From eb54a98ea2b31ab4c4db004d183a2d41be1e055a Mon Sep 17 00:00:00 2001 From: Marcel Date: Sat, 9 May 2026 15:19:20 +0200 Subject: [PATCH] fix(user): use builder in createGroup and guard against null permissions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Null dto.permissions now produces an empty HashSet instead of propagating null into the @ElementCollection — prevents a silent NPE after V64 adds NOT NULL. Co-Authored-By: Claude Sonnet 4.6 --- .../raddatz/familienarchiv/user/UserService.java | 7 ++++--- .../familienarchiv/user/UserServiceTest.java | 14 ++++++++++++++ 2 files changed, 18 insertions(+), 3 deletions(-) diff --git a/backend/src/main/java/org/raddatz/familienarchiv/user/UserService.java b/backend/src/main/java/org/raddatz/familienarchiv/user/UserService.java index 91fd12fd..09e3493e 100644 --- a/backend/src/main/java/org/raddatz/familienarchiv/user/UserService.java +++ b/backend/src/main/java/org/raddatz/familienarchiv/user/UserService.java @@ -271,9 +271,10 @@ public class UserService { @Transactional public UserGroup createGroup(GroupDTO dto) { - UserGroup group = new UserGroup(); - group.setName(dto.getName()); - group.setPermissions(dto.getPermissions()); + UserGroup group = UserGroup.builder() + .name(dto.getName()) + .permissions(dto.getPermissions() != null ? dto.getPermissions() : new HashSet<>()) + .build(); return groupRepository.save(group); } diff --git a/backend/src/test/java/org/raddatz/familienarchiv/user/UserServiceTest.java b/backend/src/test/java/org/raddatz/familienarchiv/user/UserServiceTest.java index f0fd6e46..eee87ed9 100644 --- a/backend/src/test/java/org/raddatz/familienarchiv/user/UserServiceTest.java +++ b/backend/src/test/java/org/raddatz/familienarchiv/user/UserServiceTest.java @@ -902,4 +902,18 @@ class UserServiceTest { assertThat(result.getName()).isEqualTo("Familie"); assertThat(result.getPermissions()).containsExactlyInAnyOrder("READ_ALL", "WRITE_ALL"); } + + @Test + void createGroup_withNullPermissions_savesGroupWithEmptyPermissionSet() { + org.raddatz.familienarchiv.user.GroupDTO dto = new org.raddatz.familienarchiv.user.GroupDTO(); + dto.setName("Leser"); + dto.setPermissions(null); + + UserGroup saved = UserGroup.builder().id(UUID.randomUUID()).name("Leser").build(); + when(groupRepository.save(any())).thenReturn(saved); + + userService.createGroup(dto); + + verify(groupRepository).save(argThat(g -> g.getPermissions() != null && g.getPermissions().isEmpty())); + } }