Skip to content

Instantly share code, notes, and snippets.

Show Gist options
  • Select an option

  • Save laureaudubon1/d99730fdfd6ddaec5167e12c05bffae0 to your computer and use it in GitHub Desktop.

Select an option

Save laureaudubon1/d99730fdfd6ddaec5167e12c05bffae0 to your computer and use it in GitHub Desktop.
import request from 'supertest';
import { E2ETestEnvironment } from '@/test/utils/e2e-test-environment';
import { SeededData } from '@/db/seed/utils';
import { adminUser, researcherUser } from '@/db/seed/fixtures';
describe('ResearchersController - Access Control (e2e)', () => {
let env: E2ETestEnvironment;
let data: SeededData;
let adminToken: string;
let researcherToken: string;
beforeAll(async () => {
env = await E2ETestEnvironment.builder()
.withDatabase('researchers_access')
.withNestApp()
.withResearcherAuth()
.seedData((seeder) =>
seeder
.addResearcher('admin', adminUser())
.addResearcher('researcher', researcherUser()),
)
.build();
data = env.getSeededData();
adminToken = env.getResearcherToken('admin');
researcherToken = env.getResearcherToken('researcher');
}, 60000);
afterAll(async () => {
if (env) {
await env.cleanup();
}
});
describe('GET /researchers', () => {
it('should allow admin to access researchers list', async () => {
const response = await request(env.getApp().getHttpServer())
.get('/researchers')
.set('Authorization', `Bearer ${adminToken}`)
.expect(200);
expect(response.body).toMatchObject([
{
id: expect.any(String),
email: expect.any(String),
firstName: expect.any(String),
lastName: expect.any(String),
createdAt: expect.any(String),
role: expect.any(String),
},
{
id: expect.any(String),
email: expect.any(String),
firstName: expect.any(String),
lastName: expect.any(String),
createdAt: expect.any(String),
role: expect.any(String),
},
]);
});
it('should deny researcher access to researchers list', async () => {
await request(env.getApp().getHttpServer())
.get('/researchers')
.set('Authorization', `Bearer ${researcherToken}`)
.expect(403);
});
it('should require authentication', async () => {
await request(env.getApp().getHttpServer())
.get('/researchers')
.expect(401);
});
});
describe('GET /researchers/:id', () => {
it('should deny researcher access to specific researcher details', async () => {
await request(env.getApp().getHttpServer())
.get(`/researchers/${data.researchers.get('admin').id}`)
.set('Authorization', `Bearer ${researcherToken}`)
.expect(403);
});
});
});
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment