Responding with 404 when updating an immutable attribute of a non-exi…

…sting resource
SAP · Aug 1, 2024 · ba4770f · ba4770f
1 parent bab180d
commit ba4770f
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 2 deletions.
diff --git a/scimono-server/src/main/java/com/sap/scimono/api/Groups.java b/scimono-server/src/main/java/com/sap/scimono/api/Groups.java
@@ -16,7 +16,6 @@
 import java.time.Instant;
 import java.util.ArrayList;
 import java.util.List;
-import java.util.Set;
 import java.util.UUID;
 
 import javax.validation.Valid;
@@ -191,6 +190,13 @@ public Response patchGroup(@PathParam("id") final String groupId, final PatchBod
     if (patchBody == null) {
       throw new InvalidInputException(NOT_VALID_INPUTS);
     }
+
+    Group groupFromDb = groupAPI.getGroup(groupId);
+
+    if (groupFromDb == null) {
+      throw new ResourceNotFoundException(RESOURCE_TYPE_GROUP, groupId);
+    }
+
     PatchValidationFramework validationFramework = PatchValidationFramework.groupsFramework(schemaAPI, resourceTypesAPI, groupAPI);
     validationFramework.validate(patchBody);
 

diff --git a/scimono-server/src/main/java/com/sap/scimono/api/Users.java b/scimono-server/src/main/java/com/sap/scimono/api/Users.java
@@ -16,7 +16,6 @@
 import java.time.Instant;
 import java.util.ArrayList;
 import java.util.List;
-import java.util.Set;
 import java.util.UUID;
 
 import javax.validation.Valid;
@@ -222,6 +221,12 @@ public Response patchUser(@PathParam("id") final String userId, final PatchBody
     if (patchBody == null) {
       throw new InvalidInputException(NOT_VALID_INPUTS);
     }
+
+    User userFromDb = usersAPI.getUser(userId);
+    if (userFromDb == null) {
+      throw new ResourceNotFoundException(RESOURCE_TYPE_USER, userId);
+    }
+
     PatchValidationFramework validationFramework = PatchValidationFramework.usersFramework(schemaAPI, resourceTypesAPI, usersAPI);
     validationFramework.validate(patchBody);