Merge 68b91ce into 868f152

arborist/resource.go

@@ -264,6 +264,10 @@ func (resource *ResourceIn) createInDb(tx *sqlx.Tx) *ErrorResponse {
 }
 
 func (resource *ResourceIn) createRecursively(tx *sqlx.Tx) *ErrorResponse {
+	errResponse := resource.validate()
+	if errResponse != nil {
+		return errResponse
+	}
 	// arborist uses `/` for path separator; ltree in postgres uses `.`
 	path := formatPathForDb(resource.Path)
 	stmt := "INSERT INTO resource(path, description) VALUES ($1, $2)"

arborist/server.go

@@ -963,6 +963,17 @@ func (server *Server) handleUserRevokePolicy(w http.ResponseWriter, r *http.Requ
 
 func (server *Server) handleUserListResources(w http.ResponseWriter, r *http.Request) {
 	username := mux.Vars(r)["username"]
+
+	// check if user exists at all first
+	user, err := userWithName(server.db, username)
+	if user == nil || err != nil {
+		msg := fmt.Sprintf("no user found with username: `%s`", username)
+		errResponse := newErrorResponse(msg, 404, nil)
+		errResponse.log.write(server.logger)
+		_ = errResponse.write(w, r)
+		return
+	}
+
 	service := ""
 	serviceQS, ok := r.URL.Query()["service"]
 	if ok {