From d6b9f58ffe937a531cddc4c5f131df4ddb6c79fd Mon Sep 17 00:00:00 2001
From: Aotokitsuruya <contact@aotoki.me>
Date: Mon, 18 Dec 2023 21:28:50 +0800
Subject: [PATCH] Closed #53, deliver puzzle should verify attendee in the
 event

---
 api/command/deliverPuzzle.ts        |  5 ++++
 features/puzzle_delivery.feature    | 36 ++++++++++++++++++++++-------
 worker/controller/puzzleDelivery.ts |  4 ++++
 3 files changed, 37 insertions(+), 8 deletions(-)

diff --git a/api/command/deliverPuzzle.ts b/api/command/deliverPuzzle.ts
index e38ffb2..b4eb4be 100644
--- a/api/command/deliverPuzzle.ts
+++ b/api/command/deliverPuzzle.ts
@@ -18,6 +18,7 @@ export type DeliverPuzzleOutput = {
 export class PuzzleReceiverNotFoundError extends Error {}
 export class PuzzleDelivererNotFoundError extends Error {}
 export class PuzzledAlreadyDeliveredError extends Error {}
+export class PuzzleAttendeeNotInEventError extends Error {}
 export class PuzzleConfigNotFoundError extends Error {}
 export class PuzzleStatsNotFoundError extends Error {}
 
@@ -53,6 +54,10 @@ export class DeliverPuzzleCommand implements Command<DeliverPuzzleInput, Deliver
       throw new PuzzleReceiverNotFoundError()
     }
 
+    if (attendee.eventId !== input.eventId) {
+      throw new PuzzleAttendeeNotInEventError()
+    }
+
     const status = await this.statuses.findById(input.token)
     if (!status) {
       throw new PuzzleReceiverNotFoundError()
diff --git a/features/puzzle_delivery.feature b/features/puzzle_delivery.feature
index e4de04b..5f19f51 100644
--- a/features/puzzle_delivery.feature
+++ b/features/puzzle_delivery.feature
@@ -12,8 +12,8 @@ Feature: Puzzle Delivery
     }
     """
     And there have some attendees
-      | token                                | event_id   | display_name |
-      | f185f505-d8c0-43ce-9e7b-bb9e8909072d | COSCUP2023 | Aotoki       |
+      | token                                | event_id | display_name |
+      | f185f505-d8c0-43ce-9e7b-bb9e8909072d | SITCON   | Aotoki       |
     When I make a POST request to "/event/puzzle/deliver?token=1024914b-ee65-4728-b687-8341f5affa89&event_id=SITCON":
       """
       {
@@ -41,8 +41,8 @@ Feature: Puzzle Delivery
     }
     """
     And there have some attendees
-      | token                                | event_id   | display_name |
-      | f185f505-d8c0-43ce-9e7b-bb9e8909072d | COSCUP2023 | Aotoki       |
+      | token                                | event_id | display_name |
+      | f185f505-d8c0-43ce-9e7b-bb9e8909072d | SITCON   | Aotoki       |
     When I make a POST request to "/event/puzzle/deliver?token=1024914b-ee65-4728-b687-8341f5affa89&event_id=SITCON":
       """
       {
@@ -62,10 +62,30 @@ Feature: Puzzle Delivery
 			]
       """
     And the response status should be 200
+  Scenario: POST /event/puzzle/deliver with attendee not in event
+    Given there have some booths
+      | token                                | name   | event_id |
+      | 1024914b-ee65-4728-b687-8341f5affa89 | COSCUP | SITCON   |
+    And there have some attendees
+      | token                                | event_id | display_name |
+      | f185f505-d8c0-43ce-9e7b-bb9e8909072d | COSCUP   | Aotoki       |
+    When I make a POST request to "/event/puzzle/deliver?token=1024914b-ee65-4728-b687-8341f5affa89&event_id=SITCON":
+      """
+      {
+        "receiver": "f185f505-d8c0-43ce-9e7b-bb9e8909072d"
+      }
+      """
+    Then the response json should be:
+      """
+      {
+        "message": "Attendee not in event"
+      }
+      """
+    And the response status should be 400
   Scenario: POST /event/puzzle/deliver with unpermitted booth token
     Given there have some attendees
-      | token                                | event_id   | display_name |
-      | f185f505-d8c0-43ce-9e7b-bb9e8909072d | COSCUP2023 | Aotoki       |
+      | token                                | event_id | display_name |
+      | f185f505-d8c0-43ce-9e7b-bb9e8909072d | SITCON   | Aotoki       |
     When I make a POST request to "/event/puzzle/deliver?token=d9d09032-cdae-4da2-9f41-680ca64f2d21&event_id=SITCON":
       """
       {
@@ -129,8 +149,8 @@ Feature: Puzzle Delivery
       | token                                | name   | event_id |
       | 1024914b-ee65-4728-b687-8341f5affa89 | COSCUP | SITCON   |
     And there have some attendees
-      | token                                | event_id   | display_name |
-      | f185f505-d8c0-43ce-9e7b-bb9e8909072d | COSCUP2023 | Aotoki       |
+      | token                                | event_id | display_name |
+      | f185f505-d8c0-43ce-9e7b-bb9e8909072d | SITCON   | Aotoki       |
     And there have some puzzle activity events
       | id                                   | type                | aggregate_id                         | version | payload                                     | occurred_at         |
       | b44845bd-8bd2-428d-ad65-f6a619bf8a96 | AttendeeInitialized | f185f505-d8c0-43ce-9e7b-bb9e8909072d | 0       | { "displayName": "Aotoki" }                 | 2023-09-10 20:4:00  |
diff --git a/worker/controller/puzzleDelivery.ts b/worker/controller/puzzleDelivery.ts
index d546d2b..d74e3af 100644
--- a/worker/controller/puzzleDelivery.ts
+++ b/worker/controller/puzzleDelivery.ts
@@ -70,6 +70,10 @@ export class DeliverPuzzleToUser extends OpenAPIRoute {
         throw new StatusError(400, 'Already take from this deliverer')
       }
 
+      if (e instanceof Command.PuzzleAttendeeNotInEventError) {
+        throw new StatusError(400, 'Attendee not in event')
+      }
+
       throw e
     }
   }