diff --git a/ghost/members-api/lib/controllers/RouterController.js b/ghost/members-api/lib/controllers/RouterController.js index b5af1d8599..3ef803d5a0 100644 --- a/ghost/members-api/lib/controllers/RouterController.js +++ b/ghost/members-api/lib/controllers/RouterController.js @@ -10,6 +10,7 @@ const messages = { notFound: 'Not Found.', offerNotFound: 'This offer does not exist.', offerArchived: 'This offer is archived.', + tierNotFound: 'This tier does not exist.', tierArchived: 'This tier is archived.', existingSubscription: 'A subscription exists for this Member.', unableToCheckout: 'Unable to initiate checkout session', @@ -258,9 +259,22 @@ module.exports = class RouterController { tier = await this._tiersService.api.read(offer.tier.id); cadence = offer.cadence; - } else { + } else if (tierId) { offer = null; - tier = await this._tiersService.api.read(tierId); + + try { + // If the tierId is not a valid ID, the following line will throw + tier = await this._tiersService.api.read(tierId); + + if (!tier) { + throw undefined; + } + } catch (err) { + throw new BadRequestError({ + message: tpl(messages.tierNotFound), + context: 'Tier with id "' + tierId + '" not found' + }); + } } if (tier.status === 'archived') { diff --git a/ghost/members-api/test/unit/lib/controllers/router.test.js b/ghost/members-api/test/unit/lib/controllers/router.test.js index ef1d5dd7fb..cd85e09321 100644 --- a/ghost/members-api/test/unit/lib/controllers/router.test.js +++ b/ghost/members-api/test/unit/lib/controllers/router.test.js @@ -162,7 +162,7 @@ describe('RouterController', function () { } }); - it('returns a BadRequestError if offer is not found', async function () { + it('returns a BadRequestError if offer is not found by offerId', async function () { offersAPI = { getOffer: sinon.stub().resolves(null) }; @@ -184,6 +184,56 @@ describe('RouterController', function () { assert.equal(error.context, 'Offer with id "invalid" not found'); } }); + + it('returns a BadRequestError if tier is not found by tierId', async function () { + tiersService = { + api: { + read: sinon.stub().resolves(null) + } + }; + + const routerController = new RouterController({ + tiersService, + paymentsService, + offersAPI, + stripeAPIService, + labsService + }); + + try { + await routerController._getSubscriptionCheckoutData({tierId: 'invalid', cadence: 'year'}); + + assert.fail('Expected function to throw BadRequestError'); + } catch (error) { + assert(error instanceof errors.BadRequestError, 'Error should be an instance of BadRequestError'); + assert.equal(error.context, 'Tier with id "invalid" not found'); + } + }); + + it('returns a BadRequestError if fetching tier by tierId throws', async function () { + tiersService = { + api: { + read: sinon.stub().rejects(new Error('Fail to fetch tier')) + } + }; + + const routerController = new RouterController({ + tiersService, + paymentsService, + offersAPI, + stripeAPIService, + labsService + }); + + try { + await routerController._getSubscriptionCheckoutData({tierId: 'invalid', cadence: 'year'}); + + assert.fail('Expected function to throw BadRequestError'); + } catch (error) { + assert(error instanceof errors.BadRequestError, 'Error should be an instance of BadRequestError'); + assert.equal(error.context, 'Tier with id "invalid" not found'); + } + }); }); afterEach(function () {