From 05e43722505d6fe8a80b5cfc603c9cb078fcccf4 Mon Sep 17 00:00:00 2001
From: Malaber <git@schaedler.rocks>
Date: Thu, 23 Apr 2026 19:59:19 +0200
Subject: [PATCH] Fix team action not-found responses

---
 .../team_action_items_controller.rb           |  1 +
 .../team_action_lists_controller.rb           |  1 +
 .../team_action_items_controller_spec.rb      | 14 ++++++++
 .../team_action_lists_controller_spec.rb      | 34 +++++++++++++++++++
 spec/e2e/http/tournament_sync_test_spec.rb    | 25 ++++++++++++++
 5 files changed, 75 insertions(+)

diff --git a/app/controllers/team_action_items_controller.rb b/app/controllers/team_action_items_controller.rb
index b63a5d0..a63fd07 100644
--- a/app/controllers/team_action_items_controller.rb
+++ b/app/controllers/team_action_items_controller.rb
@@ -5,6 +5,7 @@ class TeamActionItemsController < ApplicationController
   before_action :authenticate_user!, only: %i[update]
   before_action -> { require_owner! @team_action_item.owner }, only: %i[update]
   before_action -> { require_writable_tournament!(@team_action_item.tournament) }, only: %i[update]
+  rescue_from ActiveRecord::RecordNotFound, with: :render_not_found_error
 
   # PATCH /team_action_items/1
   def update
diff --git a/app/controllers/team_action_lists_controller.rb b/app/controllers/team_action_lists_controller.rb
index bff4b94..6f07f5c 100644
--- a/app/controllers/team_action_lists_controller.rb
+++ b/app/controllers/team_action_lists_controller.rb
@@ -6,6 +6,7 @@ class TeamActionListsController < ApplicationController
   before_action -> { require_owner! @tournament.owner }, only: %i[update_item]
   before_action -> { require_writable_tournament!(@tournament) }, only: %i[update_item]
   before_action :set_team_action_item, only: %i[update_item]
+  rescue_from ActiveRecord::RecordNotFound, with: :render_not_found_error
 
   # PATCH /tournaments/:tournament_id/team_action_lists/:key/teams/:team_id
   def update_item
diff --git a/spec/controllers/team_action_items_controller_spec.rb b/spec/controllers/team_action_items_controller_spec.rb
index efebd7a..569d6d5 100644
--- a/spec/controllers/team_action_items_controller_spec.rb
+++ b/spec/controllers/team_action_items_controller_spec.rb
@@ -49,5 +49,19 @@ RSpec.describe TeamActionItemsController, type: :controller do
         expect(response).to have_http_status(:forbidden)
       end
     end
+
+    context 'when item is missing' do
+      let(:owner) { create(:user) }
+
+      before do
+        apply_authentication_headers_for owner
+      end
+
+      it 'returns not found' do
+        patch :update, params: { id: 999_999_999, completed: true }
+
+        expect(response).to have_http_status(:not_found)
+      end
+    end
   end
 end
diff --git a/spec/controllers/team_action_lists_controller_spec.rb b/spec/controllers/team_action_lists_controller_spec.rb
index fdb9322..2507fd8 100644
--- a/spec/controllers/team_action_lists_controller_spec.rb
+++ b/spec/controllers/team_action_lists_controller_spec.rb
@@ -70,5 +70,39 @@ RSpec.describe TeamActionListsController, type: :controller do
         expect(response).to have_http_status(:forbidden)
       end
     end
+
+    context 'when list key is missing' do
+      before do
+        apply_authentication_headers_for tournament.owner
+      end
+
+      it 'returns not found' do
+        patch :update_item, params: {
+          tournament_id: tournament.to_param,
+          key: 'unknown_key',
+          team_id: team.to_param,
+          completed: true
+        }
+
+        expect(response).to have_http_status(:not_found)
+      end
+    end
+
+    context 'when team is missing from list context' do
+      before do
+        apply_authentication_headers_for tournament.owner
+      end
+
+      it 'returns not found' do
+        patch :update_item, params: {
+          tournament_id: tournament.to_param,
+          key: list.key,
+          team_id: 999_999_999,
+          completed: true
+        }
+
+        expect(response).to have_http_status(:not_found)
+      end
+    end
   end
 end
diff --git a/spec/e2e/http/tournament_sync_test_spec.rb b/spec/e2e/http/tournament_sync_test_spec.rb
index 9d0b871..03ff7a2 100644
--- a/spec/e2e/http/tournament_sync_test_spec.rb
+++ b/spec/e2e/http/tournament_sync_test_spec.rb
@@ -90,6 +90,31 @@ RSpec.describe 'Tournament sync test HTTP E2E' do
     expect(playoff_token_item_completed?(follower_after_update, team_name: second_item.dig(:team, :name))).to eq(true)
   end
 
+  it 'returns 404 for missing team action resources on both update routes' do
+    leader = create_group_stage_tournament(name_prefix: 'Missing Action Resource Leader')
+
+    finish_group_stage_and_create_playoffs!(leader.fetch(:id))
+
+    leader_after_playoffs = fetch_tournament(leader.fetch(:id))
+    token_list = find_playoff_token_list!(leader_after_playoffs)
+    first_item = token_list.fetch(:team_action_items).first
+
+    missing_item_update = client.patch('/team_action_items/999999999', body: { completed: true })
+    expect(missing_item_update[:status]).to eq(404)
+
+    missing_list_update = client.patch(
+      "/tournaments/#{leader.fetch(:id)}/team_action_lists/unknown_key/teams/#{first_item.dig(:team, :id)}",
+      body: { completed: true }
+    )
+    expect(missing_list_update[:status]).to eq(404)
+
+    missing_team_update = client.patch(
+      "/tournaments/#{leader.fetch(:id)}/team_action_lists/group_stage_survivor_playoff_tokens/teams/999999999",
+      body: { completed: true }
+    )
+    expect(missing_team_update[:status]).to eq(404)
+  end
+
   def login_client
     api_client = TurniereE2E::ApiClient.new(base_url: base_url)
     response = api_client.login!(email: owner_email, password: owner_password)