From 86433478ec24dd58de4f6dcbd6f8560836eabe30 Mon Sep 17 00:00:00 2001
From: elweyn <heine.hannes@gmail.com>
Date: Tue, 12 Jul 2022 09:38:19 +0200
Subject: [PATCH] Test that only the user that created the contribution can
 update it with the updateContribution mutation.

---
 .../resolver/ContributionResolver.test.ts     | 31 +++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/backend/src/graphql/resolver/ContributionResolver.test.ts b/backend/src/graphql/resolver/ContributionResolver.test.ts
index 697c5ae43..41b5808a1 100644
--- a/backend/src/graphql/resolver/ContributionResolver.test.ts
+++ b/backend/src/graphql/resolver/ContributionResolver.test.ts
@@ -285,6 +285,37 @@ describe('ContributionResolver', () => {
           )
         })
       })
+
+      describe('wrong user tries to update the contribution', () => {
+        beforeAll(async () => {
+          await query({
+            query: login,
+            variables: { email: 'peter@lustig.de', password: 'Aa12345_' },
+          })
+        })
+
+        it('throws an error', async () => {
+          await expect(
+            mutate({
+              mutation: updateContribution,
+              variables: {
+                contributionId: result.data.createContribution.id,
+                amount: 10.0,
+                memo: 'Test env contribution',
+                creationDate: new Date().toString(),
+              },
+            }),
+          ).resolves.toEqual(
+            expect.objectContaining({
+              errors: [
+                new GraphQLError(
+                  'user of the pending contribution and send user does not correspond',
+                ),
+              ],
+            }),
+          )
+        })
+      })
     })
   })
 })