Only accept delete requests for contacts we have in the DB

Author: norkans7

handlers/meta/facebook_test.go

@@ -323,12 +323,14 @@ func TestFacebookDescribeURN(t *testing.T) {
 }
 
 func TestDeleteRequest(t *testing.T) {
+	urn, _ := urns.New(urns.Facebook, "218471")
 	RunIncomingTestCases(t, facebookTestChannels, newHandler("FBA", "Facebook"), []IncomingTestCase{
 		{
-			Label:       "Receive Delete request FBA",
-			URL:         "/c/fba/delete",
-			Data:        `{"algorithm":"HMAC-SHA256","expires":1291840400,"issued_at":1291836800,"user_id":"218471"}`,
-			PrepRequest: addValidSignature,
+			Label:          "Receive Delete request FBA",
+			URL:            "/c/fba/delete",
+			Data:           `{"algorithm":"HMAC-SHA256","expires":1291840400,"issued_at":1291836800,"user_id":"218471"}`,
+			PrepRequest:    addValidSignature,
+			ExistingDBURNs: []urns.URN{urn},
 
 			ExpectedRespStatus:    200,
 			ExpectedBodyContains:  "Deletion Request Received",
@@ -340,10 +342,24 @@ func TestDeleteRequest(t *testing.T) {
 			},
 		},
 		{
-			Label:       "Receive Delete request FBA",
-			URL:         "/c/fba/delete",
-			Data:        `{"algorithm":"HMAC-SHA256","expires":1291840400,"issued_at":1291836800,"user_id":"abc1234"}`,
-			PrepRequest: addValidSignature,
+			Label:          "Receive Delete request FBA, contact not existing",
+			URL:            "/c/fba/delete",
+			Data:           `{"algorithm":"HMAC-SHA256","expires":1291840400,"issued_at":1291836800,"user_id":"123456"}`,
+			PrepRequest:    addValidSignature,
+			ExistingDBURNs: []urns.URN{urn},
+
+			ExpectedRespStatus:    200,
+			ExpectedBodyContains:  "ignoring request, no existing contact matched",
+			NoQueueErrorCheck:     true,
+			NoInvalidChannelCheck: true,
+			NoLogsExpected:        true,
+		},
+		{
+			Label:          "Receive Delete request FBA, invalid facebook ID",
+			URL:            "/c/fba/delete",
+			Data:           `{"algorithm":"HMAC-SHA256","expires":1291840400,"issued_at":1291836800,"user_id":"abc1234"}`,
+			PrepRequest:    addValidSignature,
+			ExistingDBURNs: []urns.URN{urn},
 
 			ExpectedRespStatus:    200,
 			ExpectedBodyContains:  "invalid facebook id",

handlers/meta/handlers.go

@@ -240,6 +240,12 @@ func (h *handler) deleteContactEvents(ctx context.Context, channel courier.Chann
 	if err != nil {
 		return nil, handlers.WriteAndLogRequestError(ctx, h, channel, w, r, errors.New("invalid facebook id"))
 	}
+
+	contact, err := h.Server().Backend().GetContact(ctx, channel, urn, nil, "", false, clog)
+	if contact == nil {
+		return nil, handlers.WriteAndLogRequestIgnored(ctx, h, channel, w, r, "ignoring request, no existing contact matched")
+	}
+
 	date := parseTimestamp(payload.IssuedAt)
 
 	events := make([]courier.Event, 0, 2)

handlers/test.go

@@ -52,6 +52,8 @@ type IncomingTestCase struct {
 	NoInvalidChannelCheck bool
 	PrepRequest           RequestPrepFunc
 
+	ExistingDBURNs []urns.URN
+
 	URL           string
 	Data          string
 	Headers       map[string]string
@@ -159,6 +161,11 @@ func RunIncomingTestCases(t *testing.T, channels []courier.Channel, handler cour
 	handler.Initialize(s)
 
 	for _, tc := range testCases {
+		for _, urn := range tc.ExistingDBURNs {
+			ctx, _ := context.WithTimeout(context.Background(), time.Second*10)
+			s.Backend().GetContact(ctx, channels[0], urn, nil, "", true, nil)
+		}
+
 		t.Run(tc.Label, func(t *testing.T) {
 			require := require.New(t)