From 6fc3445fc6399b4ae8e205d28a07f02e85bec1e9 Mon Sep 17 00:00:00 2001
From: Kalle <38327916+Sendouc@users.noreply.github.com>
Date: Thu, 6 Feb 2025 09:23:48 +0200
Subject: [PATCH] Fix user search endpoint allowing returning all users

---
 app/features/user-page/UserRepository.server.ts | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/app/features/user-page/UserRepository.server.ts b/app/features/user-page/UserRepository.server.ts
index 0483e0e84..581c447c3 100644
--- a/app/features/user-page/UserRepository.server.ts
+++ b/app/features/user-page/UserRepository.server.ts
@@ -5,6 +5,7 @@ import { db, sql as dbDirect } from "~/db/sql";
 import type { BuildSort, DB, TablesInsertable } from "~/db/tables";
 import type { User } from "~/db/types";
 import { dateToDatabaseTimestamp } from "~/utils/dates";
+import invariant from "~/utils/invariant";
 import type { CommonUser } from "~/utils/kysely.server";
 import { COMMON_USER_FIELDS } from "~/utils/kysely.server";
 import { safeNumberParse } from "~/utils/number";
@@ -521,18 +522,25 @@ export function searchExact(args: {
 		.leftJoin("PlusTier", "PlusTier.userId", "User.id")
 		.select(searchSelectedFields);
 
-	if (args.id) {
+	let filtered = false;
+
+	if (typeof args.id === "number") {
+		filtered = true;
 		query = query.where("User.id", "=", args.id);
 	}
 
-	if (args.discordId) {
+	if (typeof args.discordId === "string") {
+		filtered = true;
 		query = query.where("User.discordId", "=", args.discordId);
 	}
 
-	if (args.customUrl) {
+	if (typeof args.customUrl === "string") {
+		filtered = true;
 		query = query.where("User.customUrl", "=", args.customUrl);
 	}
 
+	invariant(filtered, "No search criteria provided");
+
 	return query.execute();
 }