diff --git a/app/controllers/articles.server.controller.js b/app/controllers/articles.server.controller.js index 0a24e81733..8eb757bc1b 100644 --- a/app/controllers/articles.server.controller.js +++ b/app/controllers/articles.server.controller.js @@ -88,9 +88,20 @@ exports.list = function(req, res) { * Article middleware */ exports.articleByID = function(req, res, next, id) { + + if (!mongoose.Types.ObjectId.isValid(id)) { + return res.status(400).send({ + message: 'Article is invalid' + }); + } + Article.findById(id).populate('user', 'displayName').exec(function(err, article) { if (err) return next(err); - if (!article) return next(new Error('Failed to load article ' + id)); + if (!article) { + return res.status(404).send({ + message: 'Article not found' + }); + } req.article = article; next(); }); diff --git a/app/tests/article.server.routes.test.js b/app/tests/article.server.routes.test.js index 2576095ae1..34255f5e18 100644 --- a/app/tests/article.server.routes.test.js +++ b/app/tests/article.server.routes.test.js @@ -201,6 +201,17 @@ describe('Article CRUD tests', function() { }); }); + it('should return proper error for single article which doesnt exist, if not signed in', function(done) { + request(app).get('/articles/test') + .end(function(req, res) { + // Set assertion + res.body.should.be.an.Object.with.property('message', 'Article is invalid'); + + // Call the assertion callback + done(); + }); + }); + it('should be able to delete an article if signed in', function(done) { agent.post('/auth/signin') .send(credentials)