fix(server): do not allow merging a person into themselves (#10776)

e2e/src/api/specs/person.e2e-spec.ts

@@ -230,4 +230,21 @@ describe('/people', () => {
       expect(body).toMatchObject({ birthDate: null });
     });
   });
+
+  describe('POST /people/:id/merge', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).post(`/people/${uuidDto.notFound}/merge`);
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
+    it('should not supporting merging a person into themselves', async () => {
+      const { status, body } = await request(app)
+        .post(`/people/${visiblePerson.id}/merge`)
+        .set('Authorization', `Bearer ${admin.accessToken}`)
+        .send({ ids: [visiblePerson.id] });
+      expect(status).toBe(400);
+      expect(body).toEqual(errorDto.badRequest('Cannot merge a person into themselves'));
+    });
+  });
 });

server/src/services/person.service.ts

@@ -551,6 +551,10 @@ export class PersonService {
 
   async mergePerson(auth: AuthDto, id: string, dto: MergePersonDto): Promise<BulkIdResponseDto[]> {
     const mergeIds = dto.ids;
+    if (mergeIds.includes(id)) {
+      throw new BadRequestException('Cannot merge a person into themselves');
+    }
+
     await this.access.requirePermission(auth, Permission.PERSON_WRITE, id);
     let primaryPerson = await this.findOrFail(id);
     const primaryName = primaryPerson.name || primaryPerson.id;