eletrotupi / tcc/ api/tests/users/update.test.tsff12ba99add07246bdaf39737d2c64072be1cfbf
3.3 KB | 117 lines Raw
1
import { describe, it, expect, afterAll, beforeEach } from 'vitest'
2
import request from 'supertest'
3
import { createApp } from '@app/createApp'
4
import {
5
  buildPrisma,
6
  cleanupTestDb,
7
  createTestUser,
8
  generateTestToken,
9
  expectPublicUser,
10
} from '../test-helper'
11
12
const app = createApp()
13
const db = buildPrisma()
14
15
afterAll(() => db.$disconnect())
16
beforeEach(() => cleanupTestDb(db))
17
18
describe('PUT /users/:id', () => {
19
  it('updates the authenticated user without leaking secrets', async () => {
20
    const user = await createTestUser(db, {
21
      email: 'profile@example.com',
22
      firstName: 'Old',
23
    })
24
25
    const token = generateTestToken(user.id, user.email)
26
27
    const res = await request(app)
28
      .put(`/users/${user.id}`)
29
      .set('Authorization', `Bearer ${token}`)
30
      .send({
31
        user: {
32
          id: user.id,
33
          firstName: 'New',
34
          lastName: 'Name',
35
        },
36
      })
37
38
    expect(res.status).toBe(200)
39
    expect(res.body.user.firstName).toBe('New')
40
    expect(res.body.user.lastName).toBe('Name')
41
    expectPublicUser(res.body.user)
42
43
    const dbUser = await db.user.findUnique({ where: { id: user.id } })
44
    expect(dbUser!.firstName).toBe('New')
45
  })
46
47
  it('returns 401 without a token', async () => {
48
    const user = await createTestUser(db)
49
50
    const res = await request(app)
51
      .put(`/users/${user.id}`)
52
      .send({ user: { id: user.id, firstName: 'Nope' } })
53
54
    expect(res.status).toBe(401)
55
56
    const dbUser = await db.user.findUnique({ where: { id: user.id } })
57
    expect(dbUser!.firstName).not.toBe('Nope')
58
  })
59
60
  it('forbids updating another user', async () => {
61
    const user = await createTestUser(db)
62
    const victim = await createTestUser(db, {
63
      email: 'victim@example.com',
64
      firstName: 'Victim',
65
    })
66
67
    const token = generateTestToken(user.id, user.email)
68
69
    const res = await request(app)
70
      .put(`/users/${victim.id}`)
71
      .set('Authorization', `Bearer ${token}`)
72
      .send({ user: { id: victim.id, firstName: 'Hacked' } })
73
74
    expect(res.status).toBe(403)
75
76
    const dbVictim = await db.user.findUnique({ where: { id: victim.id } })
77
78
    expect(dbVictim!.firstName).toBe('Victim')
79
  })
80
81
  it('returns 404 when the user no longer exists', async () => {
82
    const token = generateTestToken(999999, 'ghost@example.com')
83
84
    const res = await request(app)
85
      .put('/users/999999')
86
      .set('Authorization', `Bearer ${token}`)
87
      .send({ user: { id: 999999, firstName: 'Ghost' } })
88
89
    expect(res.status).toBe(404)
90
  })
91
92
  it('returns 400 for an invalid email', async () => {
93
    const user = await createTestUser(db)
94
    const token = generateTestToken(user.id, user.email)
95
96
    const res = await request(app)
97
      .put(`/users/${user.id}`)
98
      .set('Authorization', `Bearer ${token}`)
99
      .send({ user: { id: user.id, email: 'not-an-email' } })
100
101
    expect(res.status).toBe(400)
102
    expect(res.body.fields).toBeTruthy()
103
  })
104
105
  it('returns 409 when the email is already taken', async () => {
106
    const user = await createTestUser(db, { email: 'mine@example.com' })
107
    await createTestUser(db, { email: 'taken@example.com' })
108
    const token = generateTestToken(user.id, user.email)
109
110
    const res = await request(app)
111
      .put(`/users/${user.id}`)
112
      .set('Authorization', `Bearer ${token}`)
113
      .send({ user: { id: user.id, email: 'taken@example.com' } })
114
115
    expect(res.status).toBe(409)
116
  })
117
})