79 lines
3.4 KiB
JavaScript
79 lines
3.4 KiB
JavaScript
import { test, after } from 'node:test'
|
|
import assert from 'node:assert/strict'
|
|
import { Router } from 'express'
|
|
import { startAppwriteMock } from './support/appwriteMock.js'
|
|
import { startFakeStripe } from './support/fakeStripe.js'
|
|
import { useTestEnv } from './support/testEnv.js'
|
|
|
|
// Team-Eingang /api/team: Appwrite-JWT aus dem Ticketsystem, jeder Mitarbeiter (nicht nur Label admin)
|
|
const aw = await startAppwriteMock()
|
|
const st = await startFakeStripe()
|
|
useTestEnv({ appwriteUrl: aw.url, stripeUrl: st.url })
|
|
const { startTestApp, rawGet } = await import('./support/testApp.js')
|
|
const { requireStaffJwt } = await import('../server/middleware/staffJwt.js')
|
|
const { corsMiddleware } = await import('../server/middleware/cors.js')
|
|
|
|
const probeRouter = Router()
|
|
probeRouter.use(requireStaffJwt)
|
|
probeRouter.get('/', (req, res) => res.json(req.session))
|
|
|
|
const app = await startTestApp({
|
|
'/': corsMiddleware(['https://ticket.webklar.com']),
|
|
'/probe': probeRouter,
|
|
})
|
|
after(() => Promise.all([app.close(), aw.close(), st.close()]))
|
|
|
|
aw.seed('employees', { $id: 'e_staff2', userId: 'u_staff2', displayName: 'Andrej', email: 'andrej@webklar.com' })
|
|
aw.seed('employees', { $id: 'e_nico', userId: '', displayName: 'Nico', email: 'nico@webklar.com' })
|
|
|
|
const probe = (jwt) => rawGet('/probe', jwt ? { headers: { authorization: `Bearer ${jwt}` } } : {})
|
|
|
|
test('ohne, ungueltiges und halbes JWT -> 401', async () => {
|
|
for (const jwt of [null, 'jwt-falsch', 'jwt-halb']) assert.equal((await probe(jwt)).status, 401, String(jwt))
|
|
})
|
|
|
|
test('Kunde (kein Mitarbeiter, kein Label) -> 403', async () => {
|
|
const res = await probe('jwt-kunde')
|
|
assert.equal(res.status, 403)
|
|
assert.equal(res.body.error, 'Kein Mitarbeiterkonto.')
|
|
})
|
|
|
|
test('Mail gleicht Mitarbeiter, ist aber unbestaetigt -> 403', async () => {
|
|
assert.equal((await probe('jwt-mail-ungeprueft')).status, 403)
|
|
})
|
|
|
|
test('bestaetigte Mail eines Mitarbeiters ohne userId -> erlaubt', async () => {
|
|
const res = await probe('jwt-mail-geprueft')
|
|
assert.equal(res.status, 200)
|
|
assert.equal(res.body.name, 'Nico')
|
|
assert.equal(res.body.appwriteUserId, 'u_neu')
|
|
})
|
|
|
|
test('Mitarbeiter ohne Admin-Label -> erlaubt, Sitzung in Admin-Form', async () => {
|
|
const res = await probe('jwt-staff')
|
|
assert.equal(res.status, 200)
|
|
assert.deepEqual(res.body, { role: 'admin', isAdmin: false, appwriteUserId: 'u_staff2', name: 'Andrej', email: 'andrej@webklar.com' })
|
|
})
|
|
|
|
test('Label admin ohne employees-Eintrag -> erlaubt, isAdmin true', async () => {
|
|
const res = await probe('jwt-admin')
|
|
assert.equal(res.status, 200)
|
|
assert.equal(res.body.isAdmin, true)
|
|
})
|
|
|
|
test('CORS: erlaubte Herkunft bekommt die Upload-Header, fremde nichts', async () => {
|
|
const ok = await rawGet('/probe', { headers: { origin: 'https://ticket.webklar.com' } })
|
|
assert.equal(ok.headers.get('access-control-allow-origin'), 'https://ticket.webklar.com')
|
|
assert.equal(
|
|
ok.headers.get('access-control-allow-headers'),
|
|
'Authorization, Content-Type, X-File-Name, X-Attachment-Kind, X-Duration-Ms, X-Image-Width, X-Image-Height'
|
|
)
|
|
const bad = await rawGet('/probe', { headers: { origin: 'https://evil.example' } })
|
|
assert.equal(bad.headers.get('access-control-allow-origin'), null)
|
|
})
|
|
|
|
test('CORS: Preflight der erlaubten Herkunft -> 204 ohne JWT-Pruefung', async () => {
|
|
const res = await fetch(`${app.url}/probe`, { method: 'OPTIONS', headers: { origin: 'https://ticket.webklar.com' } })
|
|
assert.equal(res.status, 204)
|
|
})
|