72 lines
2.2 KiB
TypeScript
72 lines
2.2 KiB
TypeScript
import { Request, Response } from 'express';
|
|
import { requireOrgAccess } from '../../../src/middleware/requireOrgAccess';
|
|
|
|
function buildReqRes(auth: Partial<Request['auth']> | undefined, orgId: string) {
|
|
const req = { auth, params: { orgId } } as unknown as Request;
|
|
const json = jest.fn();
|
|
const status = jest.fn().mockReturnValue({ json });
|
|
const res = { status } as unknown as Response;
|
|
const next = jest.fn();
|
|
return { req, res, next, status, json };
|
|
}
|
|
|
|
describe('requireOrgAccess', () => {
|
|
test('lascia passare admin anche su un orgId diverso dal proprio', () => {
|
|
const { req, res, next, status } = buildReqRes(
|
|
{ userId: 'u1', email: null, organizationId: 'org-mio', roles: ['admin'] },
|
|
'org-altrui',
|
|
);
|
|
|
|
requireOrgAccess(req, res, next);
|
|
|
|
expect(next).toHaveBeenCalled();
|
|
expect(status).not.toHaveBeenCalled();
|
|
});
|
|
|
|
test('lascia passare capo-gruppo sulla propria organizzazione', () => {
|
|
const { req, res, next, status } = buildReqRes(
|
|
{ userId: 'u1', email: null, organizationId: 'org-1', roles: ['capo-gruppo'] },
|
|
'org-1',
|
|
);
|
|
|
|
requireOrgAccess(req, res, next);
|
|
|
|
expect(next).toHaveBeenCalled();
|
|
expect(status).not.toHaveBeenCalled();
|
|
});
|
|
|
|
test('risponde 403 se capo-gruppo prova ad accedere a un altro orgId', () => {
|
|
const { req, res, next, status, json } = buildReqRes(
|
|
{ userId: 'u1', email: null, organizationId: 'org-1', roles: ['capo-gruppo'] },
|
|
'org-2',
|
|
);
|
|
|
|
requireOrgAccess(req, res, next);
|
|
|
|
expect(next).not.toHaveBeenCalled();
|
|
expect(status).toHaveBeenCalledWith(403);
|
|
expect(json).toHaveBeenCalled();
|
|
});
|
|
|
|
test('risponde 403 se manca il ruolo capo-gruppo (e non è admin)', () => {
|
|
const { req, res, next, status } = buildReqRes(
|
|
{ userId: 'u1', email: null, organizationId: 'org-1', roles: ['censito'] },
|
|
'org-1',
|
|
);
|
|
|
|
requireOrgAccess(req, res, next);
|
|
|
|
expect(next).not.toHaveBeenCalled();
|
|
expect(status).toHaveBeenCalledWith(403);
|
|
});
|
|
|
|
test('risponde 403 se req.auth è assente', () => {
|
|
const { req, res, next, status } = buildReqRes(undefined, 'org-1');
|
|
|
|
requireOrgAccess(req, res, next);
|
|
|
|
expect(next).not.toHaveBeenCalled();
|
|
expect(status).toHaveBeenCalledWith(403);
|
|
});
|
|
});
|