feat: Add role-based access control tests and fix middleware export

This commit adds comprehensive unit tests for the role-based access control middleware and fixes the ES module export issue. The tests verify that users with correct roles can access protected routes, while users with incorrect roles or no authentication are properly denied access.

backend/middleware/role.middleware.js

@@ -23,4 +23,4 @@ const requireRole = (requiredRoles) => {
   };
 };
 
-module.exports = { requireRole };
+export { requireRole };

backend/tests/roles.test.js

@@ -1,55 +1,88 @@
-const { requireRole } = require('../middleware/role.middleware');
+import request from 'supertest';
+import app from '../app.js';
+import { requireRole } from '../middleware/role.middleware.js';
 
 describe('Role-based Access Control', () => {
-  // Test that the middleware exists and is a function
+  // Test that the middleware is properly exported
   test('requireRole should be a function', () => {
     expect(typeof requireRole).toBe('function');
   });
 
-  // Test that middleware allows access for users with correct role
+  // Mock user authentication for testing
-  test('should allow access for user with correct role', () => {
+  const mockUser = (role) => {
-    // This would need to be implemented with actual JWT mocking
+    return {
-    // For now, just testing the middleware structure
+      role: role,
-    const mockReq = { user: { role: 'admin' } };
+      id: 'test-user-id'
-    const mockRes = {
+    };
+  };
+
+  // Test that middleware allows access to users with correct roles
+  test('should allow access to users with correct roles', () => {
+    const req = {
+      user: mockUser('admin')
+    };
+    const res = {
       status: jest.fn().mockReturnThis(),
       json: jest.fn()
     };
-    const mockNext = jest.fn();
+    const next = jest.fn();
 
     const middleware = requireRole(['admin']);
-    middleware(mockReq, mockRes, mockNext);
+    middleware(req, res, next);
 
-    expect(mockNext).toHaveBeenCalled();
+    expect(next).toHaveBeenCalled();
   });
 
-  // Test that middleware denies access for users with incorrect role
+  // Test that middleware denies access to users with incorrect roles
-  test('should deny access for user with incorrect role', () => {
+  test('should deny access to users with incorrect roles', () => {
-    const mockReq = { user: { role: 'user' } };
+    const req = {
-    const mockRes = {
+      user: mockUser('user')
+    };
+    const res = {
       status: jest.fn().mockReturnThis(),
       json: jest.fn()
     };
-    const mockNext = jest.fn();
+    const next = jest.fn();
 
     const middleware = requireRole(['admin']);
-    middleware(mockReq, mockRes, mockNext);
+    middleware(req, res, next);
 
-    expect(mockRes.status).toHaveBeenCalledWith(403);
+    expect(res.status).toHaveBeenCalledWith(403);
+    expect(res.json).toHaveBeenCalledWith({ error: 'Insufficient permissions' });
   });
 
-  // Test that middleware denies access for unauthenticated users
+  // Test that middleware denies access to unauthenticated users
-  test('should deny access for unauthenticated user', () => {
+  test('should deny access to unauthenticated users', () => {
-    const mockReq = { };
+    const req = {
-    const mockRes = {
+      user: null
+    };
+    const res = {
       status: jest.fn().mockReturnThis(),
       json: jest.fn()
     };
-    const mockNext = jest.fn();
+    const next = jest.fn();
 
     const middleware = requireRole(['admin']);
-    middleware(mockReq, mockRes, mockNext);
+    middleware(req, res, next);
 
-    expect(mockRes.status).toHaveBeenCalledWith(401);
+    expect(res.status).toHaveBeenCalledWith(401);
+    expect(res.json).toHaveBeenCalledWith({ error: 'Authentication required' });
+  });
+
+  // Test that middleware allows access to users with one of multiple roles
+  test('should allow access to users with one of multiple roles', () => {
+    const req = {
+      user: mockUser('moderator')
+    };
+    const res = {
+      status: jest.fn().mockReturnThis(),
+      json: jest.fn()
+    };
+    const next = jest.fn();
+
+    const middleware = requireRole(['admin', 'moderator']);
+    middleware(req, res, next);
+
+    expect(next).toHaveBeenCalled();
   });
 });