From fad3e25278d48a9982987885a476d1f07469284a Mon Sep 17 00:00:00 2001
From: Dan Stillman <dstillman@zotero.org>
Date: Wed, 19 Jun 2024 00:28:59 -0400
Subject: [PATCH] Local API: Return 404 for unknown group library

---
 .../zotero/xpcom/localAPI/server_localAPI.js     | 16 ++++++++++++----
 test/tests/server_localAPITest.js                | 13 +++++++++++++
 2 files changed, 25 insertions(+), 4 deletions(-)

diff --git a/chrome/content/zotero/xpcom/localAPI/server_localAPI.js b/chrome/content/zotero/xpcom/localAPI/server_localAPI.js
index b18ff5d76c..8063adc8f8 100644
--- a/chrome/content/zotero/xpcom/localAPI/server_localAPI.js
+++ b/chrome/content/zotero/xpcom/localAPI/server_localAPI.js
@@ -112,10 +112,18 @@ class LocalAPIEndpoint {
 			}
 			return this.makeResponse(400, 'text/plain', 'Only data for the logged-in user is available locally -- use userID 0' + suffix);
 		}
-
-		requestData.libraryID = requestData.pathParams.groupID
-			? Zotero.Groups.getLibraryIDFromGroupID(parseInt(requestData.pathParams.groupID))
-			: Zotero.Libraries.userLibraryID;
+		
+		if (requestData.pathParams.groupID) {
+			let groupID = requestData.pathParams.groupID;
+			let libraryID = Zotero.Groups.getLibraryIDFromGroupID(parseInt(groupID));
+			if (!libraryID) {
+				return this.makeResponse(404, 'text/plain', 'Not found');
+			}
+			requestData.libraryID = libraryID;
+		}
+		else {
+			requestData.libraryID = Zotero.Libraries.userLibraryID;
+		}
 		
 		let library = Zotero.Libraries.get(requestData.libraryID);
 		if (!library.getDataLoaded('item')) {
diff --git a/test/tests/server_localAPITest.js b/test/tests/server_localAPITest.js
index f22588e8a9..208a05677b 100644
--- a/test/tests/server_localAPITest.js
+++ b/test/tests/server_localAPITest.js
@@ -281,4 +281,17 @@ describe("Local API Server", function () {
 			assert.equal(response[0].meta.numItems, 1);
 		});
 	});
+	
+	describe("/groups/<groupID>", function () {
+		it("should return 404 for unknown group", async function () {
+			let { response } = await apiGet(
+				'/groups/99999999999',
+				{
+					successCodes: [404],
+					responseType: 'text'
+				}
+			);
+			assert.equal(response, "Not found");
+		});
+	});
 });