Skip to content

Commit 7368322

Browse files
author
Vikas Agarwal
committed
added unit tests for phase and products for validating the add/update/delete access updates. Customers should not be able to do that.
1 parent b7d0535 commit 7368322

File tree

13 files changed

+460
-94
lines changed

13 files changed

+460
-94
lines changed

‎package-lock.json‎

Lines changed: 24 additions & 46 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎package.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,7 @@
5050
"express-validation": "^0.6.0",
5151
"http-aws-es": "^1.1.3",
5252
"joi": "^8.0.5",
53+
"jsonwebtoken": "^8.3.0",
5354
"lodash": "^4.16.4",
5455
"method-override": "^2.3.9",
5556
"pg": "^4.5.5",

‎src/routes/phaseProducts/create.spec.js‎

Lines changed: 38 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,20 @@ const body = {
2121
describe('Phase Products', () => {
2222
let projectId;
2323
let phaseId;
24+
const memberUser = {
25+
handle: testUtil.getDecodedToken(testUtil.jwts.member).handle,
26+
userId: testUtil.getDecodedToken(testUtil.jwts.member).userId,
27+
firstName: 'fname',
28+
lastName: 'lName',
29+
email: 'some@abc.com',
30+
};
31+
const copilotUser = {
32+
handle: testUtil.getDecodedToken(testUtil.jwts.copilot).handle,
33+
userId: testUtil.getDecodedToken(testUtil.jwts.copilot).userId,
34+
firstName: 'fname',
35+
lastName: 'lName',
36+
email: 'some@abc.com',
37+
};
2438
before((done) => {
2539
// mocks
2640
testUtil.clearDb()
@@ -37,14 +51,23 @@ describe('Phase Products', () => {
3751
}).then((p) => {
3852
projectId = p.id;
3953
// create members
40-
models.ProjectMember.create({
41-
userId: 40051332,
54+
models.ProjectMember.bulkCreate([{
55+
id: 1,
56+
userId: copilotUser.userId,
4257
projectId,
4358
role: 'copilot',
59+
isPrimary: false,
60+
createdBy: 1,
61+
updatedBy: 1,
62+
}, {
63+
id: 2,
64+
userId: memberUser.userId,
65+
projectId,
66+
role: 'customer',
4467
isPrimary: true,
4568
createdBy: 1,
4669
updatedBy: 1,
47-
}).then(() => {
70+
}]).then(() => {
4871
models.ProjectPhase.create({
4972
name: 'test project phase',
5073
status: 'active',
@@ -72,7 +95,18 @@ describe('Phase Products', () => {
7295
});
7396

7497
describe('POST /projects/{projectId}/phases/{phaseId}/products', () => {
75-
it('should return 403 if user does not have permissions', (done) => {
98+
it('should return 403 if user does not have permissions (non team member)', (done) => {
99+
request(server)
100+
.post(`/v4/projects/${projectId}/phases/${phaseId}/products`)
101+
.set({
102+
Authorization: `Bearer ${testUtil.jwts.member2}`,
103+
})
104+
.send({ param: body })
105+
.expect('Content-Type', /json/)
106+
.expect(403, done);
107+
});
108+
109+
it('should return 403 if user does not have permissions (customer)', (done) => {
76110
request(server)
77111
.post(`/v4/projects/${projectId}/phases/${phaseId}/products`)
78112
.set({

‎src/routes/phaseProducts/delete.spec.js‎

Lines changed: 37 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,20 @@ describe('Phase Products', () => {
2121
let projectId;
2222
let phaseId;
2323
let productId;
24+
const memberUser = {
25+
handle: testUtil.getDecodedToken(testUtil.jwts.member).handle,
26+
userId: testUtil.getDecodedToken(testUtil.jwts.member).userId,
27+
firstName: 'fname',
28+
lastName: 'lName',
29+
email: 'some@abc.com',
30+
};
31+
const copilotUser = {
32+
handle: testUtil.getDecodedToken(testUtil.jwts.copilot).handle,
33+
userId: testUtil.getDecodedToken(testUtil.jwts.copilot).userId,
34+
firstName: 'fname',
35+
lastName: 'lName',
36+
email: 'some@abc.com',
37+
};
2438
before((done) => {
2539
// mocks
2640
testUtil.clearDb()
@@ -37,14 +51,23 @@ describe('Phase Products', () => {
3751
}).then((p) => {
3852
projectId = p.id;
3953
// create members
40-
models.ProjectMember.create({
41-
userId: 40051332,
54+
models.ProjectMember.bulkCreate([{
55+
id: 1,
56+
userId: copilotUser.userId,
4257
projectId,
4358
role: 'copilot',
59+
isPrimary: false,
60+
createdBy: 1,
61+
updatedBy: 1,
62+
}, {
63+
id: 2,
64+
userId: memberUser.userId,
65+
projectId,
66+
role: 'customer',
4467
isPrimary: true,
4568
createdBy: 1,
4669
updatedBy: 1,
47-
}).then(() => {
70+
}]).then(() => {
4871
models.ProjectPhase.create({
4972
name: 'test project phase',
5073
status: 'active',
@@ -77,7 +100,17 @@ describe('Phase Products', () => {
77100
});
78101

79102
describe('DELETE /projects/{id}/phases/{phaseId}/products/{productId}', () => {
80-
it('should return 403 when user have no permission', (done) => {
103+
it('should return 403 when user have no permission (non team member)', (done) => {
104+
request(server)
105+
.delete(`/v4/projects/${projectId}/phases/${phaseId}/products/${productId}`)
106+
.set({
107+
Authorization: `Bearer ${testUtil.jwts.member2}`,
108+
})
109+
.expect('Content-Type', /json/)
110+
.expect(403, done);
111+
});
112+
113+
it('should return 403 when user have no permission (customer)', (done) => {
81114
request(server)
82115
.delete(`/v4/projects/${projectId}/phases/${phaseId}/products/${productId}`)
83116
.set({

‎src/routes/phaseProducts/get.spec.js‎

Lines changed: 53 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,20 @@ describe('Phase Products', () => {
2424
let projectId;
2525
let phaseId;
2626
let productId;
27+
const memberUser = {
28+
handle: testUtil.getDecodedToken(testUtil.jwts.member).handle,
29+
userId: testUtil.getDecodedToken(testUtil.jwts.member).userId,
30+
firstName: 'fname',
31+
lastName: 'lName',
32+
email: 'some@abc.com',
33+
};
34+
const copilotUser = {
35+
handle: testUtil.getDecodedToken(testUtil.jwts.copilot).handle,
36+
userId: testUtil.getDecodedToken(testUtil.jwts.copilot).userId,
37+
firstName: 'fname',
38+
lastName: 'lName',
39+
email: 'some@abc.com',
40+
};
2741
before((done) => {
2842
// mocks
2943
testUtil.clearDb()
@@ -40,14 +54,23 @@ describe('Phase Products', () => {
4054
}).then((p) => {
4155
projectId = p.id;
4256
// create members
43-
models.ProjectMember.create({
44-
userId: 40051332,
57+
models.ProjectMember.bulkCreate([{
58+
id: 1,
59+
userId: copilotUser.userId,
4560
projectId,
4661
role: 'copilot',
62+
isPrimary: false,
63+
createdBy: 1,
64+
updatedBy: 1,
65+
}, {
66+
id: 2,
67+
userId: memberUser.userId,
68+
projectId,
69+
role: 'customer',
4770
isPrimary: true,
4871
createdBy: 1,
4972
updatedBy: 1,
50-
}).then(() => {
73+
}]).then(() => {
5174
models.ProjectPhase.create({
5275
name: 'test project phase',
5376
status: 'active',
@@ -80,11 +103,11 @@ describe('Phase Products', () => {
80103
});
81104

82105
describe('GET /projects/{id}/phases/{phaseId}/products/{productId}', () => {
83-
it('should return 403 when user have no permission', (done) => {
106+
it('should return 403 when user have no permission (non team member)', (done) => {
84107
request(server)
85108
.get(`/v4/projects/${projectId}/phases/${phaseId}/products/${productId}`)
86109
.set({
87-
Authorization: `Bearer ${testUtil.jwts.member}`,
110+
Authorization: `Bearer ${testUtil.jwts.member2}`,
88111
})
89112
.expect('Content-Type', /json/)
90113
.expect(403, done);
@@ -120,7 +143,31 @@ describe('Phase Products', () => {
120143
.expect(404, done);
121144
});
122145

123-
it('should return 1 phase when user have project permission', (done) => {
146+
it('should return 1 phase when user have project permission (customer)', (done) => {
147+
request(server)
148+
.get(`/v4/projects/${projectId}/phases/${phaseId}/products/${productId}`)
149+
.set({
150+
Authorization: `Bearer ${testUtil.jwts.member}`,
151+
})
152+
.expect('Content-Type', /json/)
153+
.expect(200)
154+
.end((err, res) => {
155+
if (err) {
156+
done(err);
157+
} else {
158+
const resJson = res.body.result.content;
159+
should.exist(resJson);
160+
resJson.name.should.be.eql(body.name);
161+
resJson.type.should.be.eql(body.type);
162+
resJson.estimatedPrice.should.be.eql(body.estimatedPrice);
163+
resJson.actualPrice.should.be.eql(body.actualPrice);
164+
resJson.details.should.be.eql(body.details);
165+
done();
166+
}
167+
});
168+
});
169+
170+
it('should return 1 phase when user have project permission (copilot)', (done) => {
124171
request(server)
125172
.get(`/v4/projects/${projectId}/phases/${phaseId}/products/${productId}`)
126173
.set({

0 commit comments

Comments
 (0)