From 2b71925145411b3b780107bf548742dc1f904621 Mon Sep 17 00:00:00 2001
From: Daniel Kostro <kostro.d@gmail.com>
Date: Fri, 17 Jun 2022 09:07:05 +0200
Subject: [PATCH] fix: add doc validation to ensure $id is not undefined

---
 src/design/validateDocUpdate.js       | 3 +++
 test/unit/design/validateDocUpdate.js | 5 +++++
 test/unit/entry.js                    | 9 +++++++++
 3 files changed, 17 insertions(+)

diff --git a/src/design/validateDocUpdate.js b/src/design/validateDocUpdate.js
index 80ecf4f9..0c01b3eb 100644
--- a/src/design/validateDocUpdate.js
+++ b/src/design/validateDocUpdate.js
@@ -113,6 +113,9 @@ module.exports = function (newDoc, oldDoc, userCtx) {
     validateDates(newDoc, oldDoc);
   } else if (newDoc.$type === 'entry') {
     validateOwners(newDoc);
+    if (newDoc.$id === undefined) {
+      throw { forbidden: '$id must be defined' };
+    }
     validateDates(newDoc, oldDoc);
     if (oldDoc) {
       if (Array.isArray(newDoc.$id) && Array.isArray(oldDoc.$id)) {
diff --git a/test/unit/design/validateDocUpdate.js b/test/unit/design/validateDocUpdate.js
index 89b3fb41..dab94463 100644
--- a/test/unit/design/validateDocUpdate.js
+++ b/test/unit/design/validateDocUpdate.js
@@ -16,6 +16,11 @@ describe('validate_doc_update', () => {
   });
   describe('$type: entry', () => {
     test('id', () => {
+      assert(
+        addOwners(addDate({ $type: 'entry' })),
+        null,
+        '$id must be defined',
+      );
       assert(
         addOwners(addDate({ $type: 'entry', $id: 'abc' })),
         addOwners(addDate({ $type: 'entry', $id: 'xyz' })),
diff --git a/test/unit/entry.js b/test/unit/entry.js
index 24765ba1..3a70e3b8 100644
--- a/test/unit/entry.js
+++ b/test/unit/entry.js
@@ -365,6 +365,15 @@ describe('entry creation and editions', () => {
     expect(entry1.info.isNew).toBe(true);
     expect(entry2.info.isNew).toBe(true);
   });
+
+  test('$id is null by default', async () => {
+    const entry = await couch.insertEntry({ $content: 'A' }, 'a@a.com');
+    expect(entry.action).toEqual('created');
+
+    const dbEntry = await couch.getEntry(entry.info.id, 'a@a.com');
+    expect(dbEntry.$id).toBe(null);
+    expect(dbEntry.$content).toBe('A');
+  });
 });
 
 describe('entry rights', () => {