u

src/api/routes/entity.js

@@ -17,6 +17,7 @@ function entityErrorStatus(error) {
     if (error.message === 'Name required') return 400;
     if (error.message === 'Number required') return 400;
     if (error.message === 'Number already in use') return 409;
+    if (error.message === 'Invalid customergroupId') return 400;
     if (error.message === 'Invalid role') return 400;
     return 500;
 }
@@ -196,6 +197,9 @@ export function register(app, basePath = '') {
         }
 
         const body = req.body ?? {};
+        if (body.customergroupId !== undefined && body.customergroupId !== null && (typeof body.customergroupId !== 'number' || !Number.isInteger(body.customergroupId) || body.customergroupId <= 0)) {
+            return res.status(400).json({ error: 'Invalid customergroupId' });
+        }
         const data = {
             customergroupId: body.customergroupId,
             name: body.name,