diff --git a/services/web/app/src/Features/UserMembership/UserMembershipMiddleware.js b/services/web/app/src/Features/UserMembership/UserMembershipMiddleware.js index ef8f636409..55f68a8118 100644 --- a/services/web/app/src/Features/UserMembership/UserMembershipMiddleware.js +++ b/services/web/app/src/Features/UserMembership/UserMembershipMiddleware.js @@ -246,13 +246,39 @@ function fetchEntityConfig(entityName) { } } -// fetch the entity with id and config, and set it in the request -const fetchEntitySchema = z.object({ +const SlugEntitySchema = z.object({ + entityName: z.literal('publisher'), params: z.object({ - id: zz.objectId(), + id: z.string(), // slug }), }) +const PostgresIdEntitySchema = z.object({ + entityName: z.literal(['institution', 'team']), + params: z.object({ + id: z.coerce.number().positive(), + }), +}) + +const ObjectIdEntitySchema = z.object({ + entityName: z.literal([ + 'group', + 'groupAdmin', + 'groupManagers', + 'groupMember', + ]), + params: z.object({ + id: zz.coercedObjectId(), + }), +}) + +const fetchEntitySchema = z.discriminatedUnion('entityName', [ + SlugEntitySchema, + ObjectIdEntitySchema, + PostgresIdEntitySchema, +]) + +// fetch the entity with id and config, and set it in the request function fetchEntity() { return expressify(async (req, res, next) => { const { params } = validateReq(req, fetchEntitySchema) diff --git a/services/web/app/src/infrastructure/Validation.js b/services/web/app/src/infrastructure/Validation.js index 8c518d7f66..cb7db67af0 100644 --- a/services/web/app/src/infrastructure/Validation.js +++ b/services/web/app/src/infrastructure/Validation.js @@ -43,6 +43,11 @@ function validate(schema) { const zz = { objectId: () => z.string().refine(ObjectId.isValid, { message: 'invalid Mongo ObjectId' }), + coercedObjectId: () => + z + .string() + .refine(ObjectId.isValid, { message: 'invalid Mongo ObjectId' }) + .transform(val => new ObjectId(val)), } /**