generated from Real-Dev-Squad/website-template
-
Notifications
You must be signed in to change notification settings - Fork 263
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #2295 from Real-Dev-Squad/develop
Dev To Main Sync
- Loading branch information
Showing
9 changed files
with
272 additions
and
22 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| import { NextFunction } from "express"; | ||
| import { CustomRequest, CustomResponse } from "../types/global"; | ||
|
|
||
| export const userAuthorization = (req: CustomRequest, res: CustomResponse, next: NextFunction) => { | ||
| if (req.params.userId === req.userData.id) { | ||
| return next(); | ||
| } | ||
| res.boom.forbidden("Unauthorized access"); | ||
| }; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,97 @@ | ||
| import chai from "chai"; | ||
| import chaiHttp from "chai-http"; | ||
| import app from "../../server"; | ||
| import authService from "../../services/authService"; | ||
| import addUser from "../utils/addUser"; | ||
| import cleanDb from "../utils/cleanDb"; | ||
| import stocks from "../../models/stocks"; | ||
| import sinon from "sinon"; | ||
| import config from "config"; | ||
|
|
||
| const cookieName: string = config.get("userToken.cookieName"); | ||
| chai.use(chaiHttp); | ||
| const { expect } = chai; | ||
|
|
||
| describe("GET /stocks/:userId", function () { | ||
| let jwt: string; | ||
| let userId: string; | ||
| let userStock; | ||
| const stockData = { name: "EURO", quantity: 2, price: 10 }; | ||
|
|
||
| beforeEach(async function () { | ||
| userId = await addUser(); | ||
| jwt = authService.generateAuthToken({ userId }); | ||
| const { id } = await stocks.addStock(stockData); | ||
| userStock = { stockId: id, stockName: "EURO", quantity: 1, orderValue: 10, initialStockValue: 2 }; | ||
| }); | ||
|
|
||
| afterEach(async function () { | ||
| await cleanDb(); | ||
| sinon.restore(); | ||
| }); | ||
|
|
||
| it("Should return user stocks when stocks are available", async function () { | ||
| await stocks.updateUserStocks(userId, userStock); | ||
|
|
||
| const res = await chai.request(app).get(`/stocks/${userId}?dev=true`).set("cookie", `${cookieName}=${jwt}`); | ||
|
|
||
| expect(res).to.have.status(200); | ||
| expect(res.body).to.be.an("object"); | ||
| expect(res.body.message).to.equal("User stocks returned successfully!"); | ||
| expect(res.body.userStocks).to.be.an("array"); | ||
| expect(res.body.userStocks.map(({ id, ...rest }) => rest)).to.deep.equal([{ ...userStock, userId }]); | ||
| }); | ||
|
|
||
| it("Should return empty object when no stocks are found", function (done) { | ||
| chai | ||
| .request(app) | ||
| .get(`/stocks/${userId}?dev=true`) | ||
| .set("cookie", `${cookieName}=${jwt}`) | ||
| .end((err, res) => { | ||
| if (err) return done(err); | ||
|
|
||
| expect(res).to.have.status(200); | ||
| expect(res.body).to.be.an("object"); | ||
| expect(res.body.message).to.equal("No stocks found"); | ||
| expect(res.body.userStocks).to.be.an("array"); | ||
|
|
||
| return done(); | ||
| }); | ||
| }); | ||
|
|
||
| it("Should return 403 for unauthorized access", function (done) { | ||
| const userId = "anotherUser123"; | ||
|
|
||
| chai | ||
| .request(app) | ||
| .get(`/stocks/${userId}?dev=true`) | ||
| .set("cookie", `${cookieName}=${jwt}`) | ||
| .end((err, res) => { | ||
| if (err) return done(err); | ||
|
|
||
| expect(res).to.have.status(403); | ||
| expect(res.body).to.be.an("object"); | ||
| expect(res.body.message).to.equal("Unauthorized access"); | ||
|
|
||
| return done(); | ||
| }); | ||
| }); | ||
|
|
||
| it("Should return 500 when an internal server error occurs", function (done) { | ||
| sinon.stub(stocks, "fetchUserStocks").throws(new Error("Database error")); | ||
|
|
||
| chai | ||
| .request(app) | ||
| .get(`/stocks/${userId}?dev=true`) | ||
| .set("cookie", `${cookieName}=${jwt}`) | ||
| .end((err, res) => { | ||
| if (err) return done(err); | ||
|
|
||
| expect(res).to.have.status(500); | ||
| expect(res.body).to.be.an("object"); | ||
| expect(res.body.message).to.equal("An internal server error occurred"); | ||
|
|
||
| return done(); | ||
| }); | ||
| }); | ||
| }); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,70 @@ | ||
| import * as sinon from "sinon"; | ||
| import chai from "chai"; | ||
| const { expect } = chai; | ||
| const { userAuthorization } = require("../../../middlewares/userAuthorization"); | ||
|
|
||
| describe("userAuthorization Middleware", function () { | ||
| let req; | ||
| let res; | ||
| let next; | ||
|
|
||
| beforeEach(function () { | ||
| req = { | ||
| params: {}, | ||
| userData: {}, | ||
| }; | ||
| res = { | ||
| boom: { | ||
| forbidden: sinon.spy((message) => { | ||
| res.status = 403; | ||
| res.message = message; | ||
| }), | ||
| }, | ||
| }; | ||
| next = sinon.spy(); | ||
| }); | ||
|
|
||
| it("should call next() if userId matches userData.id", function () { | ||
| req.params.userId = "123"; | ||
| req.userData.id = "123"; | ||
|
|
||
| userAuthorization(req, res, next); | ||
|
|
||
| expect(next.calledOnce).to.be.true; | ||
| expect(res.boom.forbidden.notCalled).to.be.true; | ||
| }); | ||
|
|
||
| it("should call res.boom.forbidden() if userId does not match userData.id", function () { | ||
| req.params.userId = "123"; | ||
| req.userData.id = "456"; | ||
|
|
||
| userAuthorization(req, res, next); | ||
|
|
||
| expect(res.boom.forbidden.calledOnce).to.be.true; | ||
| expect(res.status).to.equal(403); | ||
| expect(res.message).to.equal("Unauthorized access"); | ||
| expect(next.notCalled).to.be.true; | ||
| }); | ||
|
|
||
| it("should call res.boom.forbidden() if userData.id is missing", function () { | ||
| req.params.userId = "123"; | ||
|
|
||
| userAuthorization(req, res, next); | ||
|
|
||
| expect(res.boom.forbidden.calledOnce).to.be.true; | ||
| expect(res.status).to.equal(403); | ||
| expect(res.message).to.equal("Unauthorized access"); | ||
| expect(next.notCalled).to.be.true; | ||
| }); | ||
|
|
||
| it("should call res.boom.forbidden() if userId is missing", function () { | ||
| req.userData.id = "123"; | ||
|
|
||
| userAuthorization(req, res, next); | ||
|
|
||
| expect(res.boom.forbidden.calledOnce).to.be.true; | ||
| expect(res.status).to.equal(403); | ||
| expect(res.message).to.equal("Unauthorized access"); | ||
| expect(next.notCalled).to.be.true; | ||
| }); | ||
| }); |
Oops, something went wrong.