From 79cea907a394e93b24f546ce0a7c337c8296430b Mon Sep 17 00:00:00 2001
From: Jackson Harper <jacksonh@gmail.com>
Date: Wed, 30 Aug 2023 14:18:39 +0800
Subject: [PATCH] Fix typo with RSS typed subscription queries

---
 .../api/src/resolvers/subscriptions/index.ts  |  2 +-
 .../api/test/resolvers/subscriptions.test.ts  | 76 +++++++++++++++++++
 2 files changed, 77 insertions(+), 1 deletion(-)

diff --git a/packages/api/src/resolvers/subscriptions/index.ts b/packages/api/src/resolvers/subscriptions/index.ts
index beb246649..a71133d99 100644
--- a/packages/api/src/resolvers/subscriptions/index.ts
+++ b/packages/api/src/resolvers/subscriptions/index.ts
@@ -83,7 +83,7 @@ export const subscriptionsResolver = authorized<
         status: SubscriptionStatus.Active,
       })
     } else if (type && type == SubscriptionType.Rss) {
-      queryBuilder.where({
+      queryBuilder.andWhere({
         type,
       })
     } else {
diff --git a/packages/api/test/resolvers/subscriptions.test.ts b/packages/api/test/resolvers/subscriptions.test.ts
index 71d412bec..be846e394 100644
--- a/packages/api/test/resolvers/subscriptions.test.ts
+++ b/packages/api/test/resolvers/subscriptions.test.ts
@@ -185,6 +185,82 @@ describe('Subscriptions API', () => {
       }
     })
 
+    it('should not return other users subscriptions when type is set to RSS', async () => {
+      query = `
+      query {
+        subscriptions(type: RSS) {
+          ... on SubscriptionsSuccess {
+            subscriptions {
+              id
+              name
+            }
+          }
+          ... on SubscriptionsError {
+            errorCodes
+          }
+        }
+      }
+    `
+      const user2 = await createTestUser('fakeUser2')
+      try {
+        await createTestSubscription(
+          user2,
+          'sub_other',
+          undefined,
+          SubscriptionStatus.Unsubscribed,
+          undefined,
+          SubscriptionType.Rss
+        )
+        const res = await graphqlRequest(query, authToken).expect(200)
+        expect(res.body.data.subscriptions.subscriptions).to.eql(
+          subscriptions.map((sub) => ({
+            id: sub.id,
+            name: sub.name,
+          }))
+        )
+      } finally {
+        deleteTestUser(user2.id)
+      }
+    })
+
+    it('should not return other users subscriptions when type is set to NEWSLETTER', async () => {
+      query = `
+      query {
+        subscriptions(type: NEWSLETTER) {
+          ... on SubscriptionsSuccess {
+            subscriptions {
+              id
+              name
+            }
+          }
+          ... on SubscriptionsError {
+            errorCodes
+          }
+        }
+      }
+    `
+      const user2 = await createTestUser('fakeUser2')
+      try {
+        await createTestSubscription(
+          user2,
+          'sub_other',
+          undefined,
+          SubscriptionStatus.Unsubscribed,
+          undefined,
+          SubscriptionType.Rss
+        )
+        const res = await graphqlRequest(query, authToken).expect(200)
+        expect(res.body.data.subscriptions.subscriptions).to.eql(
+          subscriptions.map((sub) => ({
+            id: sub.id,
+            name: sub.name,
+          }))
+        )
+      } finally {
+        deleteTestUser(user2.id)
+      }
+    })
+
     it('responds status code 400 when invalid query', async () => {
       const invalidQuery = `
         query {