fix(core): Do not allow updating products not in active channel

vendure-ecommerce · Jan 28, 2021 · 4b2fac7 · 4b2fac7
1 parent d880f8e
commit 4b2fac7
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 1 deletion.
diff --git a/packages/core/e2e/product-channel.e2e-spec.ts b/packages/core/e2e/product-channel.e2e-spec.ts
@@ -20,6 +20,7 @@ import {
     ProductVariantFragment,
     RemoveProductsFromChannel,
     RemoveProductVariantsFromChannel,
+    UpdateProduct,
 } from './graphql/generated-e2e-admin-types';
 import {
     ASSIGN_PRODUCTVARIANT_TO_CHANNEL,
@@ -32,6 +33,7 @@ import {
     GET_PRODUCT_WITH_VARIANTS,
     REMOVE_PRODUCTVARIANT_FROM_CHANNEL,
     REMOVE_PRODUCT_FROM_CHANNEL,
+    UPDATE_PRODUCT,
 } from './graphql/shared-definitions';
 import { assertThrowsWithMessage } from './utils/assert-throws-with-message';
 
@@ -470,4 +472,19 @@ describe('ChannelAware Products and ProductVariants', () => {
             expect(product?.variants[0].channels.map(c => c.id).sort()).toEqual(['T_1', 'T_2']);
         });
     });
+
+    describe('updating Product in sub-channel', () => {
+        it(
+            'throws if attempting to update a Product which is not assigned to that Channel',
+            assertThrowsWithMessage(async () => {
+                adminClient.setChannelToken(SECOND_CHANNEL_TOKEN);
+                await adminClient.query<UpdateProduct.Mutation, UpdateProduct.Variables>(UPDATE_PRODUCT, {
+                    input: {
+                        id: 'T_2',
+                        translations: [{ languageCode: LanguageCode.en, name: 'xyz' }],
+                    },
+                });
+            }, `No Product with the id '2' could be found`),
+        );
+    });
 });
diff --git a/packages/core/src/service/services/product.service.ts b/packages/core/src/service/services/product.service.ts
@@ -165,7 +165,7 @@ export class ProductService {
     }
 
     async update(ctx: RequestContext, input: UpdateProductInput): Promise<Translated<Product>> {
-        await this.connection.getEntityOrThrow(ctx, Product, input.id);
+        await this.connection.getEntityOrThrow(ctx, Product, input.id, { channelId: ctx.channelId });
         await this.slugValidator.validateSlugs(ctx, input, ProductTranslation);
         const product = await this.translatableSaver.update({
             ctx,