Validate winners

Author: ThomasKranitsas

config/default.js

@@ -54,6 +54,7 @@ module.exports = {
   // copilot resource role ids allowed to upload attachment
   COPILOT_RESOURCE_ROLE_IDS: process.env.COPILOT_RESOURCE_ROLE_IDS
     ? process.env.COPILOT_RESOURCE_ROLE_IDS.split(',') : ['10ba038e-48da-487b-96e8-8d3b99b6d18b'],
+  SUBMITTER_ROLE_ID: process.env.SUBMITTER_ROLE_ID || '732339e7-8e30-49d7-9198-cccf9451e221',
 
   // health check timeout in milliseconds
   HEALTH_CHECK_TIMEOUT: process.env.HEALTH_CHECK_TIMEOUT || 3000,

src/services/ChallengeService.js

@@ -716,9 +716,15 @@ function isDifferentPrizeSets (prizeSets = [], otherPrizeSets) {
 /**
  * Validate the winners array.
  * @param {Array} winners the Winner Array
+ * @param {String} winchallengeIdners the challenge ID
  */
-function validateWinners (winners) {
+async function validateWinners (winners, challengeId) {
+  const challengeResources = await helper.getChallengeResources(challengeId)
+  const registrants = _.filter(challengeResources, r => r.roleId === config.SUBMITTER_ROLE_ID)
   for (const winner of winners) {
+    if (!_.find(registrants, r => _.toString(r.memberId) === _.toString(winner.userId))) {
+      throw new errors.BadRequestError(`Member with userId: ${winner.userId} is not registered on the challenge`)
+    }
     const diffWinners = _.differenceWith(winners, [winner], _.isEqual)
     if (diffWinners.length + 1 !== winners.length) {
       throw new errors.BadRequestError(`Duplicate member with placement: ${helper.toString(winner)}`)
@@ -857,7 +863,7 @@ async function update (currentUser, challengeId, data, userToken, isFull) {
   }
 
   if (data.winners && data.winners.length) {
-    await validateWinners(data.winners)
+    await validateWinners(data.winners, challengeId)
   }
 
   data.updated = moment().utc()