From 28cab6d89854b9c5130852bd2a3d23c400e91b60 Mon Sep 17 00:00:00 2001
From: Travis Semple <travis8814@gmail.com>
Date: Tue, 5 Nov 2024 12:45:52 -0800
Subject: [PATCH] Small change to fix error

---
 pay-api/src/pay_api/resources/v1/account.py |  2 ++
 pay-api/tests/unit/api/test_account.py      | 13 +++++++++++++
 2 files changed, 15 insertions(+)

diff --git a/pay-api/src/pay_api/resources/v1/account.py b/pay-api/src/pay_api/resources/v1/account.py
index a196e46b2..ae09098c9 100644
--- a/pay-api/src/pay_api/resources/v1/account.py
+++ b/pay-api/src/pay_api/resources/v1/account.py
@@ -258,6 +258,8 @@ def put_account_fee_product(account_number: str, product: str):
 def post_search_purchase_history(account_number: str):
     """Search purchase history."""
     current_app.logger.info("<post_search_purchase_history")
+    if account_number and account_number.isnumeric() is False:
+        return error_to_response(Error.INVALID_REQUEST, invalid_params='account_number')
     request_json = request.get_json()
     current_app.logger.debug(request_json)
     # Validate the input request
diff --git a/pay-api/tests/unit/api/test_account.py b/pay-api/tests/unit/api/test_account.py
index 0ac1d5935..068463368 100755
--- a/pay-api/tests/unit/api/test_account.py
+++ b/pay-api/tests/unit/api/test_account.py
@@ -384,6 +384,19 @@ def test_account_purchase_history_default_list(session, client, jwt, app):
     assert rv.json.get("total") == 10
 
 
+def test_bad_id_payment_queries(session, client, jwt, app):
+    """Assert testing a string inside of the route doesn't work."""
+    token = jwt.create_jwt(get_claims(), token_header)
+    headers = {"Authorization": f"Bearer {token}", "content-type": "application/json"}
+    rv = client.post(
+        "/api/v1/accounts/HELLO/payments/queries",
+        data=json.dumps({}),
+        headers=headers,
+    )
+    assert rv.status_code == 400
+    assert rv.json.get("invalidParams") == "account_number"
+
+
 def test_basic_account_creation(session, client, jwt, app):
     """Assert that the endpoint returns 201."""
     token = jwt.create_jwt(get_claims(role=Role.SYSTEM.value), token_header)