fix: person management ids validation and permissions (#31902)

fix: person management ids validation and permissions (#31898)

(cherry picked from commit 4408f49d15d5b38eb2fbfa40b68cf697a0e16ca8)

Co-authored-by: Daniel Dietzler <36593685+danieldietzler@users.noreply.github.com>

server/test/medium/specs/repositories/person-user.repository.spec.ts

@@ -70,6 +70,27 @@ const newShares = async () => {
 };
 
 describe(PersonUserRepository.name, () => {
+  describe('table constraints', () => {
+    it('should reject a row with sharedWithId = sharedById', async () => {
+      const { ctx } = setup();
+      const { user } = await ctx.newUser();
+      const { person } = await ctx.newPerson({ ownerId: user.id });
+      await expect(
+        ctx.database
+          .insertInto('person_user')
+          .values({
+            personGroupId: person.personGroupId,
+            sharedById: user.id,
+            sharedWithId: user.id,
+            role: PersonUserRole.Write,
+          })
+          .execute(),
+      ).rejects.toThrow(
+        'new row for relation "person_user" violates check constraint "person_user_sharedBy_sharedWith_chk"',
+      );
+    });
+  });
+
   describe('createAll', () => {
     describe(person_user_after_insert.name, () => {
       it('should create automatically person for the user it was shared with', async () => {

server/test/medium/specs/services/person.service.spec.ts

@@ -1245,18 +1245,20 @@ describe(PersonService.name, () => {
   });
 
   describe('addUsersToPeople', () => {
-    it('should skip sharedWith users that are not in the same cluster group', async () => {
+    it('should throw error for sharedWith users that are not in the same cluster group', async () => {
       const { sut, ctx } = setup();
       const { user: owner } = await ctx.newUser();
       const { user: user1 } = await ctx.newUser();
       const { person } = await ctx.newPerson({ ownerId: owner.id });
       const auth = factory.auth({ user: owner });
 
-      await sut.addUsersToPeople(auth, {
-        personIds: [person.personGroupId],
-        sharedWithIds: [user1.id],
-        role: PersonUserRole.Read,
-      });
+      await expect(
+        sut.addUsersToPeople(auth, {
+          personIds: [person.personGroupId],
+          sharedWithIds: [user1.id],
+          role: PersonUserRole.Read,
+        }),
+      ).rejects.toThrow('All users must be in the same cluster group');
 
       await expect(sut.getUsersForPeople(auth, {})).resolves.toHaveLength(0);
     });

server/test/utils.ts

@@ -140,7 +140,10 @@ export const controllerSetup = async (controller: ControllerClass | ControllerCl
     .overrideInterceptor(AssetUploadInterceptor)
     .useValue(noopInterceptor)
     .compile();
-  const app = moduleRef.createNestApplication();
+  const app = moduleRef.createNestApplication({
+    routeConflictPolicy: { duplicate: 'error' },
+    routeResolutionStrategy: 'specificity',
+  });
   await app.init();
 
   // allow the AuthController to override the AuthService itself