Merge 35bab96 into df1d41e

src/Curation/Curation.router.spec.ts

@@ -360,6 +360,40 @@ describe('when handling a request', () => {
       })
     })
 
+    describe('when the new assignee is not a committee member', () => {
+      let req: AuthRequest
+
+      beforeEach(() => {
+        req = {
+          auth: { ethAddress: 'ethAddress' },
+          params: {
+            id: 'some id',
+          },
+          body: {
+            curation: {
+              assignee: '0xnotCommitteeMember',
+              status: CurationStatus.PENDING,
+            },
+          },
+        } as any
+      })
+
+      describe('when updating a collection curation', () => {
+        beforeEach(() => {
+          service = mockServiceWithAccess(CollectionCuration, true)
+          jest
+            .spyOn(service, 'getLatestById')
+            .mockResolvedValueOnce({ id: 'curationId' } as any)
+        })
+
+        it('should reject with an error message saying the assignee is not a committee member', async () => {
+          await expect(
+            router.updateCollectionCuration(req)
+          ).rejects.toThrowError('The assignee must be a committee member')
+        })
+      })
+    })
+
     describe('when the payload is invalid', () => {
       let req: AuthRequest
 
@@ -566,18 +600,24 @@ describe('when handling a request', () => {
             })
           })
 
-          it('should resolve with the updated curation', async () => {
-            await expect(
-              router.updateCollectionCuration(req)
-            ).resolves.toStrictEqual(expectedCuration)
-          })
+          describe('and the assignee is a committee member', () => {
+            beforeEach(() => {
+              mockIsCommitteeMember.mockResolvedValueOnce(true)
+            })
 
-          it('should call the update method with the right data', async () => {
-            await router.updateCollectionCuration(req)
+            it('should resolve with the updated curation', async () => {
+              await expect(
+                router.updateCollectionCuration(req)
+              ).resolves.toStrictEqual(expectedCuration)
+            })
 
-            expect(updateSpy).toHaveBeenCalledWith('curationId', {
-              assignee: assignee.toLowerCase(),
-              updated_at: expect.any(Date),
+            it('should call the update method with the right data', async () => {
+              await router.updateCollectionCuration(req)
+
+              expect(updateSpy).toHaveBeenCalledWith('curationId', {
+                assignee: assignee.toLowerCase(),
+                updated_at: expect.any(Date),
+              })
             })
           })
         })
@@ -605,6 +645,8 @@ describe('when handling a request', () => {
               .spyOn(service, 'updateById')
               .mockResolvedValueOnce(expectedCuration)
 
+            mockIsCommitteeMember.mockResolvedValueOnce(true)
+
             updateSpy = jest
               .spyOn(service, 'updateById')
               .mockResolvedValueOnce(expectedCuration)

src/Curation/Curation.router.ts

@@ -384,6 +384,19 @@ export class CurationRouter extends Router {
       )
     }
 
+    if (curationJSON.assignee) {
+      const isAssigneeCommitteeMember = await isCommitteeMember(
+        curationJSON.assignee.toLowerCase()
+      )
+      if (!isAssigneeCommitteeMember) {
+        throw new HTTPError(
+          'The assignee must be a committee member',
+          { id },
+          STATUS_CODES.unauthorized
+        )
+      }
+    }
+
     let fieldsToUpdate: Partial<
       CollectionCurationAttributes & ItemCurationAttributes
     > = {