94 lines
No EOL
2.7 KiB
JavaScript
94 lines
No EOL
2.7 KiB
JavaScript
const request = require('supertest');
|
|
const app = require('../app');
|
|
const { createUser, createAdminUser } = require('./test-utils');
|
|
|
|
describe('RBAC Integration Tests', () => {
|
|
let userToken;
|
|
let adminToken;
|
|
let testUser;
|
|
|
|
beforeAll(async () => {
|
|
// Create a regular user
|
|
testUser = await createUser({
|
|
name: 'Test User',
|
|
email: 'testuser@example.com',
|
|
password: 'password123',
|
|
role: 'user'
|
|
});
|
|
|
|
// Create an admin user
|
|
const adminUser = await createAdminUser({
|
|
name: 'Admin User',
|
|
email: 'admin@example.com',
|
|
password: 'password123',
|
|
role: 'admin'
|
|
});
|
|
|
|
// Login to get tokens
|
|
const userResponse = await request(app)
|
|
.post('/api/auth/login')
|
|
.send({
|
|
email: testUser.email,
|
|
password: 'password123'
|
|
});
|
|
|
|
const adminResponse = await request(app)
|
|
.post('/api/auth/login')
|
|
.send({
|
|
email: adminUser.email,
|
|
password: 'password123'
|
|
});
|
|
|
|
userToken = userResponse.body.token;
|
|
adminToken = adminResponse.body.token;
|
|
});
|
|
|
|
describe('Protected Routes', () => {
|
|
// Test that regular users cannot access admin-only routes
|
|
it('should deny access to admin-only routes for regular users', async () => {
|
|
const response = await request(app)
|
|
.get('/api/roles')
|
|
.set('Authorization', `Bearer ${userToken}`)
|
|
.expect(403);
|
|
|
|
expect(response.body.error).toBe('Insufficient permissions');
|
|
});
|
|
|
|
// Test that admin users can access admin-only routes
|
|
it('should allow access to admin-only routes for admins', async () => {
|
|
const response = await request(app)
|
|
.get('/api/roles')
|
|
.set('Authorization', `Bearer ${adminToken}`)
|
|
.expect(200);
|
|
|
|
expect(response.body).toBeDefined();
|
|
});
|
|
|
|
// Test that unauthenticated users cannot access protected routes
|
|
it('should deny access to protected routes for unauthenticated users', async () => {
|
|
const response = await request(app)
|
|
.get('/api/roles')
|
|
.expect(401);
|
|
|
|
expect(response.body.error).toBe('Authentication required');
|
|
});
|
|
});
|
|
|
|
describe('Role-based Access Control Middleware', () => {
|
|
// Test that requireRole middleware works correctly
|
|
it('should validate role requirements properly', async () => {
|
|
// This test verifies the middleware logic by testing protected routes
|
|
const response = await request(app)
|
|
.get('/api/roles')
|
|
.set('Authorization', `Bearer ${adminToken}`)
|
|
.expect(200);
|
|
|
|
expect(response.body).toBeDefined();
|
|
});
|
|
});
|
|
|
|
afterAll(async () => {
|
|
// Cleanup test users if needed
|
|
// This would depend on your database setup
|
|
});
|
|
}); |