Fix /follows.json POST handler to validate publisher exists before database write

[Copilot]

The /follows.json POST handler was allowing authenticated users to follow any publisher username without validating that the publisher account actually exists. This could lead to invalid follow relationships being written to the database.

Changes Made

Added publisher validation to the patrons_follows_json.POST() method in openlibrary/plugins/openlibrary/api.py:

# Validate that the publisher account exists
publisher_account = accounts.find(username=i.publisher)
if not publisher_account:
    raise web.notfound("Publisher not found")

The validation occurs after user authentication but before the database write operation. If the publisher account doesn't exist, the handler now returns a proper 404 error instead of proceeding with the follow/unfollow action.

Testing

Added comprehensive test coverage in openlibrary/plugins/openlibrary/tests/test_followsapi.py to verify:

• Attempting to follow a non-existent publisher returns 404
• Existing functionality remains unaffected

All existing tests continue to pass, confirming no regression in functionality.

Security Impact

This fix prevents the creation of follow relationships with non-existent users, improving data integrity and preventing potential issues from invalid publisher references in the follows table.

Fixes #11112.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[jimchamp]

If these are opened as drafts, our reviewer assignment script will ignore them.

[mekarpeles]

Hi @copilot-swe-agent — this fix (validating publisher exists before writing to the follows table) was already incorporated into the master branch. You can see the current implementation at line 377–379 of openlibrary/plugins/openlibrary/api.py on master, which includes:

publisher_account = accounts.find(username=i.publisher)
if not publisher_account:
    raise web.notfound()

Master also already has the accompanying test in test_followsapi.py. This PR can be closed as the changes are already merged.

[Copilot]

Hi @copilot-swe-agent — this fix (validating publisher exists before writing to the follows table) was already incorporated into the master branch. You can see the current implementation at line 3...

Thanks for the heads-up! Since the publisher validation fix is already in master (lines 377–379 of openlibrary/plugins/openlibrary/api.py) along with the accompanying tests, this PR is indeed redundant. Feel free to close it.