Adds test for info exposure via patch user endpoint

application/backend/src/controllers/AuthController.test.ts

@@ -178,8 +178,7 @@ describe('AuthController', () => {
       expect(body.message).toBe('Validation Failed')
       expect(body.details).toEqual({
         'bodyRequest.email': {
-          message: 'Please provide valid email',
-          value: registerRequest.email,
+          message: 'Invalid value provided',
         },
       })
     })
@@ -203,8 +202,7 @@ describe('AuthController', () => {
       expect(body.message).toBe('Validation Failed')
       expect(body.details).toEqual({
         'bodyRequest.password': {
-          message: 'Password must be at least 8 characters',
-          value: 'pass',
+          message: 'Invalid value provided',
         },
       })
     })
@@ -227,10 +225,10 @@ describe('AuthController', () => {
       const body = response.body
       expect(body.message).toBe('Validation Failed')
       expect(body.details).toEqual({
-        'bodyRequest.firstName': { message: 'minLength 1', value: '' },
-        'bodyRequest.lastName': { message: 'minLength 1', value: '' },
-        'bodyRequest.email': { message: 'Please provide valid email', value: '' },
-        'bodyRequest.password': { message: 'Password must be at least 8 characters', value: '' },
+        'bodyRequest.firstName': { message: 'Invalid value provided' },
+        'bodyRequest.lastName': { message: 'Invalid value provided' },
+        'bodyRequest.email': { message: 'Invalid value provided' },
+        'bodyRequest.password': { message: 'Invalid value provided' },
       })
     })
 
@@ -252,8 +250,8 @@ describe('AuthController', () => {
       const body = response.body
       expect(body.message).toBe('Validation Failed')
       expect(body.details).toEqual({
-        Uppercase: { message: 'Password must contain at least one uppercase letter' },
-        Number: { message: 'Password must contain at least one number' },
+        Uppercase: { message: 'Invalid value provided' },
+        Number: { message: 'Invalid value provided' },
       })
     })
   })
@@ -334,8 +332,8 @@ describe('AuthController', () => {
       expect(registerParticipantBody.message).toEqual('Validation Failed')
       expect(registerParticipantBody.token).toBe(undefined)
       expect(registerParticipantBody.details).toEqual({
-        Uppercase: { message: 'Password must contain at least one uppercase letter' },
-        Number: { message: 'Password must contain at least one number' },
+        Uppercase: { message: 'Invalid value provided' },
+        Number: { message: 'Invalid value provided' },
       })
     })
 
@@ -363,12 +361,10 @@ describe('AuthController', () => {
       expect(registerParticipantBody.token).toBe(undefined)
       expect(registerParticipantBody.details).toEqual({
         'bodyRequest.lastName': {
-          message: 'minLength 1',
-          value: '',
+          message: 'Invalid value provided',
         },
         'bodyRequest.mobile': {
-          message: 'please provide valid phone number',
-          value: '12341234',
+          message: 'Invalid value provided',
         },
       })
     })
@@ -565,7 +561,7 @@ describe('AuthController', () => {
       const body = response.body
       expect(body.message).toBe('Validation Failed')
       expect(body.details).toEqual({
-        'bodyRequest.email': { message: 'Please provide valid email', value: '' },
+        'bodyRequest.email': { message: 'Invalid value provided' },
       })
     })
 
@@ -581,7 +577,7 @@ describe('AuthController', () => {
       const body = response.body
       expect(body.message).toBe('Validation Failed')
       expect(body.details).toEqual({
-        'bodyRequest.email': { message: 'Please provide valid email', value: loginRequest.email },
+        'bodyRequest.email': { message: 'Invalid value provided' },
       })
     })
     it('Should return an otp token if otp is enabled', async () => {

application/backend/src/controllers/UsersController.test.ts

@@ -202,6 +202,36 @@ describe('UsersController', () => {
       expect(updatedUser?.firstName).toBe(newFirstName)
     })
 
+    it('should not expose information when updating a user', async () => {
+      const userId: number = PARTICIPANT_UNANSWERED_ID
+
+      // Get existing user details
+      const existingUser = await prisma.user.findFirst({ where: { id: userId } })
+
+      const testUser: RegisterRequest = {
+        firstName: 'Test',
+        lastName: 'User',
+        email: 'test2@example.com',
+        password: 'Password123',
+        role: Role.Participant,
+      }
+
+      expect(existingUser?.email).toBe(testUser.email)
+      expect(existingUser?.firstName).toBe(testUser.firstName)
+      expect(existingUser?.lastName).toBe(testUser.lastName)
+      expect(existingUser?.role).toBe(testUser.role)
+
+      const response = await request(app)
+        .patch(`/users/${userId}`)
+        .set({ Authorization: `Bearer ${orgAdminToken}` })
+        .send({ role: 'ThisIsDefinitelyNotARole' })
+
+      expect(response.status).toBe(422)
+      expect(response.body.details['bodyRequest.role'].message).not.toMatch(
+        /should be one of the following; \['OperatorAdmin'\]/,
+      )
+    })
+
     it('should return an error for a non-existent user', async () => {
       const userId: number = 9999
       const newFirstName: string = 'Updated'

application/backend/src/middlewares/ErrorHandler.ts

@@ -110,9 +110,15 @@ export function ErrorHandler(
 
   // Validation Errors
   if (err instanceof ValidateError) {
+    const sanitisedDetails: Record<string, { message: string }> = {}
+    for (const [field] of Object.entries(err.fields)) {
+      sanitisedDetails[field] = {
+        message: 'Invalid value provided',
+      }
+    }
     const errorResponse: ValidateErrorResponse = {
       message: 'Validation Failed',
-      details: err?.fields,
+      details: sanitisedDetails,
     }
     logger.error({ ...errorResponse })
     return res.status(422).json(errorResponse)

application/backend/swagger.json

@@ -92,14 +92,7 @@
           "details"
         ],
         "type": "object",
-        "additionalProperties": false,
-        "example": {
-          "message": "Validation Failed",
-          "bodyRequest.firstName": {
-            "message": "minLength 1",
-            "value": ""
-          }
-        }
+        "additionalProperties": false
       },
       "UnprocessableError": {
         "properties": {

application/common/types/api/errors.ts

@@ -36,7 +36,6 @@ export interface UnauthorizedErrorResponse {
  *  "message": "Validation Failed",
  *  "bodyRequest.firstName": {
  *    "message": "minLength 1",
- *    "value": ""
  *   }
  * }
  */