Add missing 'not_found' checks in variables API

2 files changed, 25 insertions, 0 deletions

diff --git a/lib/api/variables.rb b/lib/api/variables.rb
index c70c7cd9d7b..dac2ba679c7 100644
--- a/lib/api/variables.rb
+++ b/lib/api/variables.rb
@@ -36,6 +36,8 @@ module API
             variables.where(key: variable_id)
           end
 
+        return not_found!('Variable') if variables.empty?
+
         present variables.first, with: Entities::Variable
       end
 
@@ -51,6 +53,8 @@ module API
       put ':id/variables/:variable_id' do
         variable = user_project.variables.where(id: params[:variable_id].to_i).first
 
+        return not_found!('Variable') unless variable
+
         variable.key = params[:key]
         variable.value = params[:value]
         variable.save!
@@ -67,6 +71,9 @@ module API
       #   DELETE /projects/:id/variables/:variable_id
       delete ':id/variables/:variable_id' do
         variable = user_project.variables.where(id: params[:variable_id].to_i).first
+
+        return not_found!('Variable') unless variable
+
         variable.destroy
       end
     end
diff --git a/spec/requests/api/variables_spec.rb b/spec/requests/api/variables_spec.rb
index 385db2409bd..b35ee2d32d1 100644
--- a/spec/requests/api/variables_spec.rb
+++ b/spec/requests/api/variables_spec.rb
@@ -54,6 +54,12 @@ describe API::API, api: true do
         expect(json_response['id']).to eq(variable.id)
         expect(json_response['value']).to eq(variable.value)
       end
+
+      it 'should responde with 404 Not Found if requesting non-existing variable' do
+        get api("/projects/#{project.id}/variables/9999", user)
+
+        expect(response.status).to eq(404)
+      end
     end
 
     context 'authorized user with invalid permissions' do
@@ -90,6 +96,12 @@ describe API::API, api: true do
         expect(updated_variable.key).to eq('TEST_VARIABLE_1_UP')
         expect(updated_variable.value).to eq('VALUE_1_UP')
       end
+
+      it 'should responde with 404 Not Found if requesting non-existing variable' do
+        put api("/projects/#{project.id}/variables/9999", user)
+
+        expect(response.status).to eq(404)
+      end
     end
 
     context 'authorized user with invalid permissions' do
@@ -117,6 +129,12 @@ describe API::API, api: true do
         end.to change{project.variables.count}.by(-1)
         expect(response.status).to eq(200)
       end
+
+      it 'should responde with 404 Not Found if requesting non-existing variable' do
+        delete api("/projects/#{project.id}/variables/9999", user)
+
+        expect(response.status).to eq(404)
+      end
     end
 
     context 'authorized user with invalid permissions' do