feat(validators): Increased code coverage of validators library to 100%

src/middleware/validators.js

@@ -4,9 +4,22 @@ const getToken = require('../lib/auth')
 const jwt = require('jsonwebtoken')
 const wlogger = require('../lib/wlogger')
 
-async function ensureUser (ctx, next) {
+let _this
+
+class Validators {
+  constructor () {
+    this.User = User
+    this.getToken = getToken
+    this.jwt = jwt
+    this.config = config
+
+    _this = this
+  }
+
+  async ensureUser (ctx, next) {
+    try {
       // console.log(`getToken: ${typeof (getToken)}`)
-  const token = getToken(ctx)
+      const token = _this.getToken(ctx)
 
       if (!token) {
       // console.log(`Err: Token not provided.`)
@@ -17,26 +30,30 @@ async function ensureUser (ctx, next) {
       try {
       // console.log(`token: ${JSON.stringify(token, null, 2)}`)
       // console.log(`config: ${JSON.stringify(config, null, 2)}`)
-    decoded = jwt.verify(token, config.token)
+        decoded = _this.jwt.verify(token, config.token)
       } catch (err) {
       // console.log(`Err: Token could not be decoded: ${err}`)
         ctx.throw(401)
       }
 
-  ctx.state.user = await User.findById(decoded.id, '-password')
+      ctx.state.user = await _this.User.findById(decoded.id, '-password')
       if (!ctx.state.user) {
       // console.log(`Err: Could not find user.`)
         ctx.throw(401)
       }
 
       return next()
-}
+    } catch (error) {
+      ctx.throw(401)
+    }
+  }
 
-// This funciton is almost identical to ensureUser, except at the end, it verifies
-// that the 'type' associated with the user equals 'admin'.
-async function ensureAdmin (ctx, next) {
+  // This funciton is almost identical to ensureUser, except at the end, it verifies
+  // that the 'type' associated with the user equals 'admin'.
+  async ensureAdmin (ctx, next) {
+    try {
       // console.log(`getToken: ${typeof (getToken)}`)
-  const token = getToken(ctx)
+      const token = _this.getToken(ctx)
 
       if (!token) {
         // console.log(`Err: Token not provided.`)
@@ -47,13 +64,13 @@ async function ensureAdmin (ctx, next) {
       try {
         // console.log(`token: ${JSON.stringify(token, null, 2)}`)
         // console.log(`config: ${JSON.stringify(config, null, 2)}`)
-    decoded = jwt.verify(token, config.token)
+        decoded = _this.jwt.verify(token, config.token)
       } catch (err) {
         // console.log(`Err: Token could not be decoded: ${err}`)
         ctx.throw(401)
       }
 
-  ctx.state.user = await User.findById(decoded.id, '-password')
+      ctx.state.user = await _this.User.findById(decoded.id, '-password')
       if (!ctx.state.user) {
         // console.log(`Err: Could not find user.`)
         ctx.throw(401)
@@ -64,16 +81,20 @@ async function ensureAdmin (ctx, next) {
       }
 
       return next()
-}
+    } catch (error) {
+      ctx.throw(401, error.message)
+    }
+  }
 
-// This middleware ensures that the :id used in the API endpoint matches the
-// the ID used in the JWT, or failing that, the ID used in the JWT matches
-// an Admin user. This prevents situations like users updating other users
-// profiles or non-admins deleting users.
-// TODO Tests must be developed before developing this function.
-async function ensureTargetUserOrAdmin (ctx, next) {
+  // This middleware ensures that the :id used in the API endpoint matches the
+  // the ID used in the JWT, or failing that, the ID used in the JWT matches
+  // an Admin user. This prevents situations like users updating other users
+  // profiles or non-admins deleting users.
+  // TODO Tests must be developed before developing this function.
+  async ensureTargetUserOrAdmin (ctx, next) {
+    try {
       // console.log(`getToken: ${typeof (getToken)}`)
-  const token = getToken(ctx)
+      const token = _this.getToken(ctx)
 
       if (!token) {
         // console.log(`Err: Token not provided.`)
@@ -88,13 +109,13 @@ async function ensureTargetUserOrAdmin (ctx, next) {
       try {
         // console.log(`token: ${JSON.stringify(token, null, 2)}`)
         // console.log(`config: ${JSON.stringify(config, null, 2)}`)
-    decoded = jwt.verify(token, config.token)
+        decoded = _this.jwt.verify(token, config.token)
       } catch (err) {
         // console.log(`Err: Token could not be decoded: ${err}`)
         ctx.throw(401)
       }
 
-  ctx.state.user = await User.findById(decoded.id, '-password')
+      ctx.state.user = await _this.User.findById(decoded.id, '-password')
       if (!ctx.state.user) {
         // console.log(`Err: Could not find user.`)
         ctx.throw(401)
@@ -102,6 +123,7 @@ async function ensureTargetUserOrAdmin (ctx, next) {
 
       // console.log(`ctx.state.user: ${JSON.stringify(ctx.state.user, null, 2)}`)
       // Ensure the calling user and the target user are the same.
+
       if (ctx.state.user._id.toString() !== targetId.toString()) {
         wlogger.verbose(
       `Calling user and target user do not match! Calling user: ${
@@ -118,10 +140,10 @@ async function ensureTargetUserOrAdmin (ctx, next) {
       }
 
       return next()
+    } catch (error) {
+      ctx.throw(401, error.message)
+    }
+  }
 }
 
-module.exports = {
-  ensureUser,
-  ensureAdmin,
-  ensureTargetUserOrAdmin
-}
+module.exports = Validators

src/modules/users/router.js

@@ -1,4 +1,6 @@
-const validator = require('../../middleware/validators')
+const VALIDATOR = require('../../middleware/validators')
+const validator = new VALIDATOR()
+
 const CONTROLLER = require('./controller')
 const controller = new CONTROLLER()
 

test/a08-validators.spec.js

@@ -0,0 +1,317 @@
+const assert = require('chai').assert
+const testUtils = require('./utils')
+
+const Validators = require('../src/middleware/validators')
+
+const sinon = require('sinon')
+const mockContext = require('./mocks/ctx-mock').context
+
+const util = require('util')
+util.inspect.defaultOptions = { depth: 1 }
+
+const context = {}
+
+let sandbox
+let uut
+describe('Validators', () => {
+  before(async () => {
+    // console.log(`config: ${JSON.stringify(config, null, 2)}`)
+
+    // Create a second test user.
+    const userObj = {
+      email: 'test2@test.com',
+      password: 'pass2'
+    }
+    const testUser = await testUtils.createUser(userObj)
+    // console.log(`testUser2: ${JSON.stringify(testUser, null, 2)}`)
+
+    context.user = testUser.user
+    context.token = testUser.token
+    context.id = testUser.user._id
+
+    // Get the JWT used to log in as the admin 'system' user.
+    const adminJWT = await testUtils.getAdminJWT()
+    // console.log(`adminJWT: ${adminJWT}`)
+    context.adminJWT = adminJWT
+
+    // const admin = await testUtils.loginAdminUser()
+    // context.adminJWT = admin.token
+
+    // const admin = await adminLib.loginAdmin()
+    // console.log(`admin: ${JSON.stringify(admin, null, 2)}`)
+  })
+  beforeEach(() => {
+    uut = new Validators()
+
+    sandbox = sinon.createSandbox()
+  })
+
+  afterEach(() => sandbox.restore())
+
+  describe('ensureUser()', () => {
+    it('should throw 401 if user cant be found', async () => {
+      try {
+      // Force an error
+        sandbox.stub(uut.User, 'findById').resolves(false)
+
+        // Mock the context object.
+        const ctx = mockContext()
+        ctx.request = {
+          header: {
+            authorization: `Bearer ${context.token}`
+          }
+        }
+
+        await uut.ensureUser(ctx)
+
+        assert(false, 'Unexpected result')
+      } catch (err) {
+        assert.equal(err.status, 401)
+        assert.include(err.message, 'Unauthorized')
+      }
+    })
+    it('should throw 401 if token not found', async () => {
+      try {
+        // Mock the context object.
+        const ctx = mockContext()
+
+        await uut.ensureUser(ctx)
+
+        assert(false, 'Unexpected result')
+      } catch (err) {
+        assert.equal(err.status, 401)
+        assert.include(err.message, 'Unauthorized')
+      }
+    })
+    it('should throw 401 if token is invalid', async () => {
+      try {
+        // Mock the context object.
+        const ctx = mockContext()
+        ctx.request = {
+          header: {
+            authorization: 'Bearer 1'
+          }
+        }
+        await uut.ensureUser(ctx)
+
+        assert(false, 'Unexpected result')
+      } catch (err) {
+        assert.equal(err.status, 401)
+        assert.include(err.message, 'Unauthorized')
+      }
+    })
+    it('should trigger the "next" function if user is admin', async () => {
+      try {
+        // Mock the context object.
+        const ctx = mockContext()
+        ctx.params = { id: context.id }
+
+        ctx.request = {
+          header: {
+            authorization: `Bearer ${context.adminJWT}`
+          }
+        }
+        // Function that execute if the validations
+        // are successful
+        const next = () => { return 'next function' }
+
+        const result = await uut.ensureUser(ctx, next)
+
+        assert.isString(result)
+        assert.equal(result, 'next function')
+      } catch (err) {
+        assert(false, 'Unexpected result')
+      }
+    })
+  })
+
+  describe('ensureAdmin()', () => {
+    it('should throw 401 if token not found', async () => {
+      try {
+        // Mock the context object.
+        const ctx = mockContext()
+
+        await uut.ensureAdmin(ctx)
+
+        assert(false, 'Unexpected result')
+      } catch (err) {
+        assert.equal(err.status, 401)
+        assert.include(err.message, 'Unauthorized')
+      }
+    })
+    it('should throw 401 if token is invalid', async () => {
+      try {
+        // Mock the context object.
+        const ctx = mockContext()
+        ctx.request = {
+          header: {
+            authorization: 'Bearer 1'
+          }
+        }
+        await uut.ensureAdmin(ctx)
+
+        assert(false, 'Unexpected result')
+      } catch (err) {
+        assert.equal(err.status, 401)
+        assert.include(err.message, 'Unauthorized')
+      }
+    })
+    it('should throw 401 if user cant be found', async () => {
+      try {
+        // Force an error
+        sandbox.stub(uut.User, 'findById').resolves(false)
+
+        // Mock the context object.
+        const ctx = mockContext()
+        ctx.request = {
+          header: {
+            authorization: `Bearer ${context.token}`
+          }
+        }
+        await uut.ensureAdmin(ctx)
+
+        assert(false, 'Unexpected result')
+      } catch (err) {
+        assert.equal(err.status, 401)
+        assert.include(err.message, 'Unauthorized')
+      }
+    })
+    it('should throw 401 if user is not admin type', async () => {
+      try {
+        // Mock the context object.
+        const ctx = mockContext()
+        ctx.request = {
+          header: {
+            authorization: `Bearer ${context.token}`
+          }
+        }
+        await uut.ensureAdmin(ctx)
+
+        assert(false, 'Unexpected result')
+      } catch (err) {
+        assert.equal(err.status, 401)
+        assert.include(err.message, 'not admin')
+      }
+    })
+    it('should trigger the "next" function if user is admin', async () => {
+      try {
+        // Mock the context object.
+        const ctx = mockContext()
+        ctx.request = {
+          header: {
+            authorization: `Bearer ${context.adminJWT}`
+          }
+        }
+        // Function that execute if the validations
+        // are successful
+        const next = () => { return 'next function' }
+
+        const result = await uut.ensureAdmin(ctx, next)
+
+        assert.isString(result)
+        assert.equal(result, 'next function')
+      } catch (err) {
+        assert(false, 'Unexpected result')
+      }
+    })
+  })
+
+  describe('ensureTargetUserOrAdmin()', () => {
+    it('should throw 401 if token not found', async () => {
+      try {
+        // Mock the context object.
+        const ctx = mockContext()
+        ctx.params = { id: context.id }
+        await uut.ensureTargetUserOrAdmin(ctx)
+
+        assert(false, 'Unexpected result')
+      } catch (err) {
+        assert.equal(err.status, 401)
+        assert.include(err.message, 'Unauthorized')
+      }
+    })
+    it('should throw 401 if token is invalid', async () => {
+      try {
+        // Mock the context object.
+        const ctx = mockContext()
+        ctx.params = { id: context.id }
+
+        ctx.request = {
+          header: {
+            authorization: 'Bearer 1'
+          }
+        }
+        await uut.ensureTargetUserOrAdmin(ctx)
+
+        assert(false, 'Unexpected result')
+      } catch (err) {
+        assert.equal(err.status, 401)
+        assert.include(err.message, 'Unauthorized')
+      }
+    })
+    it('should throw 401 if user cant be found', async () => {
+      try {
+        // Force an error
+        sandbox.stub(uut.User, 'findById').resolves(false)
+
+        // Mock the context object.
+        const ctx = mockContext()
+        ctx.params = { id: context.id }
+
+        ctx.request = {
+          header: {
+            authorization: `Bearer ${context.token}`
+          }
+        }
+        await uut.ensureTargetUserOrAdmin(ctx)
+
+        assert(false, 'Unexpected result')
+      } catch (err) {
+        assert.equal(err.status, 401)
+        assert.include(err.message, 'Unauthorized')
+      }
+    })
+    it('should throw 401 if user is not admin type', async () => {
+      try {
+        // Mock the context object.
+        const ctx = mockContext()
+        ctx.params = { id: 'Target Id' }
+
+        ctx.request = {
+          header: {
+            authorization: `Bearer ${context.token}`
+          }
+        }
+        await uut.ensureTargetUserOrAdmin(ctx)
+
+        assert(false, 'Unexpected result')
+      } catch (err) {
+        assert.equal(err.status, 401)
+        assert.include(err.message, 'not admin')
+      }
+    })
+    it('should trigger the "next" function if user is admin', async () => {
+      try {
+        // Mock the context object.
+        const ctx = mockContext()
+        ctx.params = { id: context.id }
+
+        ctx.request = {
+          header: {
+            authorization: `Bearer ${context.adminJWT}`
+          }
+        }
+        // Function that execute if the validations
+        // are successful
+        const next = () => { return 'next function' }
+
+        const result = await uut.ensureTargetUserOrAdmin(ctx, next)
+
+        assert.isString(result)
+        assert.equal(result, 'next function')
+      } catch (err) {
+        assert(false, 'Unexpected result')
+      }
+    })
+  })
+})