regression: custom sound record breaks when validation error on update (#40696)

Author: nazabucciarelli

apps/meteor/app/api/server/v1/custom-sounds.ts

@@ -259,6 +259,13 @@ const customSoundsEndpoints = API.v1
 				: soundToUpdate.extension;
 
 			try {
+				await insertOrUpdateSound({
+					_id: fields._id,
+					name: fields.name,
+					extension: nextExtension,
+					previousName: soundToUpdate.name,
+					previousExtension: soundToUpdate.extension,
+				});
 				if (fileBuffer) {
 					await uploadCustomSound(fileBuffer, computedMimeType, {
 						_id: fields._id,
@@ -267,13 +274,6 @@ const customSoundsEndpoints = API.v1
 						extension: nextExtension,
 					});
 				}
-				await insertOrUpdateSound({
-					_id: fields._id,
-					name: fields.name,
-					extension: nextExtension,
-					previousName: soundToUpdate.name,
-					previousExtension: soundToUpdate.extension,
-				});
 				return API.v1.success({});
 			} catch (error) {
 				SystemLogger.error({ error });

apps/meteor/tests/end-to-end/api/custom-sounds.ts

@@ -1,4 +1,5 @@
 import { randomUUID } from 'crypto';
+import fs from 'fs';
 import path from 'path';
 
 import type { Credentials } from '@rocket.chat/api-client';
@@ -361,6 +362,61 @@ describe('[CustomSounds]', () => {
 					.expect(403);
 			});
 		});
+
+		describe('mutating file on failed validation', () => {
+			let soundAId: string;
+			let soundBId: string;
+			const soundAName = `sound-a-${randomUUID()}`;
+			const soundBName = `sound-b-${randomUUID()}`;
+
+			before(async () => {
+				soundAId = await createCustomSound(soundAName, mockWavAudioPath);
+				soundBId = await createCustomSound(soundBName, mockMp3AudioPath);
+			});
+
+			after(async () => {
+				await deleteCustomSound(soundAId);
+				await deleteCustomSound(soundBId);
+			});
+
+			it('should not mutate the underlying file or metadata if the update fails validation (e.g., name collision)', async () => {
+				await request
+					.post(api('custom-sounds.update'))
+					.set(credentials)
+					.attach('sound', mockMp3AudioPath)
+					.field('_id', soundAId)
+					.field('name', soundBName)
+					.expect(400)
+					.expect((res) => {
+						expect(res.body).to.have.property('success', false);
+						expect(res.body).to.have.property('error', 'The custom sound name is already in use [Custom_Sound_Error_Name_Already_In_Use]');
+					});
+
+				await request
+					.get(api('custom-sounds.getOne'))
+					.set(credentials)
+					.query({ _id: soundAId })
+					.expect(200)
+					.expect((res) => {
+						expect(res.body.sound).to.have.property('name', soundAName);
+						expect(res.body.sound).to.have.property('extension', 'wav');
+					});
+
+				const originalWavBuffer = fs.readFileSync(mockWavAudioPath);
+
+				await request
+					.get(`/custom-sounds/${soundAId}.wav`)
+					.set(credentials)
+					.expect(200)
+					.expect((res) => {
+						expect(res.headers).to.have.property('content-type', 'audio/wav');
+						expect(Buffer.isBuffer(res.body)).to.be.true;
+						expect(originalWavBuffer.equals(res.body)).to.be.true;
+					});
+
+				await request.get(`/custom-sounds/${soundAId}.mp3`).set(credentials).expect(404);
+			});
+		});
 	});
 
 	describe('[/custom-sounds.list]', () => {