groupMembers: add unique constraint

fixes #696

src/routes/test/groups-test.js

@@ -145,6 +145,16 @@ describe('Groups API', function () {
             });
     });
 
+    it('cannot set duplicate groups for a user', function (done) {
+        superagent.put(SERVER_URL + '/api/v1/users/' + userId + '/groups')
+            .query({ access_token: token })
+            .send({ groupIds: [ groupObject.id, group1Object.id, groupObject.id ]})
+            .end(function (error, result) {
+                expect(result.statusCode).to.equal(409);
+                done();
+            });
+    });
+
     it('can set users of a group', function (done) {
         superagent.put(SERVER_URL + '/api/v1/groups/' + groupObject.id + '/members')
             .query({ access_token: token })
@@ -155,6 +165,17 @@ describe('Groups API', function () {
             });
     });
 
+    it('cannot set duplicate users of a group', function (done) {
+        superagent.put(SERVER_URL + '/api/v1/groups/' + groupObject.id + '/members')
+            .query({ access_token: token })
+            .send({ userIds: [ userId, userId_1, userId ]})
+            .end(function (error, result) {
+                expect(result.statusCode).to.equal(409);
+                done();
+            });
+    });
+
+
     it('cannot get non-existing group', function (done) {
         superagent.get(SERVER_URL + '/api/v1/groups/nope')
             .query({ access_token: token })
@@ -180,8 +201,8 @@ describe('Groups API', function () {
                 expect(result.statusCode).to.equal(200);
                 expect(result.body.name).to.be(groupObject.name);
                 expect(result.body.userIds.length).to.be(2);
-                expect(result.body.userIds[0]).to.be(userId);
-                expect(result.body.userIds[1]).to.be(userId_1);
+                expect(result.body.userIds).to.contain(userId);
+                expect(result.body.userIds).to.contain(userId_1);
                 done();
             });
     });