Skip to content

Commit 59bfd33

Browse files
davellanedamdavellanedam
authored
Merge pull request #193 from Ciriak/master
Added a test to ensure that a simple user cannot PATCH another
2 parents d9d6e19 + 92c582c commit 59bfd33

File tree

2 files changed

+77
-17
lines changed

2 files changed

+77
-17
lines changed

‎data/1.users/user.js‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,5 +17,21 @@ module.exports = [
1717
urlGitHub: faker.internet.url(),
1818
createdAt: faker.date.past(),
1919
updatedAt: faker.date.recent()
20+
},
21+
{
22+
_id: new ObjectID('5aa1c2c35ef7a4e97b5e995b'),
23+
name: 'Simple user',
24+
email: 'user@user.com',
25+
password: '$2a$05$2KOSBnbb0r.0TmMrvefbluTOB735rF/KRZb4pmda4PdvU9iDvUB26',
26+
role: 'user',
27+
verified: true,
28+
verification: '3d6e072c-0eaf-4239-bb5e-495e6486148d',
29+
city: 'Bucaramanga',
30+
country: 'Colombia',
31+
phone: '123123',
32+
urlTwitter: faker.internet.url(),
33+
urlGitHub: faker.internet.url(),
34+
createdAt: faker.date.past(),
35+
updatedAt: faker.date.recent()
2036
}
2137
]

‎test/users.js‎

Lines changed: 61 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -10,27 +10,52 @@ const server = require('../server')
1010
// eslint-disable-next-line no-unused-vars
1111
const should = chai.should()
1212
const loginDetails = {
13-
email: 'admin@admin.com',
14-
password: '12345'
13+
admin: {
14+
id: '5aa1c2c35ef7a4e97b5e995a',
15+
email: 'admin@admin.com',
16+
password: '12345'
17+
},
18+
user: {
19+
id: '5aa1c2c35ef7a4e97b5e995b',
20+
email: 'user@user.com',
21+
password: '12345'
22+
}
1523
}
16-
let token = ''
24+
const tokens = {
25+
admin: '',
26+
user: ''
27+
}
28+
1729
const email = faker.internet.email()
1830
const createdID = []
1931

2032
chai.use(chaiHttp)
2133

2234
describe('*********** USERS ***********', () => {
2335
describe('/POST login', () => {
24-
it('it should GET token', done => {
36+
it('it should GET token as admin', done => {
37+
chai
38+
.request(server)
39+
.post('/login')
40+
.send(loginDetails.admin)
41+
.end((err, res) => {
42+
res.should.have.status(200)
43+
res.body.should.be.an('object')
44+
res.body.should.have.property('token')
45+
tokens.admin = res.body.token
46+
done()
47+
})
48+
})
49+
it('it should GET token as user', done => {
2550
chai
2651
.request(server)
2752
.post('/login')
28-
.send(loginDetails)
53+
.send(loginDetails.user)
2954
.end((err, res) => {
3055
res.should.have.status(200)
3156
res.body.should.be.an('object')
3257
res.body.should.have.property('token')
33-
token = res.body.token
58+
tokens.user = res.body.token
3459
done()
3560
})
3661
})
@@ -49,7 +74,7 @@ describe('*********** USERS ***********', () => {
4974
chai
5075
.request(server)
5176
.get('/users')
52-
.set('Authorization', `Bearer ${token}`)
77+
.set('Authorization', `Bearer ${tokens.admin}`)
5378
.end((err, res) => {
5479
res.should.have.status(200)
5580
res.body.should.be.an('object')
@@ -61,7 +86,7 @@ describe('*********** USERS ***********', () => {
6186
chai
6287
.request(server)
6388
.get('/users?filter=admin&fields=name,email,city,country,phone')
64-
.set('Authorization', `Bearer ${token}`)
89+
.set('Authorization', `Bearer ${tokens.admin}`)
6590
.end((err, res) => {
6691
res.should.have.status(200)
6792
res.body.should.be.an('object')
@@ -78,7 +103,7 @@ describe('*********** USERS ***********', () => {
78103
chai
79104
.request(server)
80105
.post('/users')
81-
.set('Authorization', `Bearer ${token}`)
106+
.set('Authorization', `Bearer ${tokens.admin}`)
82107
.send(user)
83108
.end((err, res) => {
84109
res.should.have.status(422)
@@ -102,7 +127,7 @@ describe('*********** USERS ***********', () => {
102127
chai
103128
.request(server)
104129
.post('/users')
105-
.set('Authorization', `Bearer ${token}`)
130+
.set('Authorization', `Bearer ${tokens.admin}`)
106131
.send(user)
107132
.end((err, res) => {
108133
res.should.have.status(201)
@@ -122,7 +147,7 @@ describe('*********** USERS ***********', () => {
122147
chai
123148
.request(server)
124149
.post('/users')
125-
.set('Authorization', `Bearer ${token}`)
150+
.set('Authorization', `Bearer ${tokens.admin}`)
126151
.send(user)
127152
.end((err, res) => {
128153
res.should.have.status(422)
@@ -141,7 +166,7 @@ describe('*********** USERS ***********', () => {
141166
chai
142167
.request(server)
143168
.post('/users')
144-
.set('Authorization', `Bearer ${token}`)
169+
.set('Authorization', `Bearer ${tokens.admin}`)
145170
.send(user)
146171
.end((err, res) => {
147172
res.should.have.status(422)
@@ -157,7 +182,7 @@ describe('*********** USERS ***********', () => {
157182
chai
158183
.request(server)
159184
.get(`/users/${id}`)
160-
.set('Authorization', `Bearer ${token}`)
185+
.set('Authorization', `Bearer ${tokens.admin}`)
161186
.end((error, res) => {
162187
res.should.have.status(200)
163188
res.body.should.be.a('object')
@@ -183,7 +208,7 @@ describe('*********** USERS ***********', () => {
183208
chai
184209
.request(server)
185210
.patch(`/users/${id}`)
186-
.set('Authorization', `Bearer ${token}`)
211+
.set('Authorization', `Bearer ${tokens.admin}`)
187212
.send(user)
188213
.end((error, res) => {
189214
res.should.have.status(200)
@@ -207,7 +232,7 @@ describe('*********** USERS ***********', () => {
207232
chai
208233
.request(server)
209234
.patch(`/users/${id}`)
210-
.set('Authorization', `Bearer ${token}`)
235+
.set('Authorization', `Bearer ${tokens.admin}`)
211236
.send(user)
212237
.end((err, res) => {
213238
res.should.have.status(422)
@@ -216,6 +241,25 @@ describe('*********** USERS ***********', () => {
216241
done()
217242
})
218243
})
244+
it('it should NOT UPDATE another user if not an admin', done => {
245+
const id = createdID.slice(-1).pop()
246+
const user = {
247+
name: faker.random.words(),
248+
email: 'toto@toto.com',
249+
role: 'user'
250+
}
251+
chai
252+
.request(server)
253+
.patch(`/users/${id}`)
254+
.set('Authorization', `Bearer ${tokens.user}`)
255+
.send(user)
256+
.end((err, res) => {
257+
res.should.have.status(401)
258+
res.body.should.be.a('object')
259+
res.body.should.have.property('errors')
260+
done()
261+
})
262+
})
219263
})
220264
describe('/DELETE/:id user', () => {
221265
it('it should DELETE a user given the id', done => {
@@ -233,7 +277,7 @@ describe('*********** USERS ***********', () => {
233277
chai
234278
.request(server)
235279
.post('/users')
236-
.set('Authorization', `Bearer ${token}`)
280+
.set('Authorization', `Bearer ${tokens.admin}`)
237281
.send(user)
238282
.end((err, res) => {
239283
res.should.have.status(201)
@@ -242,7 +286,7 @@ describe('*********** USERS ***********', () => {
242286
chai
243287
.request(server)
244288
.delete(`/users/${res.body._id}`)
245-
.set('Authorization', `Bearer ${token}`)
289+
.set('Authorization', `Bearer ${tokens.admin}`)
246290
.end((error, result) => {
247291
result.should.have.status(200)
248292
result.body.should.be.a('object')

0 commit comments

Comments
 (0)