bug: Restrict user data access in User query

src/resolvers/Query/user.ts

@@ -5,12 +5,16 @@ import { AppUserProfile, User } from "../../models";
 import type { QueryResolvers } from "../../types/generatedGraphQLTypes";
 /**
  * This query fetch the user from the database.
+ *
+ * This function ensure that users can only query their own data and not access details of other users , protecting sensitive data.
+ *
  * @param _parent-
  * @param args - An object that contains `id` for the user.
  * @param context-
  * @returns An object that contains user data. If the user is not found then it throws a `NotFoundError` error.
  */
 export const user: QueryResolvers["user"] = async (_parent, args, context) => {
+  // Check if the current user exists in the system
   const currentUserExists = !!(await User.exists({
     _id: context.userId,
   }));
@@ -23,9 +27,26 @@ export const user: QueryResolvers["user"] = async (_parent, args, context) => {
     );
   }
 
-  const user: InterfaceUser = (await User.findOne({
-    _id: args.id,
-  }).lean()) as InterfaceUser;
+  // Check if the requesting user is trying to access their own data
+  if (context.userId !== args.id) {
+    throw new errors.UnauthorizedError(
+      "Access denied. You can only view your own profile.",
+    );
+  }
+
+  // Fetch the user data from the database based on the provided ID (args.id)
+  const user: InterfaceUser = (await User.findById(
+    args.id,
+  ).lean()) as InterfaceUser;
+
+  if (!user) {
+    throw new errors.NotFoundError(
+      USER_NOT_FOUND_ERROR.DESC,
+      USER_NOT_FOUND_ERROR.CODE,
+      USER_NOT_FOUND_ERROR.PARAM,
+    );
+  }
+
   const userAppProfile: InterfaceAppUserProfile = (await AppUserProfile.findOne(
     {
       userId: user._id,

tests/resolvers/Query/userAccess.spec.ts

@@ -0,0 +1,74 @@
+import { USER_NOT_FOUND_ERROR } from "../../../src/constants";
+import type mongoose from "mongoose";
+import { user } from "../../../src/resolvers/Query/user";
+import { connect, disconnect } from "../../helpers/db";
+import type { TestUserType } from "../../helpers/userAndOrg";
+import { createTestUser } from "../../helpers/userAndOrg";
+import { beforeAll, afterAll, describe, it, expect } from "vitest";
+
+let testUser: TestUserType;
+let anotherTestUser: TestUserType;
+let MONGOOSE_INSTANCE: typeof mongoose;
+
+beforeAll(async () => {
+  MONGOOSE_INSTANCE = await connect();
+  testUser = await createTestUser();
+  anotherTestUser = await createTestUser();
+});
+
+afterAll(async () => {
+  await disconnect(MONGOOSE_INSTANCE);
+});
+
+describe("user Query", () => {
+  // Test case 1: Invalid user ID scenario
+  it("throws error if user doesn't exist", async () => {
+    const args = {
+      id: "invalidUserId",
+    };
+
+    const context = {
+      userId: testUser?.id,
+    };
+
+    try {
+      await user?.({}, args, context);
+    } catch (error: unknown) {
+      expect((error as Error).message).toEqual(USER_NOT_FOUND_ERROR.DESC);
+    }
+  });
+
+  // Test case 2: Unauthorized access scenario
+  it("throws unauthorized error when trying to access another user's data", async () => {
+    const args = {
+      id: anotherTestUser?.id,
+    };
+
+    const context = {
+      userId: testUser?.id,
+    };
+
+    try {
+      await user?.({}, args, context);
+    } catch (error: unknown) {
+      expect((error as Error).message).toEqual(
+        "Access denied. You can only view your own profile.",
+      );
+    }
+  });
+
+  // Test case 3: Successful access scenario
+  it("successfully returns user data when accessing own profile", async () => {
+    const args = {
+      id: testUser?.id,
+    };
+
+    const context = {
+      userId: testUser?.id,
+    };
+
+    const result = await user?.({}, args, context);
+
+    expect(result).toBeDefined();
+  });
+});