diff --git a/services/users.js b/services/users.js index da3b23bc6..de9678089 100644 --- a/services/users.js +++ b/services/users.js @@ -844,6 +844,9 @@ module.exports = class UsersService { static ignoreUsers(userId, usersToIgnore) { assert(Array.isArray(usersToIgnore), 'usersToIgnore is an array'); assert(usersToIgnore.every(u => typeof u === 'string'), 'usersToIgnore is an array of string user IDs'); + if (usersToIgnore.includes(userId)) { + throw new Error('Users cannot ignore themselves'); + } // TODO: For each usersToIgnore, make sure they exist? return UserModel.update({id: userId}, { diff --git a/test/graph/mutations/ignoreUser.js b/test/graph/mutations/ignoreUser.js index fc6035839..c5633bfb4 100644 --- a/test/graph/mutations/ignoreUser.js +++ b/test/graph/mutations/ignoreUser.js @@ -53,6 +53,22 @@ describe('graph.mutations.ignoreUser', () => { expect(myIgnoredUsers[0].username).to.equal(userToIgnore.username); }); + it('users cannot ignore themselves', async () => { + const user = await UsersService.createLocalUser('usernameA@example.com', 'password', 'usernameA'); + const context = new Context({user}); + const ignoreUserResponse = await graphql(schema, ignoreUserMutation, {}, context, {id: user.id}); + expect(ignoreUserResponse.errors).to.not.be.empty; + + // now check my ignored users + const myIgnoredUsersResponse = await graphql(schema, getMyIgnoredUsersQuery, {}, context, {}); + if (myIgnoredUsersResponse.errors && myIgnoredUsersResponse.errors.length) { + console.error(myIgnoredUsersResponse.errors); + } + expect(myIgnoredUsersResponse.errors).to.be.empty; + const myIgnoredUsers = myIgnoredUsersResponse.data.myIgnoredUsers; + expect(myIgnoredUsers.length).to.equal(0); + }); + }); describe('graph.mutations.stopIgnoringUser', () => {