mirror of
https://github.com/Permissionless-Software-Foundation/x402-base-facilitator.git
synced 2026-09-21 16:52:01 -07:00
745 lines
20 KiB
JavaScript
745 lines
20 KiB
JavaScript
const testUtils = require('./utils')
|
|
const rp = require('request-promise')
|
|
const assert = require('chai').assert
|
|
const config = require('../config')
|
|
|
|
const util = require('util')
|
|
util.inspect.defaultOptions = { depth: 1 }
|
|
|
|
const LOCALHOST = `http://localhost:${config.port}`
|
|
|
|
const context = {}
|
|
|
|
describe('Users', () => {
|
|
before(async () => {
|
|
// console.log(`config: ${JSON.stringify(config, null, 2)}`)
|
|
|
|
// Create a second test user.
|
|
const userObj = {
|
|
email: 'test2@test.com',
|
|
password: 'pass2'
|
|
}
|
|
const testUser = await testUtils.createUser(userObj)
|
|
// console.log(`testUser2: ${JSON.stringify(testUser, null, 2)}`)
|
|
|
|
context.user2 = testUser.user
|
|
context.token2 = testUser.token
|
|
context.id2 = testUser.user._id
|
|
|
|
// Get the JWT used to log in as the admin 'system' user.
|
|
const adminJWT = await testUtils.getAdminJWT()
|
|
// console.log(`adminJWT: ${adminJWT}`)
|
|
context.adminJWT = adminJWT
|
|
|
|
// const admin = await testUtils.loginAdminUser()
|
|
// context.adminJWT = admin.token
|
|
|
|
// const admin = await adminLib.loginAdmin()
|
|
// console.log(`admin: ${JSON.stringify(admin, null, 2)}`)
|
|
})
|
|
|
|
describe('POST /users', () => {
|
|
it('should reject signup when data is incomplete', async () => {
|
|
try {
|
|
const options = {
|
|
method: 'POST',
|
|
uri: `${LOCALHOST}/users`,
|
|
resolveWithFullResponse: true,
|
|
json: true,
|
|
body: {
|
|
email: 'test2@test.com'
|
|
}
|
|
}
|
|
|
|
let result = await rp(options)
|
|
|
|
console.log(`result stringified: ${JSON.stringify(result, null, 2)}`)
|
|
assert(false, 'Unexpected result')
|
|
} catch (err) {
|
|
if (err.statusCode === 422) {
|
|
assert(err.statusCode === 422, 'Error code 422 expected.')
|
|
} else if (err.statusCode === 401) {
|
|
assert(err.statusCode === 401, 'Error code 401 expected.')
|
|
} else {
|
|
console.error('Error: ', err)
|
|
console.log('Error stringified: ' + JSON.stringify(err, null, 2))
|
|
throw err
|
|
}
|
|
}
|
|
})
|
|
it('should reject signup if no email property is provided', async () => {
|
|
try {
|
|
const options = {
|
|
method: 'POST',
|
|
uri: `${LOCALHOST}/users`,
|
|
resolveWithFullResponse: true,
|
|
json: true,
|
|
body: {
|
|
user: {
|
|
password: 'supersecretpassword'
|
|
}
|
|
}
|
|
}
|
|
|
|
await rp(options)
|
|
} catch (err) {
|
|
assert.equal(err.statusCode, 422)
|
|
assert.include(
|
|
err.message,
|
|
`Property 'email' must be a string`
|
|
)
|
|
}
|
|
})
|
|
it('should reject signup if email property provided is wrong format', async () => {
|
|
try {
|
|
const options = {
|
|
method: 'POST',
|
|
uri: `${LOCALHOST}/users`,
|
|
resolveWithFullResponse: true,
|
|
json: true,
|
|
body: {
|
|
user: {
|
|
email: 'badEmailFormat',
|
|
password: 'test'
|
|
}
|
|
}
|
|
}
|
|
|
|
await rp(options)
|
|
} catch (err) {
|
|
assert.equal(err.statusCode, 422)
|
|
assert.include(
|
|
err.message,
|
|
`Property 'email' must be email format`
|
|
)
|
|
}
|
|
})
|
|
it('should reject signup if no password property is provided', async () => {
|
|
try {
|
|
const options = {
|
|
method: 'POST',
|
|
uri: `${LOCALHOST}/users`,
|
|
resolveWithFullResponse: true,
|
|
json: true,
|
|
body: {
|
|
user: {
|
|
email: 'test2@test.com'
|
|
}
|
|
}
|
|
}
|
|
|
|
await rp(options)
|
|
} catch (err) {
|
|
assert.equal(err.statusCode, 422)
|
|
assert.include(
|
|
err.message,
|
|
`Property 'password' must be a string`
|
|
)
|
|
}
|
|
})
|
|
it('should signup of type user by default', async () => {
|
|
try {
|
|
const options = {
|
|
method: 'POST',
|
|
uri: `${LOCALHOST}/users`,
|
|
resolveWithFullResponse: true,
|
|
json: true,
|
|
body: {
|
|
user: {
|
|
email: 'test3@test.com',
|
|
password: 'supersecretpassword'
|
|
}
|
|
}
|
|
}
|
|
|
|
let result = await rp(options)
|
|
// console.log(`result: ${JSON.stringify(result, null, 2)}`)
|
|
|
|
context.user = result.body.user
|
|
context.token = result.body.token
|
|
|
|
assert(result.statusCode === 200, 'Status Code 200 expected.')
|
|
assert(
|
|
result.body.user.email === 'test3@test.com',
|
|
'Email of test expected'
|
|
)
|
|
assert(
|
|
result.body.user.password === undefined,
|
|
'Password expected to be omited'
|
|
)
|
|
assert.property(result.body, 'token', 'Token property exists.')
|
|
assert.equal(result.body.user.type, 'user')
|
|
} catch (err) {
|
|
console.log(
|
|
'Error authenticating test user: ' + JSON.stringify(err, null, 2)
|
|
)
|
|
throw err
|
|
}
|
|
})
|
|
})
|
|
|
|
describe('GET /users', () => {
|
|
it('should not fetch users if the authorization header is missing', async () => {
|
|
try {
|
|
const options = {
|
|
method: 'GET',
|
|
uri: `${LOCALHOST}/users`,
|
|
resolveWithFullResponse: true,
|
|
json: true,
|
|
headers: {
|
|
Accept: 'application/json'
|
|
}
|
|
}
|
|
|
|
await rp(options)
|
|
|
|
assert.equal(true, false, 'Unexpected behavior')
|
|
} catch (err) {
|
|
assert.equal(err.statusCode, 401)
|
|
}
|
|
})
|
|
|
|
it('should not fetch users if the authorization header is missing the scheme', async () => {
|
|
try {
|
|
const options = {
|
|
method: 'GET',
|
|
uri: `${LOCALHOST}/users`,
|
|
resolveWithFullResponse: true,
|
|
json: true,
|
|
headers: {
|
|
Accept: 'application/json',
|
|
Authorization: '1'
|
|
}
|
|
}
|
|
|
|
await rp(options)
|
|
assert.equal(true, false, 'Unexpected behavior')
|
|
} catch (err) {
|
|
assert.equal(err.statusCode, 401)
|
|
}
|
|
})
|
|
|
|
it('should not fetch users if the authorization header has invalid scheme', async () => {
|
|
const { token } = context
|
|
try {
|
|
const options = {
|
|
method: 'GET',
|
|
uri: `${LOCALHOST}/users`,
|
|
resolveWithFullResponse: true,
|
|
json: true,
|
|
headers: {
|
|
Accept: 'application/json',
|
|
Authorization: `Unknown ${token}`
|
|
}
|
|
}
|
|
|
|
await rp(options)
|
|
assert.equal(true, false, 'Unexpected behavior')
|
|
} catch (err) {
|
|
assert.equal(err.statusCode, 401)
|
|
}
|
|
})
|
|
|
|
it('should not fetch users if token is invalid', async () => {
|
|
try {
|
|
const options = {
|
|
method: 'GET',
|
|
uri: `${LOCALHOST}/users`,
|
|
resolveWithFullResponse: true,
|
|
json: true,
|
|
headers: {
|
|
Accept: 'application/json',
|
|
Authorization: `Bearer 1`
|
|
}
|
|
}
|
|
|
|
await rp(options)
|
|
assert.equal(true, false, 'Unexpected behavior')
|
|
} catch (err) {
|
|
assert.equal(err.statusCode, 401)
|
|
}
|
|
})
|
|
|
|
it('should fetch all users', async () => {
|
|
const { token } = context
|
|
|
|
const options = {
|
|
method: 'GET',
|
|
uri: `${LOCALHOST}/users`,
|
|
resolveWithFullResponse: true,
|
|
json: true,
|
|
headers: {
|
|
Accept: 'application/json',
|
|
Authorization: `Bearer ${token}`
|
|
}
|
|
}
|
|
|
|
const result = await rp(options)
|
|
const users = result.body.users
|
|
// console.log(`users: ${util.inspect(users)}`)
|
|
|
|
assert.hasAnyKeys(users[0], ['type', '_id', 'username'])
|
|
assert.isNumber(users.length)
|
|
})
|
|
})
|
|
|
|
describe('GET /users/:id', () => {
|
|
it('should not fetch user if token is invalid', async () => {
|
|
try {
|
|
const options = {
|
|
method: 'GET',
|
|
uri: `${LOCALHOST}/users/1`,
|
|
resolveWithFullResponse: true,
|
|
json: true,
|
|
headers: {
|
|
Accept: 'application/json',
|
|
Authorization: `Bearer 1`
|
|
}
|
|
}
|
|
|
|
await rp(options)
|
|
assert.equal(true, false, 'Unexpected behavior')
|
|
} catch (err) {
|
|
assert.equal(err.statusCode, 401)
|
|
}
|
|
})
|
|
|
|
it("should throw 404 if user doesn't exist", async () => {
|
|
const { token } = context
|
|
|
|
try {
|
|
const options = {
|
|
method: 'GET',
|
|
uri: `${LOCALHOST}/users/1`,
|
|
resolveWithFullResponse: true,
|
|
json: true,
|
|
headers: {
|
|
Accept: 'application/json',
|
|
Authorization: `Bearer ${token}`
|
|
}
|
|
}
|
|
|
|
await rp(options)
|
|
assert.equal(true, false, 'Unexpected behavior')
|
|
} catch (err) {
|
|
assert.equal(err.statusCode, 404)
|
|
}
|
|
})
|
|
|
|
it('should fetch user', async () => {
|
|
const {
|
|
user: { _id },
|
|
token
|
|
} = context
|
|
|
|
const options = {
|
|
method: 'GET',
|
|
uri: `${LOCALHOST}/users/${_id}`,
|
|
resolveWithFullResponse: true,
|
|
json: true,
|
|
headers: {
|
|
Accept: 'application/json',
|
|
Authorization: `Bearer ${token}`
|
|
}
|
|
}
|
|
|
|
const result = await rp(options)
|
|
const user = result.body.user
|
|
// console.log(`user: ${util.inspect(user)}`)
|
|
|
|
assert.hasAnyKeys(user, ['type', '_id', 'email'])
|
|
assert.equal(user._id, _id)
|
|
assert.notProperty(
|
|
user,
|
|
'password',
|
|
'Password property should not be returned'
|
|
)
|
|
})
|
|
})
|
|
|
|
describe('PUT /users/:id', () => {
|
|
it('should not update user if token is invalid', async () => {
|
|
try {
|
|
const options = {
|
|
method: 'PUT',
|
|
uri: `${LOCALHOST}/users/1`,
|
|
resolveWithFullResponse: true,
|
|
json: true,
|
|
headers: {
|
|
Accept: 'application/json',
|
|
Authorization: `Bearer 1`
|
|
}
|
|
}
|
|
|
|
await rp(options)
|
|
assert.equal(true, false, 'Unexpected behavior')
|
|
} catch (err) {
|
|
assert.equal(err.statusCode, 401)
|
|
}
|
|
})
|
|
|
|
it('should throw 401 if non-admin updating other user', async () => {
|
|
const { token } = context
|
|
|
|
try {
|
|
const options = {
|
|
method: 'PUT',
|
|
uri: `${LOCALHOST}/users/1`,
|
|
resolveWithFullResponse: true,
|
|
json: true,
|
|
headers: {
|
|
Accept: 'application/json',
|
|
Authorization: `Bearer ${token}`
|
|
}
|
|
}
|
|
|
|
await rp(options)
|
|
assert.equal(true, false, 'Unexpected behavior')
|
|
} catch (err) {
|
|
assert.equal(err.statusCode, 401)
|
|
}
|
|
})
|
|
|
|
it('should update user with minimum inputs', async () => {
|
|
const {
|
|
user: { _id },
|
|
token
|
|
} = context
|
|
|
|
const options = {
|
|
method: 'PUT',
|
|
uri: `${LOCALHOST}/users/${_id}`,
|
|
resolveWithFullResponse: true,
|
|
json: true,
|
|
headers: {
|
|
Accept: 'application/json',
|
|
Authorization: `Bearer ${token}`
|
|
},
|
|
body: {
|
|
user: { email: 'testToUpdate@test.com' }
|
|
}
|
|
}
|
|
|
|
const result = await rp(options)
|
|
const user = result.body.user
|
|
// console.log(`user: ${util.inspect(user)}`)
|
|
|
|
assert.hasAnyKeys(user, ['type', '_id', 'email'])
|
|
assert.equal(user._id, _id)
|
|
assert.notProperty(
|
|
user,
|
|
'password',
|
|
'Password property should not be returned'
|
|
)
|
|
assert.equal(user.email, 'testToUpdate@test.com')
|
|
})
|
|
it('should update user with all inputs', async () => {
|
|
const {
|
|
user: { _id },
|
|
token
|
|
} = context
|
|
|
|
const options = {
|
|
method: 'PUT',
|
|
uri: `${LOCALHOST}/users/${_id}`,
|
|
resolveWithFullResponse: true,
|
|
json: true,
|
|
headers: {
|
|
Accept: 'application/json',
|
|
Authorization: `Bearer ${token}`
|
|
},
|
|
body: {
|
|
user: {
|
|
email: 'testToUpdate@test.com',
|
|
name: 'my name',
|
|
username: 'myUsername'
|
|
}
|
|
}
|
|
}
|
|
|
|
const result = await rp(options)
|
|
const user = result.body.user
|
|
// console.log(`user: ${util.inspect(user)}`)
|
|
|
|
assert.hasAnyKeys(user, ['type', '_id', 'email', 'name'])
|
|
assert.equal(user._id, _id)
|
|
assert.notProperty(
|
|
user,
|
|
'password',
|
|
'Password property should not be returned'
|
|
)
|
|
assert.equal(user.name, 'my name')
|
|
assert.equal(user.email, 'testToUpdate@test.com')
|
|
assert.equal(user.username, 'myUsername')
|
|
})
|
|
|
|
it('should not be able to update user type', async () => {
|
|
try {
|
|
const options = {
|
|
method: 'PUT',
|
|
uri: `${LOCALHOST}/users/${context.user._id.toString()}`,
|
|
resolveWithFullResponse: true,
|
|
json: true,
|
|
headers: {
|
|
Authorization: `Bearer ${context.token}`
|
|
},
|
|
body: {
|
|
user: {
|
|
name: 'new name',
|
|
type: 'test'
|
|
}
|
|
}
|
|
}
|
|
|
|
const result = await rp(options)
|
|
|
|
// console.log(`Users: ${JSON.stringify(result, null, 2)}`)
|
|
|
|
assert(result.statusCode === 200, 'Status Code 200 expected.')
|
|
assert(result.body.user.type === 'user', 'Type should be unchanged.')
|
|
} catch (err) {
|
|
assert.equal(err.statusCode, 422)
|
|
assert.include(
|
|
err.message,
|
|
"Property 'type' just can change for Admin user"
|
|
)
|
|
}
|
|
})
|
|
|
|
it('should not be able to update other user when not admin', async () => {
|
|
try {
|
|
const options = {
|
|
method: 'PUT',
|
|
uri: `${LOCALHOST}/users/${context.user2._id.toString()}`,
|
|
resolveWithFullResponse: true,
|
|
json: true,
|
|
headers: {
|
|
Authorization: `Bearer ${context.token}`
|
|
},
|
|
body: {
|
|
user: {
|
|
name: 'This should not work'
|
|
}
|
|
}
|
|
}
|
|
|
|
let result = await rp(options)
|
|
|
|
console.log(`result stringified: ${JSON.stringify(result, null, 2)}`)
|
|
assert(false, 'Unexpected result')
|
|
} catch (err) {
|
|
if (err.statusCode === 401) {
|
|
assert(err.statusCode === 401, 'Error code 401 expected.')
|
|
} else {
|
|
console.error('Error: ', err)
|
|
console.log('Error stringified: ' + JSON.stringify(err, null, 2))
|
|
throw err
|
|
}
|
|
}
|
|
})
|
|
|
|
it('should be able to update other user when admin', async () => {
|
|
const adminJWT = context.adminJWT
|
|
|
|
const options = {
|
|
method: 'PUT',
|
|
uri: `${LOCALHOST}/users/${context.user2._id.toString()}`,
|
|
resolveWithFullResponse: true,
|
|
json: true,
|
|
headers: {
|
|
Authorization: `Bearer ${adminJWT}`
|
|
},
|
|
body: {
|
|
user: {
|
|
name: 'This should work'
|
|
}
|
|
}
|
|
}
|
|
|
|
let result = await rp(options)
|
|
// console.log(`result stringified: ${JSON.stringify(result, null, 2)}`)
|
|
|
|
const userName = result.body.user.name
|
|
assert.equal(userName, 'This should work')
|
|
})
|
|
it('should not be able to update if name property is wrong', async () => {
|
|
const {
|
|
user: { _id },
|
|
token
|
|
} = context
|
|
|
|
const options = {
|
|
method: 'PUT',
|
|
uri: `${LOCALHOST}/users/${_id}`,
|
|
resolveWithFullResponse: true,
|
|
json: true,
|
|
headers: {
|
|
Accept: 'application/json',
|
|
Authorization: `Bearer ${token}`
|
|
},
|
|
body: {
|
|
user: {
|
|
email: 'testToUpdate@test.com',
|
|
name: {}
|
|
}
|
|
}
|
|
}
|
|
try {
|
|
const result = await rp(options)
|
|
const user = result.body.user
|
|
// console.log(`user: ${util.inspect(user)}`)
|
|
|
|
assert.hasAnyKeys(user, ['type', '_id', 'username'])
|
|
assert.equal(user._id, _id)
|
|
assert.notProperty(
|
|
user,
|
|
'password',
|
|
'Password property should not be returned'
|
|
)
|
|
assert.notEqual(user.username, 'updatedcoolname31')
|
|
} catch (error) {
|
|
assert.equal(error.statusCode, 422)
|
|
assert.include(error.message, "Property 'name' must be a string!")
|
|
}
|
|
})
|
|
it('should not be able to update if email property provided is wrong format', async () => {
|
|
try {
|
|
const options = {
|
|
method: 'POST',
|
|
uri: `${LOCALHOST}/users`,
|
|
resolveWithFullResponse: true,
|
|
json: true,
|
|
body: {
|
|
user: {
|
|
email: 'badEmailFormat'
|
|
}
|
|
}
|
|
}
|
|
|
|
await rp(options)
|
|
} catch (err) {
|
|
assert.equal(err.statusCode, 422)
|
|
assert.include(
|
|
err.message,
|
|
`Property 'email' must be email format`
|
|
)
|
|
}
|
|
})
|
|
})
|
|
|
|
describe('DELETE /users/:id', () => {
|
|
it('should not delete user if token is invalid', async () => {
|
|
try {
|
|
const options = {
|
|
method: 'DELETE',
|
|
uri: `${LOCALHOST}/users/1`,
|
|
resolveWithFullResponse: true,
|
|
json: true,
|
|
headers: {
|
|
Accept: 'application/json',
|
|
Authorization: `Bearer 1`
|
|
}
|
|
}
|
|
|
|
await rp(options)
|
|
assert.equal(true, false, 'Unexpected behavior')
|
|
} catch (err) {
|
|
assert.equal(err.statusCode, 401)
|
|
}
|
|
})
|
|
|
|
it('should throw 401 if deleting other user', async () => {
|
|
const { token } = context
|
|
|
|
try {
|
|
const options = {
|
|
method: 'DELETE',
|
|
uri: `${LOCALHOST}/users/1`,
|
|
resolveWithFullResponse: true,
|
|
json: true,
|
|
headers: {
|
|
Accept: 'application/json',
|
|
Authorization: `Bearer ${token}`
|
|
}
|
|
}
|
|
|
|
await rp(options)
|
|
assert.equal(true, false, 'Unexpected behavior')
|
|
} catch (err) {
|
|
assert.equal(err.statusCode, 401)
|
|
}
|
|
})
|
|
|
|
it('should not be able to delete other users unless admin', async () => {
|
|
try {
|
|
const options = {
|
|
method: 'DELETE',
|
|
uri: `${LOCALHOST}/users/${context.user2._id.toString()}`,
|
|
resolveWithFullResponse: true,
|
|
json: true,
|
|
headers: {
|
|
Authorization: `Bearer ${context.token}`
|
|
}
|
|
}
|
|
|
|
let result = await rp(options)
|
|
|
|
console.log(`result stringified: ${JSON.stringify(result, null, 2)}`)
|
|
assert(false, 'Unexpected result')
|
|
} catch (err) {
|
|
if (err.statusCode === 401) {
|
|
assert(err.statusCode === 401, 'Error code 401 expected.')
|
|
} else {
|
|
console.error('Error: ', err)
|
|
console.log('Error stringified: ' + JSON.stringify(err, null, 2))
|
|
throw err
|
|
}
|
|
}
|
|
})
|
|
|
|
it('should delete own user', async () => {
|
|
const {
|
|
user: { _id },
|
|
token
|
|
} = context
|
|
|
|
const options = {
|
|
method: 'DELETE',
|
|
uri: `${LOCALHOST}/users/${_id}`,
|
|
resolveWithFullResponse: true,
|
|
json: true,
|
|
headers: {
|
|
Accept: 'application/json',
|
|
Authorization: `Bearer ${token}`
|
|
}
|
|
}
|
|
|
|
const result = await rp(options)
|
|
// console.log(`result: ${util.inspect(result.body)}`)
|
|
|
|
assert.equal(result.body.success, true)
|
|
})
|
|
|
|
it('should be able to delete other users when admin', async () => {
|
|
const id = context.id2
|
|
const adminJWT = context.adminJWT
|
|
|
|
const options = {
|
|
method: 'DELETE',
|
|
uri: `${LOCALHOST}/users/${id}`,
|
|
resolveWithFullResponse: true,
|
|
json: true,
|
|
headers: {
|
|
Accept: 'application/json',
|
|
Authorization: `Bearer ${adminJWT}`
|
|
}
|
|
}
|
|
|
|
const result = await rp(options)
|
|
// console.log(`result: ${util.inspect(result.body)}`)
|
|
|
|
assert.equal(result.body.success, true)
|
|
})
|
|
})
|
|
})
|