Files
task-stream/libs/api/tracker/application/src/lib/queries/get-project.query-handler.ts
Josep Piguillem 71dc2d6f2d fix(api): typed OpenAPI query params and not-found messages that hide private projects
- Query DTO properties with a default value (limit, offset, days, perColumn,
  assignedToMe, search, archived, requiresReason, force) were documented as
  `object` in openapi.json, which broke generated clients. They now declare
  their type explicitly.
- Reading a private project, ticket, release or its comments without access
  answered "Project <internal id> not found", confirming the project exists.
  ReadAccess now reports what the caller asked for (e2e covered).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-07 18:59:38 +02:00

28 lines
1.0 KiB
TypeScript

import { IQueryHandler, QueryHandler } from '@nestjs/cqrs';
import { ProjectReadModel } from '@task-stream/api/tracker/domain';
import { FindProjectsRepository } from '../ports/find-projects.repository';
import { ReadAccess, UUID } from './read-access';
import { GetProjectQuery } from './get-project.query';
@QueryHandler(GetProjectQuery)
export class GetProjectQueryHandler
implements IQueryHandler<GetProjectQuery, ProjectReadModel>
{
constructor(
private readonly findProjects: FindProjectsRepository,
private readonly access: ReadAccess,
) {}
async execute(query: GetProjectQuery): Promise<ProjectReadModel> {
const project = UUID.test(query.idOrKey)
? await this.findProjects.findById(query.idOrKey)
: await this.findProjects.findByKey(query.idOrKey.toUpperCase());
const found = this.access.assertFound(project, 'Project', query.idOrKey);
await this.access.assertCanView(found.id, query.viewerId, {
entity: 'Project',
ref: query.idOrKey,
});
return found;
}
}