Fix scouthub-home-be

scouthub-home-be/tests/unit/middleware/requireOrgAccess.test.ts

@@ -0,0 +1,71 @@
+import { Request, Response } from 'express';
+import { requireOrgAccess } from '../../../src/middleware/requireOrgAccess';
+
+function buildReqRes(auth: Partial<Request['auth']> | undefined, orgId: string) {
+  const req = { auth, params: { orgId } } as unknown as Request;
+  const json = jest.fn();
+  const status = jest.fn().mockReturnValue({ json });
+  const res = { status } as unknown as Response;
+  const next = jest.fn();
+  return { req, res, next, status, json };
+}
+
+describe('requireOrgAccess', () => {
+  test('lascia passare admin anche su un orgId diverso dal proprio', () => {
+    const { req, res, next, status } = buildReqRes(
+      { userId: 'u1', email: null, organizationId: 'org-mio', roles: ['admin'] },
+      'org-altrui',
+    );
+
+    requireOrgAccess(req, res, next);
+
+    expect(next).toHaveBeenCalled();
+    expect(status).not.toHaveBeenCalled();
+  });
+
+  test('lascia passare capo-gruppo sulla propria organizzazione', () => {
+    const { req, res, next, status } = buildReqRes(
+      { userId: 'u1', email: null, organizationId: 'org-1', roles: ['capo-gruppo'] },
+      'org-1',
+    );
+
+    requireOrgAccess(req, res, next);
+
+    expect(next).toHaveBeenCalled();
+    expect(status).not.toHaveBeenCalled();
+  });
+
+  test('risponde 403 se capo-gruppo prova ad accedere a un altro orgId', () => {
+    const { req, res, next, status, json } = buildReqRes(
+      { userId: 'u1', email: null, organizationId: 'org-1', roles: ['capo-gruppo'] },
+      'org-2',
+    );
+
+    requireOrgAccess(req, res, next);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(status).toHaveBeenCalledWith(403);
+    expect(json).toHaveBeenCalled();
+  });
+
+  test('risponde 403 se manca il ruolo capo-gruppo (e non è admin)', () => {
+    const { req, res, next, status } = buildReqRes(
+      { userId: 'u1', email: null, organizationId: 'org-1', roles: ['censito'] },
+      'org-1',
+    );
+
+    requireOrgAccess(req, res, next);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(status).toHaveBeenCalledWith(403);
+  });
+
+  test('risponde 403 se req.auth è assente', () => {
+    const { req, res, next, status } = buildReqRes(undefined, 'org-1');
+
+    requireOrgAccess(req, res, next);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(status).toHaveBeenCalledWith(403);
+  });
+});