eletrotupi / tcc/ api/tests/users/update.test.ts5b0a5a6cf15017c93e1dd78af7d46e7eb1c3f262
3.4 KB | 117 lines Raw
1
import { describe, it, expect, afterAll, beforeEach } from 'vitest'
2
import request from 'supertest'
3
import { createApp } from '@app/createApp'
4
import {
5
  buildPrisma,
6
  cleanupTestDb,
7
  createTestUser,
8
  generateTestToken,
9
} from '../test-helper'
10
11
const app = createApp()
12
const db = buildPrisma()
13
14
afterAll(() => db.$disconnect())
15
beforeEach(() => cleanupTestDb(db))
16
17
describe('PUT /users/:id', () => {
18
  it('updates the authenticated user without leaking secrets', async () => {
19
    const user = await createTestUser(db, {
20
      email: 'profile@example.com',
21
      firstName: 'Old',
22
    })
23
24
    const token = generateTestToken(user.id, user.email)
25
26
    const res = await request(app)
27
      .put(`/users/${user.id}`)
28
      .set('Authorization', `Bearer ${token}`)
29
      .send({
30
        user: {
31
          id: user.id,
32
          firstName: 'New',
33
          lastName: 'Name',
34
        },
35
      })
36
37
    expect(res.status).toBe(200)
38
    expect(res.body.user.firstName).toBe('New')
39
    expect(res.body.user.lastName).toBe('Name')
40
    expect(res.body.user.encryptedPassword).toBeUndefined()
41
    expect(res.body.user.passwordResetToken).toBeUndefined()
42
43
    const dbUser = await db.user.findUnique({ where: { id: user.id } })
44
    expect(dbUser!.firstName).toBe('New')
45
  })
46
47
  it('returns 401 without a token', async () => {
48
    const user = await createTestUser(db)
49
50
    const res = await request(app)
51
      .put(`/users/${user.id}`)
52
      .send({ user: { id: user.id, firstName: 'Nope' } })
53
54
    expect(res.status).toBe(401)
55
56
    const dbUser = await db.user.findUnique({ where: { id: user.id } })
57
    expect(dbUser!.firstName).not.toBe('Nope')
58
  })
59
60
  it('forbids updating another user', async () => {
61
    const user = await createTestUser(db)
62
    const victim = await createTestUser(db, {
63
      email: 'victim@example.com',
64
      firstName: 'Victim',
65
    })
66
67
    const token = generateTestToken(user.id, user.email)
68
69
    const res = await request(app)
70
      .put(`/users/${victim.id}`)
71
      .set('Authorization', `Bearer ${token}`)
72
      .send({ user: { id: victim.id, firstName: 'Hacked' } })
73
74
    expect(res.status).toBe(403)
75
76
    const dbVictim = await db.user.findUnique({ where: { id: victim.id } })
77
78
    expect(dbVictim!.firstName).toBe('Victim')
79
  })
80
81
  it('returns 404 when the user no longer exists', async () => {
82
    const token = generateTestToken(999999, 'ghost@example.com')
83
84
    const res = await request(app)
85
      .put('/users/999999')
86
      .set('Authorization', `Bearer ${token}`)
87
      .send({ user: { id: 999999, firstName: 'Ghost' } })
88
89
    expect(res.status).toBe(404)
90
  })
91
92
  it('returns 400 for an invalid email', async () => {
93
    const user = await createTestUser(db)
94
    const token = generateTestToken(user.id, user.email)
95
96
    const res = await request(app)
97
      .put(`/users/${user.id}`)
98
      .set('Authorization', `Bearer ${token}`)
99
      .send({ user: { id: user.id, email: 'not-an-email' } })
100
101
    expect(res.status).toBe(400)
102
    expect(res.body.fields).toBeTruthy()
103
  })
104
105
  it('returns 409 when the email is already taken', async () => {
106
    const user = await createTestUser(db, { email: 'mine@example.com' })
107
    await createTestUser(db, { email: 'taken@example.com' })
108
    const token = generateTestToken(user.id, user.email)
109
110
    const res = await request(app)
111
      .put(`/users/${user.id}`)
112
      .set('Authorization', `Bearer ${token}`)
113
      .send({ user: { id: user.id, email: 'taken@example.com' } })
114
115
    expect(res.status).toBe(409)
116
  })
117
})