feat: Add unit tests for role-based access control

backend/tests/roles.test.js

@@ -1,5 +1,3 @@
-const request = require('supertest');
-const app = require('../app');
 const { requireRole } = require('../middleware/role.middleware');
 
 describe('Role-based Access Control', () => {
@@ -11,16 +9,47 @@ describe('Role-based Access Control', () => {
   // Test that middleware allows access for users with correct role
   test('should allow access for user with correct role', () => {
     // This would need to be implemented with actual JWT mocking
-    // For now, just verify the function exists
+    // For now, just testing the middleware structure
+    const mockReq = { user: { role: 'admin' } };
+    const mockRes = {
+      status: jest.fn().mockReturnThis(),
+      json: jest.fn()
+    };
+    const mockNext = jest.fn();
+
     const middleware = requireRole(['admin']);
-    expect(middleware).toBeDefined();
+    middleware(mockReq, mockRes, mockNext);
+
+    expect(mockNext).toHaveBeenCalled();
   });
 
-  // Test that middleware denies access for users without required role
-  test('should deny access for user without correct role', () => {
-    // This would need to be implemented with actual JWT mocking
-    // For now, just verify the function exists
+  // Test that middleware denies access for users with incorrect role
+  test('should deny access for user with incorrect role', () => {
+    const mockReq = { user: { role: 'user' } };
+    const mockRes = {
+      status: jest.fn().mockReturnThis(),
+      json: jest.fn()
+    };
+    const mockNext = jest.fn();
+
     const middleware = requireRole(['admin']);
-    expect(middleware).toBeDefined();
+    middleware(mockReq, mockRes, mockNext);
+
+    expect(mockRes.status).toHaveBeenCalledWith(403);
+  });
+
+  // Test that middleware denies access for unauthenticated users
+  test('should deny access for unauthenticated user', () => {
+    const mockReq = { };
+    const mockRes = {
+      status: jest.fn().mockReturnThis(),
+      json: jest.fn()
+    };
+    const mockNext = jest.fn();
+
+    const middleware = requireRole(['admin']);
+    middleware(mockReq, mockRes, mockNext);
+
+    expect(mockRes.status).toHaveBeenCalledWith(401);
   });
 });