api/trackers/export: Add missing nil checks

There are currently two cases that cause the export function to panic.

The first one happens, when the authenticated user does not have the
permissions to access the tracker. In that case the TrackersByID loader
returns nil, so we have to check for that.

The second one can happen for tickets that got mentioned by other
tickets. In that case event.Participant is nil. That is caused here in
tickets.py [1] where participant is only filled for user and
not for ticket mention events.

[1]: c2a87f590d/item/todosrht/tickets.py (L283)

api/trackers/export.go

@@ -5,6 +5,7 @@ import (
 	"context"
 	"database/sql"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 
@@ -23,6 +24,11 @@ func ExportDump(ctx context.Context, trackerID int, w io.Writer) error {
 	if err != nil {
 		return err
 	}
+
+	if tracker == nil {
+		return errors.New("access denied")
+	}
+
 	owner, err := loaders.ForContext(ctx).UsersByID.Load(tracker.OwnerID)
 	if err != nil {
 		return err
@@ -98,7 +104,7 @@ func signDump(tracker *TrackerDump) {
 
 		for j := range ticket.Events {
 			event := &ticket.Events[j]
-			if event.Participant.Type == "user" && event.Comment != nil {
+			if event.Participant != nil && event.Participant.Type == "user" && event.Comment != nil {
 				signCommentEvent(event, tracker.ID, ticket.ID)
 			}
 		}