Improving user endpoints; error handling mostly

Author: javieraviles

src/controller/user.ts

@@ -1,5 +1,5 @@
 import { BaseContext } from 'koa';
-import { getManager, Repository } from 'typeorm';
+import { getManager, Repository, Not, Equal } from 'typeorm';
 import { validate, ValidationError } from 'class-validator';
 import { User } from '../entity/user';
 
@@ -13,7 +13,8 @@ export default class UserController {
         // load all users
         const users: User[] = await userRepository.find();
 
-        // return loaded users
+        // return OK status code and loaded users array
+        ctx.status = 200;
         ctx.body = users;
     }
 
@@ -23,10 +24,11 @@ export default class UserController {
         const userRepository: Repository<User> = getManager().getRepository(User);
 
         // load user by id
-        const user: User = await userRepository.findOne(ctx.params.id);
+        const user: User = await userRepository.findOne(+ctx.params.id || 0);
 
         if (user) {
-            // return loaded user
+            // return OK status code and loaded user object
+            ctx.status = 200;
             ctx.body = user;
         } else {
             // return a BAD REQUEST status code and error message
@@ -50,13 +52,17 @@ export default class UserController {
         const errors: ValidationError[] = await validate(userToBeSaved); // errors is an array of validation errors
 
         if (errors.length > 0) {
-            // return bad request status code and errors array
+            // return BAD REQUEST status code and errors array
             ctx.status = 400;
             ctx.body = errors;
+        } else if ( await userRepository.findOne({ email: userToBeSaved.email}) ) {
+            // return BAD REQUEST status code and email already exists error
+            ctx.status = 400;
+            ctx.body = 'The specified e-mail address already exists';
         } else {
             // save the user contained in the POST body
             const user = await userRepository.save(userToBeSaved);
-            // return created status code and updated user
+            // return CREATED status code and updated user
             ctx.status = 201;
             ctx.body = user;
         }
@@ -67,34 +73,35 @@ export default class UserController {
         // get a user repository to perform operations with user
         const userRepository: Repository<User> = getManager().getRepository(User);
 
-        // check if a user with the specified id exists
-        if (await userRepository.findOne(ctx.params.id)) {
-            // update the user by specified id
-            // build up entity user to be updated
-            const userToBeUpdated: User = new User();
-            userToBeUpdated.id = +ctx.params.id;
-            userToBeUpdated.name = ctx.request.body.name;
-            userToBeUpdated.email = ctx.request.body.email;
-
-            // validate user entity
-            const errors: ValidationError[] = await validate(userToBeUpdated); // errors is an array of validation errors
-
-            if (errors.length > 0) {
-                // return bad request status code and errors array
-                ctx.status = 400;
-                ctx.body = errors;
-            } else {
-                // save the user contained in the PUT body
-                const user = await userRepository.save(userToBeUpdated);
-                // return created status code and updated user
-                ctx.status = 201;
-                ctx.body = user;
-            }
+        // update the user by specified id
+        // build up entity user to be updated
+        const userToBeUpdated: User = new User();
+        userToBeUpdated.id = +ctx.params.id || 0; // will always have a number, this will avoid errors
+        userToBeUpdated.name = ctx.request.body.name;
+        userToBeUpdated.email = ctx.request.body.email;
 
-        } else {
+        // validate user entity
+        const errors: ValidationError[] = await validate(userToBeUpdated); // errors is an array of validation errors
+
+        if (errors.length > 0) {
+            // return BAD REQUEST status code and errors array
+            ctx.status = 400;
+            ctx.body = errors;
+        } else if ( !await userRepository.findOne(userToBeUpdated.id) ) {
+            // check if a user with the specified id exists
             // return a BAD REQUEST status code and error message
             ctx.status = 400;
             ctx.body = 'The user you are trying to update doesn\'t exist in the db';
+        } else if ( await userRepository.findOne({ id: Not(Equal(userToBeUpdated.id)) , email: userToBeUpdated.email}) ) {
+            // return BAD REQUEST status code and email already exists error
+            ctx.status = 400;
+            ctx.body = 'The specified e-mail address already exists';
+        } else {
+            // save the user contained in the PUT body
+            const user = await userRepository.save(userToBeUpdated);
+            // return CREATED status code and updated user
+            ctx.status = 201;
+            ctx.body = user;
         }
 
     }
@@ -105,16 +112,21 @@ export default class UserController {
         const userRepository = getManager().getRepository(User);
 
         // find the user by specified id
-        const userToRemove: User = await userRepository.findOne(ctx.params.id);
-        if (userToRemove) {
+        const userToRemove: User = await userRepository.findOne(+ctx.params.id || 0);
+        if (!userToRemove) {
+            // return a BAD REQUEST status code and error message
+            ctx.status = 400;
+            ctx.body = 'The user you are trying to delete doesn\'t exist in the db';
+        } else if (+ctx.state.user.id !== userToRemove.id) {
+            // check user's token id and user id are the same
+            // if not, return a FORBIDDEN status code and error message
+            ctx.status = 403;
+            ctx.body = 'A user can only be deleted by himself';
+        } else {
             // the user is there so can be removed
             await userRepository.remove(userToRemove);
             // return a NO CONTENT status code
             ctx.status = 204;
-        } else {
-            // return a BAD REQUEST status code and error message
-            ctx.status = 400;
-            ctx.body = 'The user you are trying to delete doesn\'t exist in the db';
         }
 
     }