Sistemato magazzino

scouthub-magazzino-be/tests/integration/categorie.endpoint.test.ts

@@ -0,0 +1,237 @@
+import { generateKeyPairSync } from 'crypto';
+import request from 'supertest';
+import nock from 'nock';
+import jwt from 'jsonwebtoken';
+
+process.env.KEYCLOAK_BASE_URL = 'http://keycloak.test';
+process.env.KEYCLOAK_REALM = 'scouthub';
+process.env.KEYCLOAK_MAGAZZINO_CLIENT_ID = 'test-client';
+process.env.KEYCLOAK_MAGAZZINO_CLIENT_SECRET = 'test-secret';
+process.env.DATABASE_URL = 'postgresql://user:pass@localhost:5432/scouthub_magazzino_test';
+
+const categoriaFindMany = jest.fn();
+const categoriaFindUnique = jest.fn();
+const categoriaCreate = jest.fn();
+const categoriaUpdate = jest.fn();
+const categoriaDelete = jest.fn();
+
+jest.mock('../../src/db/prisma', () => ({
+  prisma: {
+    categoria: {
+      findMany: (...args: unknown[]) => categoriaFindMany(...args),
+      findUnique: (...args: unknown[]) => categoriaFindUnique(...args),
+      create: (...args: unknown[]) => categoriaCreate(...args),
+      update: (...args: unknown[]) => categoriaUpdate(...args),
+      delete: (...args: unknown[]) => categoriaDelete(...args),
+    },
+  },
+}));
+
+import { app } from '../../src/app';
+
+const KEYCLOAK_HOST = 'http://keycloak.test';
+const CERTS_PATH = '/realms/scouthub/protocol/openid-connect/certs';
+const KID = 'test-kid';
+
+const { publicKey, privateKey } = generateKeyPairSync('rsa', { modulusLength: 2048 });
+const jwk = publicKey.export({ format: 'jwk' }) as Record<string, unknown>;
+const privateKeyPem = privateKey.export({ type: 'pkcs1', format: 'pem' }) as string;
+
+function signToken(payload: object): string {
+  return jwt.sign(payload, privateKeyPem, { algorithm: 'RS256', keyid: KID, expiresIn: '5m' });
+}
+
+function utenteToken(orgId = 'org-1'): string {
+  return signToken({
+    sub: 'user-1',
+    realm_access: { roles: ['censito'] },
+    organization: { 'gruppo-alfa': { id: orgId, roles: [] } },
+  });
+}
+
+function adminCatalogoToken(): string {
+  return signToken({
+    sub: 'admin-1',
+    realm_access: { roles: ['moderatore'] },
+    organization: { 'gruppo-omega': { id: 'org-9', roles: [] } },
+  });
+}
+
+beforeAll(() => {
+  nock(KEYCLOAK_HOST).persist().get(CERTS_PATH).reply(200, {
+    keys: [{ ...jwk, kid: KID, alg: 'RS256', use: 'sig' }],
+  });
+});
+
+afterAll(() => {
+  nock.cleanAll();
+});
+
+beforeEach(() => {
+  jest.clearAllMocks();
+});
+
+describe('GET /categorie', () => {
+  test('un utente normale non può accedere', async () => {
+    const response = await request(app).get('/categorie').set('Authorization', `Bearer ${utenteToken()}`);
+
+    expect(response.status).toBe(403);
+    expect(categoriaFindMany).not.toHaveBeenCalled();
+  });
+
+  test('un moderatore vede tutte le categorie', async () => {
+    categoriaFindMany.mockResolvedValueOnce([{ id: 'c-1', nome: 'Cucina', stato: 'confermata' }]);
+
+    const response = await request(app).get('/categorie').set('Authorization', `Bearer ${adminCatalogoToken()}`);
+
+    expect(response.status).toBe(200);
+    expect(response.body).toEqual([{ id: 'c-1', nome: 'Cucina', stato: 'confermata' }]);
+  });
+
+  test('risponde 401 senza token', async () => {
+    const response = await request(app).get('/categorie');
+
+    expect(response.status).toBe(401);
+    expect(categoriaFindMany).not.toHaveBeenCalled();
+  });
+});
+
+describe('POST /categorie', () => {
+  test('un utente normale non può creare una categoria direttamente', async () => {
+    const response = await request(app)
+      .post('/categorie')
+      .set('Authorization', `Bearer ${utenteToken()}`)
+      .send({ nome: 'Campeggio' });
+
+    expect(response.status).toBe(403);
+    expect(categoriaCreate).not.toHaveBeenCalled();
+  });
+
+  test('un moderatore crea una categoria già confermata', async () => {
+    categoriaCreate.mockResolvedValueOnce({ id: 'c-2', nome: 'Campeggio', stato: 'confermata' });
+
+    const response = await request(app)
+      .post('/categorie')
+      .set('Authorization', `Bearer ${adminCatalogoToken()}`)
+      .send({ nome: 'Campeggio' });
+
+    expect(response.status).toBe(201);
+    expect(categoriaCreate).toHaveBeenCalledWith({ data: { nome: 'Campeggio', stato: 'confermata' } });
+  });
+});
+
+describe('PUT /categorie/:id', () => {
+  test('un moderatore può modificare una categoria', async () => {
+    categoriaUpdate.mockResolvedValueOnce({ id: 'c-1', nome: 'Cucina da campo', stato: 'confermata' });
+
+    const response = await request(app)
+      .put('/categorie/c-1')
+      .set('Authorization', `Bearer ${adminCatalogoToken()}`)
+      .send({ nome: 'Cucina da campo' });
+
+    expect(response.status).toBe(200);
+    expect(categoriaUpdate).toHaveBeenCalledWith({ where: { id: 'c-1' }, data: { nome: 'Cucina da campo' } });
+  });
+});
+
+describe('DELETE /categorie/:id', () => {
+  test('un moderatore può eliminare una categoria', async () => {
+    categoriaDelete.mockResolvedValueOnce({ id: 'c-1' });
+
+    const response = await request(app).delete('/categorie/c-1').set('Authorization', `Bearer ${adminCatalogoToken()}`);
+
+    expect(response.status).toBe(204);
+    expect(categoriaDelete).toHaveBeenCalledWith({ where: { id: 'c-1' } });
+  });
+});
+
+describe('POST /categorie/proposte', () => {
+  test("un utente autenticato con un'org propone una categoria, che nasce 'da_approvare'", async () => {
+    categoriaCreate.mockResolvedValueOnce({
+      id: 'c-3',
+      nome: 'Escursionismo',
+      stato: 'da_approvare',
+      creatoDaOrgId: 'org-1',
+    });
+
+    const response = await request(app)
+      .post('/categorie/proposte')
+      .set('Authorization', `Bearer ${utenteToken('org-1')}`)
+      .send({ nome: 'Escursionismo' });
+
+    expect(response.status).toBe(201);
+    expect(response.body).toMatchObject({ stato: 'da_approvare', creatoDaOrgId: 'org-1' });
+    expect(categoriaCreate).toHaveBeenCalledWith({
+      data: { nome: 'Escursionismo', stato: 'da_approvare', creatoDaOrgId: 'org-1' },
+    });
+  });
+
+  test('risponde 401 senza token', async () => {
+    const response = await request(app).post('/categorie/proposte').send({ nome: 'Escursionismo' });
+
+    expect(response.status).toBe(401);
+    expect(categoriaCreate).not.toHaveBeenCalled();
+  });
+});
+
+describe('POST /categorie/:id/approva', () => {
+  test('un moderatore può approvare una categoria proposta', async () => {
+    categoriaFindUnique.mockResolvedValueOnce({ id: 'c-3', nome: 'Escursionismo', stato: 'da_approvare' });
+    categoriaUpdate.mockResolvedValueOnce({ id: 'c-3', nome: 'Escursionismo', stato: 'confermata' });
+
+    const response = await request(app)
+      .post('/categorie/c-3/approva')
+      .set('Authorization', `Bearer ${adminCatalogoToken()}`);
+
+    expect(response.status).toBe(200);
+    expect(response.body.stato).toBe('confermata');
+    expect(categoriaUpdate).toHaveBeenCalledWith({ where: { id: 'c-3' }, data: { stato: 'confermata' } });
+  });
+
+  test('risponde 409 se la categoria è già confermata', async () => {
+    categoriaFindUnique.mockResolvedValueOnce({ id: 'c-1', nome: 'Cucina', stato: 'confermata' });
+
+    const response = await request(app)
+      .post('/categorie/c-1/approva')
+      .set('Authorization', `Bearer ${adminCatalogoToken()}`);
+
+    expect(response.status).toBe(409);
+    expect(categoriaUpdate).not.toHaveBeenCalled();
+  });
+
+  test('risponde 404 se la categoria non esiste', async () => {
+    categoriaFindUnique.mockResolvedValueOnce(null);
+
+    const response = await request(app)
+      .post('/categorie/inesistente/approva')
+      .set('Authorization', `Bearer ${adminCatalogoToken()}`);
+
+    expect(response.status).toBe(404);
+    expect(categoriaUpdate).not.toHaveBeenCalled();
+  });
+});
+
+describe('POST /categorie/:id/rifiuta', () => {
+  test('un moderatore può rifiutare una categoria proposta, che viene eliminata', async () => {
+    categoriaFindUnique.mockResolvedValueOnce({ id: 'c-3', nome: 'Escursionismo', stato: 'da_approvare' });
+    categoriaDelete.mockResolvedValueOnce({ id: 'c-3' });
+
+    const response = await request(app)
+      .post('/categorie/c-3/rifiuta')
+      .set('Authorization', `Bearer ${adminCatalogoToken()}`);
+
+    expect(response.status).toBe(204);
+    expect(categoriaDelete).toHaveBeenCalledWith({ where: { id: 'c-3' } });
+  });
+
+  test('risponde 409 se la categoria è già confermata', async () => {
+    categoriaFindUnique.mockResolvedValueOnce({ id: 'c-1', nome: 'Cucina', stato: 'confermata' });
+
+    const response = await request(app)
+      .post('/categorie/c-1/rifiuta')
+      .set('Authorization', `Bearer ${adminCatalogoToken()}`);
+
+    expect(response.status).toBe(409);
+    expect(categoriaDelete).not.toHaveBeenCalled();
+  });
+});