110 lines
No EOL
3.5 KiB
TypeScript
110 lines
No EOL
3.5 KiB
TypeScript
import { describe, it, expect, beforeAll } from "vitest";
|
|
import PocketBase from "pocketbase";
|
|
|
|
import { APP_URL, DEMO, adminPb, requireServices, signIn, userPb } from "./helpers";
|
|
|
|
let admin: PocketBase;
|
|
|
|
beforeAll(async () => {
|
|
await requireServices();
|
|
admin = await adminPb();
|
|
});
|
|
|
|
describe("a project is never created without a usable board", () => {
|
|
it("every project has exactly one inbox and one done column", async () => {
|
|
// A project missing either makes POST /api/client/cards answer 409, which
|
|
// the client discovers days later when they try to file a request.
|
|
const projects = await admin.collection("projects").getFullList();
|
|
expect(projects.length).toBeGreaterThan(0);
|
|
|
|
for (const project of projects) {
|
|
const columns = await admin
|
|
.collection("columns")
|
|
.getFullList({ filter: `project = "${project.id}"` });
|
|
|
|
expect(
|
|
columns.filter((c) => c.is_inbox),
|
|
`project ${project.slug} inbox columns`
|
|
).toHaveLength(1);
|
|
expect(
|
|
columns.filter((c) => c.is_done),
|
|
`project ${project.slug} done columns`
|
|
).toHaveLength(1);
|
|
}
|
|
});
|
|
});
|
|
|
|
describe("the admin area is owner-only", () => {
|
|
it("does not let a client manager list other accounts", async () => {
|
|
const pb = await userPb(DEMO.managerEmail, DEMO.managerPassword);
|
|
const users = await pb.collection("users").getFullList();
|
|
expect(users).toHaveLength(1);
|
|
});
|
|
|
|
it("does not let a client manager create a client", async () => {
|
|
const pb = await userPb(DEMO.managerEmail, DEMO.managerPassword);
|
|
await expect(
|
|
pb.collection("clients").create({
|
|
name: "Injected",
|
|
slug: `injected-${Date.now()}`,
|
|
active: true,
|
|
})
|
|
).rejects.toThrow();
|
|
});
|
|
|
|
it("does not let a client manager create a project", async () => {
|
|
const pb = await userPb(DEMO.managerEmail, DEMO.managerPassword);
|
|
const client = await admin
|
|
.collection("clients")
|
|
.getFirstListItem(`slug = "${DEMO.clientSlug}"`);
|
|
|
|
await expect(
|
|
pb.collection("projects").create({
|
|
client: client.id,
|
|
name: "Injected",
|
|
slug: `injected-${Date.now()}`,
|
|
status: "active",
|
|
})
|
|
).rejects.toThrow();
|
|
});
|
|
});
|
|
|
|
describe("deactivated accounts cannot sign in", () => {
|
|
it("is refused with the same message as a wrong password", async () => {
|
|
const email = `deactivated-${Date.now()}@example.com`;
|
|
const password = "probe-password-123";
|
|
const client = await admin
|
|
.collection("clients")
|
|
.getFirstListItem(`slug = "${DEMO.clientSlug}"`);
|
|
|
|
const user = await admin.collection("users").create({
|
|
email,
|
|
password,
|
|
passwordConfirm: password,
|
|
name: "Deactivated probe",
|
|
role: "client_manager",
|
|
client: client.id,
|
|
active: false,
|
|
verified: true,
|
|
});
|
|
|
|
const response = await fetch(`${APP_URL}/api/auth/login`, {
|
|
method: "POST",
|
|
headers: { "content-type": "application/json" },
|
|
body: JSON.stringify({ email, password }),
|
|
});
|
|
|
|
expect(response.status).toBe(401);
|
|
const body = await response.json();
|
|
expect(body.error).toBe("Invalid email or password");
|
|
|
|
await admin.collection("users").delete(user.id);
|
|
});
|
|
|
|
it("still lets an active account in", async () => {
|
|
// Guards against the active check rejecting everyone, which would look
|
|
// identical to a wrong password and lock the product.
|
|
const cookie = await signIn(DEMO.managerEmail, DEMO.managerPassword);
|
|
expect(cookie).toContain("pb_auth=");
|
|
});
|
|
}); |