Add unit tests for role middleware

backend/jest.config.js

@@ -0,0 +1,14 @@
+export default {
+  testEnvironment: 'node',
+  transform: {
+    '^.+\\.js$': 'babel-jest'
+  },
+  testMatch: [
+    '**/tests/**/*.test.js',
+    '**/__tests__/**/*.js'
+  ],
+  moduleNameMapper: {
+    '^src/(.*)$': '<rootDir>/src/$1',
+    '^backend/(.*)$': '<rootDir>/$1'
+  }
+};

backend/package.json

@@ -5,7 +5,7 @@
   "description": "",
   "main": "index.js",
   "scripts": {
-    "test": "npm run test:smoke",
+    "test": "jest",
     "start": "node src/server.js",
     "dev": "node --watch src/server.js",
     "db:init": "node src/db/init.js",
@@ -31,7 +31,12 @@
     "zod": "^4.3.6"
   },
   "devDependencies": {
+    "@babel/core": "^7.29.0",
+    "@babel/preset-env": "^7.29.2",
     "@playwright/test": "^1.58.2",
-    "playwright": "^1.58.2"
+    "babel-jest": "^30.3.0",
+    "jest": "^29.5.0",
+    "playwright": "^1.58.2",
+    "supertest": "^6.3.3"
   }
 }

backend/tests/roles.test.js

@@ -1,25 +1,82 @@
 const request = require('supertest');
-const app = require('../app.js');
+const app = require('../app');
 
-describe('Role-based Access Control', () => {
-  describe('User Role', () => {
-    test('should allow user to access user-specific endpoints', async () => {
-      // This is a placeholder test - actual implementation would need JWT setup
-      expect(true).toBe(true);
-    });
+describe('Role Middleware', () => {
+  // Mock a user with a specific role for testing
+  const mockUserWithRole = (role) => {
+    return {
+      role: role,
+      id: 'test-user-id'
+    };
+  };
+
+  // Test that the middleware allows access to users with correct roles
+  test('should allow access to users with correct roles', () => {
+    const req = {
+      user: mockUserWithRole('admin')
+    };
+    const res = {
+      status: jest.fn().mockReturnThis(),
+      json: jest.fn()
+    };
+    const next = jest.fn();
+
+    const middleware = require('../middleware/role.middleware');
+    middleware.requireRole(['admin'])(req, res, next);
+
+    expect(next).toHaveBeenCalled();
   });
 
-  describe('Moderator Role', () => {
-    test('should allow moderator to access moderation endpoints', async () => {
-      // This is a placeholder test - actual implementation would need JWT setup
-      expect(true).toBe(true);
-    });
+  // Test that the middleware denies access to users with incorrect roles
+  test('should deny access to users with incorrect roles', () => {
+    const req = {
+      user: mockUserWithRole('user')
+    };
+    const res = {
+      status: jest.fn().mockReturnThis(),
+      json: jest.fn()
+    };
+    const next = jest.fn();
+
+    const middleware = require('../middleware/role.middleware');
+    middleware.requireRole(['admin'])(req, res, next);
+
+    expect(res.status).toHaveBeenCalledWith(403);
+    expect(res.json).toHaveBeenCalledWith({ error: 'Forbidden' });
   });
 
-  describe('Admin Role', () => {
-    test('should allow admin to access admin endpoints', async () => {
-      // This is a placeholder test - actual implementation would need JWT setup
-      expect(true).toBe(true);
-    });
+  // Test that the middleware denies access to users without roles
+  test('should deny access to users without roles', () => {
+    const req = {
+      user: null
+    };
+    const res = {
+      status: jest.fn().mockReturnThis(),
+      json: jest.fn()
+    };
+    const next = jest.fn();
+
+    const middleware = require('../middleware/role.middleware');
+    middleware.requireRole(['admin'])(req, res, next);
+
+    expect(res.status).toHaveBeenCalledWith(401);
+    expect(res.json).toHaveBeenCalledWith({ error: 'Unauthorized' });
+  });
+
+  // Test that the middleware allows access to users with one of multiple required roles
+  test('should allow access to users with one of multiple required roles', () => {
+    const req = {
+      user: mockUserWithRole('moderator')
+    };
+    const res = {
+      status: jest.fn().mockReturnThis(),
+      json: jest.fn()
+    };
+    const next = jest.fn();
+
+    const middleware = require('../middleware/role.middleware');
+    middleware.requireRole(['admin', 'moderator'])(req, res, next);
+
+    expect(next).toHaveBeenCalled();
   });
 });