shancheas
07550b3167
- Introduced a new `PrivilegesModule` to manage user privileges and access control. - Added `RequirePrivilege` decorator to enforce privilege checks on controller handlers. - Implemented `PrivilegesGuard` to handle authorization based on user privileges. - Created database migrations for `privileges`, `privilege_keys`, and `privilege_details` tables. - Updated user model to include `is_superadmin` field for enhanced access control. - Added unit tests for the new privileges functionality and guards to ensure correct behavior.
112 lines
2.9 KiB
TypeScript
112 lines
2.9 KiB
TypeScript
import { INestApplication } from '@nestjs/common';
|
|
import { Test, TestingModule } from '@nestjs/testing';
|
|
import request from 'supertest';
|
|
import { App } from 'supertest/types';
|
|
import { AppModule } from '../src/app.module';
|
|
import { configureApp } from '../src/common/configure-app';
|
|
|
|
describe('Auth (e2e)', () => {
|
|
let app: INestApplication<App>;
|
|
|
|
const username = `user_${Date.now()}`;
|
|
const password = 'password123';
|
|
|
|
beforeAll(async () => {
|
|
const moduleFixture: TestingModule = await Test.createTestingModule({
|
|
imports: [AppModule],
|
|
}).compile();
|
|
|
|
app = moduleFixture.createNestApplication();
|
|
configureApp(app, {
|
|
NODE_ENV: 'test',
|
|
SWAGGER_ENABLED: 'false',
|
|
});
|
|
await app.init();
|
|
});
|
|
|
|
afterAll(async () => {
|
|
await app.close();
|
|
});
|
|
|
|
it('GET / remains public', async () => {
|
|
await request(app.getHttpServer())
|
|
.get('/')
|
|
.expect(200)
|
|
.expect('Hello World!');
|
|
});
|
|
|
|
it('GET /auth/me without token returns 401', async () => {
|
|
await request(app.getHttpServer()).get('/auth/me').expect(401);
|
|
});
|
|
|
|
it('register → me → refresh → revoke → me 401', async () => {
|
|
const register = await request(app.getHttpServer())
|
|
.post('/auth/register')
|
|
.send({ username, password })
|
|
.expect(201);
|
|
|
|
const { accessToken, refreshToken } = register.body as {
|
|
accessToken: string;
|
|
refreshToken: string;
|
|
};
|
|
expect(accessToken).toBeDefined();
|
|
expect(refreshToken).toHaveLength(64);
|
|
expect(Object.keys(register.body).sort()).toEqual([
|
|
'accessToken',
|
|
'refreshToken',
|
|
]);
|
|
|
|
const me = await request(app.getHttpServer())
|
|
.get('/auth/me')
|
|
.set('Authorization', `Bearer ${accessToken}`)
|
|
.expect(200);
|
|
|
|
expect(me.body).toMatchObject({
|
|
username: username.toLowerCase(),
|
|
isSuperadmin: false,
|
|
privilege: null,
|
|
permissions: {},
|
|
});
|
|
|
|
const refreshed = await request(app.getHttpServer())
|
|
.post('/auth/refresh')
|
|
.send({ refreshToken })
|
|
.expect(200);
|
|
|
|
const { accessToken: nextAccess, refreshToken: nextRefresh } =
|
|
refreshed.body as {
|
|
accessToken: string;
|
|
refreshToken: string;
|
|
};
|
|
|
|
await request(app.getHttpServer())
|
|
.get('/auth/me')
|
|
.set('Authorization', `Bearer ${nextAccess}`)
|
|
.expect(200);
|
|
|
|
await request(app.getHttpServer())
|
|
.post('/auth/revoke')
|
|
.send({ refreshToken: nextRefresh })
|
|
.expect(204);
|
|
|
|
await request(app.getHttpServer())
|
|
.get('/auth/me')
|
|
.set('Authorization', `Bearer ${nextAccess}`)
|
|
.expect(401);
|
|
});
|
|
|
|
it('login rejects invalid credentials', async () => {
|
|
await request(app.getHttpServer())
|
|
.post('/auth/login')
|
|
.send({ username, password: 'wrongpass' })
|
|
.expect(401);
|
|
});
|
|
|
|
it('duplicate register returns 409', async () => {
|
|
await request(app.getHttpServer())
|
|
.post('/auth/register')
|
|
.send({ username, password })
|
|
.expect(409);
|
|
});
|
|
});
|