,9 @@ export class ContributionResolver { user.id, ) } + if (contributionToUpdate.moderatorId) { + throw new LogError('Cannot update contribution of moderator', contributionToUpdate, user.id) + } if ( contributionToUpdate.contributionStatus !== ContributionStatus.IN_PROGRESS && contributionToUpdate.contributionStatus !== ContributionStatus.PENDING