fix(server): Prevent user resolver crash for anonymous requests

packages/openneuro-server/src/datalad/__tests__/dataset.spec.ts

@@ -1,4 +1,3 @@
-/* eslint-disable @typescript-eslint/no-explicit-any */
 import { vi } from "vitest"
 import request from "superagent"
 import { createDataset, datasetsFilter, testBlacklist } from "../dataset"

packages/openneuro-server/src/graphql/resolvers/__tests__/user.spec.ts

@@ -10,7 +10,7 @@ import {
 import { MongoMemoryServer } from "mongodb-memory-server"
 import mongoose, { Types } from "mongoose"
 import User from "../../../models/user"
-import { users } from "../user.js"
+import { user, users } from "../user.js"
 import type { GraphQLContext } from "../user.js"
 
 vi.mock("ioredis")
@@ -132,6 +132,27 @@ describe("user resolvers", () => {
     await User.insertMany(testUsersSeedData)
   })
 
+  describe("user()", () => {
+    it("does not crash when userInfo is undefined (anonymous request)", async () => {
+      const result = await user(null, { id: "u1" }, {})
+      expect(result).not.toBeNull()
+      expect(result!.id).toBe("u1")
+      // Email should be hidden for anonymous users
+      expect(result!.email).toBeUndefined()
+    })
+
+    it("does not crash when context is completely missing", async () => {
+      const result = await user(null, { id: "u1" }, undefined)
+      expect(result).not.toBeNull()
+      expect(result!.id).toBe("u1")
+    })
+
+    it("returns null for non-existent user", async () => {
+      const result = await user(null, { id: "nonexistent" }, {})
+      expect(result).toBeNull()
+    })
+  })
+
   describe("users()", () => {
     it("returns sanitized data for non-admin context", async () => {
       const result = await users(null, {}, nonAdminContext)

packages/openneuro-server/src/graphql/resolvers/user.ts

@@ -34,7 +34,7 @@ export async function user(
   { id },
   { userInfo }: { userInfo?: Record<string, unknown> } = {},
 ): Promise<Partial<GraphQLUserType> | null> {
-  if (userInfo.reviewer) {
+  if (userInfo?.reviewer) {
     const oneWeekAgo = new Date()
     oneWeekAgo.setDate(oneWeekAgo.getDate() - 7)
     return {