Created
October 2, 2025 07:41
-
-
Save laureaudubon1/d99730fdfd6ddaec5167e12c05bffae0 to your computer and use it in GitHub Desktop.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| import request from 'supertest'; | |
| import { E2ETestEnvironment } from '@/test/utils/e2e-test-environment'; | |
| import { SeededData } from '@/db/seed/utils'; | |
| import { adminUser, researcherUser } from '@/db/seed/fixtures'; | |
| describe('ResearchersController - Access Control (e2e)', () => { | |
| let env: E2ETestEnvironment; | |
| let data: SeededData; | |
| let adminToken: string; | |
| let researcherToken: string; | |
| beforeAll(async () => { | |
| env = await E2ETestEnvironment.builder() | |
| .withDatabase('researchers_access') | |
| .withNestApp() | |
| .withResearcherAuth() | |
| .seedData((seeder) => | |
| seeder | |
| .addResearcher('admin', adminUser()) | |
| .addResearcher('researcher', researcherUser()), | |
| ) | |
| .build(); | |
| data = env.getSeededData(); | |
| adminToken = env.getResearcherToken('admin'); | |
| researcherToken = env.getResearcherToken('researcher'); | |
| }, 60000); | |
| afterAll(async () => { | |
| if (env) { | |
| await env.cleanup(); | |
| } | |
| }); | |
| describe('GET /researchers', () => { | |
| it('should allow admin to access researchers list', async () => { | |
| const response = await request(env.getApp().getHttpServer()) | |
| .get('/researchers') | |
| .set('Authorization', `Bearer ${adminToken}`) | |
| .expect(200); | |
| expect(response.body).toMatchObject([ | |
| { | |
| id: expect.any(String), | |
| email: expect.any(String), | |
| firstName: expect.any(String), | |
| lastName: expect.any(String), | |
| createdAt: expect.any(String), | |
| role: expect.any(String), | |
| }, | |
| { | |
| id: expect.any(String), | |
| email: expect.any(String), | |
| firstName: expect.any(String), | |
| lastName: expect.any(String), | |
| createdAt: expect.any(String), | |
| role: expect.any(String), | |
| }, | |
| ]); | |
| }); | |
| it('should deny researcher access to researchers list', async () => { | |
| await request(env.getApp().getHttpServer()) | |
| .get('/researchers') | |
| .set('Authorization', `Bearer ${researcherToken}`) | |
| .expect(403); | |
| }); | |
| it('should require authentication', async () => { | |
| await request(env.getApp().getHttpServer()) | |
| .get('/researchers') | |
| .expect(401); | |
| }); | |
| }); | |
| describe('GET /researchers/:id', () => { | |
| it('should deny researcher access to specific researcher details', async () => { | |
| await request(env.getApp().getHttpServer()) | |
| .get(`/researchers/${data.researchers.get('admin').id}`) | |
| .set('Authorization', `Bearer ${researcherToken}`) | |
| .expect(403); | |
| }); | |
| }); | |
| }); |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment