26 lines
1 KiB
JavaScript
26 lines
1 KiB
JavaScript
const request = require('supertest');
|
|
const app = require('../../app');
|
|
const { Project } = require('../../models');
|
|
const { createTestUser } = require('../helpers/testUtils');
|
|
|
|
describe('Projects Permissions', () => {
|
|
let user, otherUser, agent;
|
|
|
|
beforeEach(async () => {
|
|
user = await createTestUser({ email: `user_${Date.now()}@example.com` });
|
|
otherUser = await createTestUser({ email: `other_${Date.now()}@example.com` });
|
|
|
|
agent = request.agent(app);
|
|
await agent.post('/api/login').send({ email: user.email, password: 'password123' });
|
|
});
|
|
|
|
it("GET /api/project/:uidSlug should return 403 for other user's project", async () => {
|
|
const otherProject = await Project.create({ name: 'Other Project', user_id: otherUser.id });
|
|
const slugged = otherProject.name.toLowerCase().replace(/\s+/g, '-');
|
|
const uidSlug = `${otherProject.uid}-${slugged}`;
|
|
|
|
const res = await agent.get(`/api/project/${uidSlug}`);
|
|
expect(res.status).toBe(403);
|
|
expect(res.body.error).toBe('Forbidden');
|
|
});
|
|
});
|