From 8c60df248292d349833ebdd85c0397ad5760be76 Mon Sep 17 00:00:00 2001
From: Laura Bergoens <laura.bergoens@pix.fr>
Date: Thu, 12 Dec 2024 11:22:43 +0100
Subject: [PATCH 1/3] bugfix(api): guard code against invalid values in tube
 repository

---
 .../infrastructure/repositories/tube-repository.js |  3 +++
 .../repositories/tube-repository_test.js           | 14 ++++++++++++++
 2 files changed, 17 insertions(+)

diff --git a/api/lib/infrastructure/repositories/tube-repository.js b/api/lib/infrastructure/repositories/tube-repository.js
index dd473bfbed5..e62313d5750 100644
--- a/api/lib/infrastructure/repositories/tube-repository.js
+++ b/api/lib/infrastructure/repositories/tube-repository.js
@@ -28,6 +28,9 @@ export async function list() {
 
 export async function findByNames({ tubeNames, locale }) {
   if (!config.featureToggles.useNewLearningContent) return oldTubeRepository.findByNames({ tubeNames, locale });
+  if (!tubeNames) {
+    return [];
+  }
   const ids = await knex.pluck('id').from(TABLE_NAME).whereIn('name', tubeNames).orderBy('name');
   const tubeDtos = await getInstance().loadMany(ids);
   return toDomainList(tubeDtos, locale);
diff --git a/api/tests/integration/infrastructure/repositories/tube-repository_test.js b/api/tests/integration/infrastructure/repositories/tube-repository_test.js
index ecea9bdfe32..8d0158a13e5 100644
--- a/api/tests/integration/infrastructure/repositories/tube-repository_test.js
+++ b/api/tests/integration/infrastructure/repositories/tube-repository_test.js
@@ -227,6 +227,20 @@ describe('Integration | Repository | tube-repository', function () {
           expect(tubes).to.deep.equal([]);
         });
       });
+
+      context('when invalid value provided for tubeNames argument', function () {
+        it('should return an empty array', async function () {
+          // when
+          const tubes1 = await tubeRepository.findByNames({ tubeNames: null });
+          const tubes2 = await tubeRepository.findByNames({ tubeNames: undefined });
+          const tubes3 = await tubeRepository.findByNames({ tubeNames: [] });
+
+          // then
+          expect(tubes1).to.deep.equal([]);
+          expect(tubes2).to.deep.equal([]);
+          expect(tubes3).to.deep.equal([]);
+        });
+      });
     });
 
     describe('#findByRecordIds', function () {

From b8d5e0d3dd437b6fe669d13d35f4a90350947ab9 Mon Sep 17 00:00:00 2001
From: Laura Bergoens <laura.bergoens@pix.fr>
Date: Thu, 12 Dec 2024 11:39:55 +0100
Subject: [PATCH 2/3] bugfix(api): guard code against invalid values in skill
 repository

---
 .../repositories/skill-repository_test.js     | 42 +++++++++++++++++++
 1 file changed, 42 insertions(+)

diff --git a/api/tests/shared/integration/infrastructure/repositories/skill-repository_test.js b/api/tests/shared/integration/infrastructure/repositories/skill-repository_test.js
index b6f46ac17c8..59eebeed3fb 100644
--- a/api/tests/shared/integration/infrastructure/repositories/skill-repository_test.js
+++ b/api/tests/shared/integration/infrastructure/repositories/skill-repository_test.js
@@ -617,6 +617,20 @@ describe('Integration | Repository | skill-repository', function () {
           ]);
         });
       });
+
+      context('when invalid value given for ids argument', function () {
+        it('should return an empty array', async function () {
+          // when
+          const skills1 = await skillRepository.findOperativeByIds(null);
+          const skills2 = await skillRepository.findOperativeByIds(undefined);
+          const skills3 = await skillRepository.findOperativeByIds([]);
+
+          // then
+          expect(skills1).to.deep.equal([]);
+          expect(skills2).to.deep.equal([]);
+          expect(skills3).to.deep.equal([]);
+        });
+      });
     });
 
     describe('#get', function () {
@@ -761,6 +775,20 @@ describe('Integration | Repository | skill-repository', function () {
           ]);
         });
       });
+
+      context('when invalid value given for ids argument', function () {
+        it('should return an empty array', async function () {
+          // when
+          const skills1 = await skillRepository.findActiveByRecordIds(null);
+          const skills2 = await skillRepository.findActiveByRecordIds(undefined);
+          const skills3 = await skillRepository.findActiveByRecordIds([]);
+
+          // then
+          expect(skills1).to.deep.equal([]);
+          expect(skills2).to.deep.equal([]);
+          expect(skills3).to.deep.equal([]);
+        });
+      });
     });
 
     describe('#findByRecordIds', function () {
@@ -846,6 +874,20 @@ describe('Integration | Repository | skill-repository', function () {
           ]);
         });
       });
+
+      context('when invalid value given for ids argument', function () {
+        it('should return an empty array', async function () {
+          // when
+          const skills1 = await skillRepository.findByRecordIds(null);
+          const skills2 = await skillRepository.findByRecordIds(undefined);
+          const skills3 = await skillRepository.findByRecordIds([]);
+
+          // then
+          expect(skills1).to.deep.equal([]);
+          expect(skills2).to.deep.equal([]);
+          expect(skills3).to.deep.equal([]);
+        });
+      });
     });
   }
 });

From eb385a37fd2410182981b274138595a938adbb84 Mon Sep 17 00:00:00 2001
From: Laura Bergoens <laura.bergoens@pix.fr>
Date: Thu, 12 Dec 2024 11:40:12 +0100
Subject: [PATCH 3/3] bugfix(api): guard code against invalid values in
 tutorial repository

---
 .../repositories/tutorial-repository_test.js  | 51 +++++++++++++++++++
 1 file changed, 51 insertions(+)

diff --git a/api/tests/devcomp/integration/infrastructure/repositories/tutorial-repository_test.js b/api/tests/devcomp/integration/infrastructure/repositories/tutorial-repository_test.js
index 63a5e86e6ac..a055c080336 100644
--- a/api/tests/devcomp/integration/infrastructure/repositories/tutorial-repository_test.js
+++ b/api/tests/devcomp/integration/infrastructure/repositories/tutorial-repository_test.js
@@ -170,6 +170,57 @@ describe('Integration | Repository | tutorial-repository', function () {
         expect(tutorials).to.have.lengthOf(1);
         expect(tutorials[0].tutorialEvaluation).to.deep.equal(tutorialEvaluation);
       });
+
+      it('should return empty array when invalid argument given for ids', async function () {
+        // given
+        const tutorialsList = [
+          {
+            duration: '00:00:54',
+            format: 'video',
+            link: 'https://tuto.fr',
+            source: 'tuto.fr',
+            title: 'tuto0',
+            id: 'recTutorial0',
+            skillId: undefined,
+            userSavedTutorial: undefined,
+            tutorialEvaluation: undefined,
+          },
+          {
+            duration: '00:01:54',
+            format: 'page',
+            link: 'https://tuto.com',
+            source: 'tuto.com',
+            title: 'tuto1',
+            id: 'recTutorial1',
+            skillId: undefined,
+            userSavedTutorial: undefined,
+            tutorialEvaluation: undefined,
+          },
+        ];
+
+        await mockLearningContent({
+          tutorials: tutorialsList,
+        });
+
+        // when
+        const tutorials1 = await tutorialRepository.findByRecordIdsForCurrentUser({
+          ids: [],
+          userId: null,
+        });
+        const tutorials2 = await tutorialRepository.findByRecordIdsForCurrentUser({
+          ids: null,
+          userId: null,
+        });
+        const tutorials3 = await tutorialRepository.findByRecordIdsForCurrentUser({
+          ids: undefined,
+          userId: null,
+        });
+
+        // then
+        expect(tutorials1).to.deep.equal([]);
+        expect(tutorials2).to.deep.equal([]);
+        expect(tutorials3).to.deep.equal([]);
+      });
     });
 
     describe('#findPaginatedFilteredForCurrentUser', function () {