b8611d9338
- Projects: remove superfluous try/catch around toast; keep explicit error path - AdminUsers/Sidebar/ShareService: keep minimal catch blocks only to ignore non-JSON parse failures, without swallowing errors - Lint/format pass remains green
35 lines
1.2 KiB
JavaScript
35 lines
1.2 KiB
JavaScript
const request = require('supertest');
|
|
const app = require('../../app');
|
|
const { Project } = require('../../models');
|
|
const { createTestUser } = require('../helpers/testUtils');
|
|
|
|
describe('Projects Permissions', () => {
|
|
let user, otherUser, agent;
|
|
|
|
beforeEach(async () => {
|
|
user = await createTestUser({
|
|
email: `user_${Date.now()}@example.com`,
|
|
});
|
|
otherUser = await createTestUser({
|
|
email: `other_${Date.now()}@example.com`,
|
|
});
|
|
|
|
agent = request.agent(app);
|
|
await agent
|
|
.post('/api/login')
|
|
.send({ email: user.email, password: 'password123' });
|
|
});
|
|
|
|
it("GET /api/project/:uidSlug should return 403 for other user's project", async () => {
|
|
const otherProject = await Project.create({
|
|
name: 'Other Project',
|
|
user_id: otherUser.id,
|
|
});
|
|
const slugged = otherProject.name.toLowerCase().replace(/\s+/g, '-');
|
|
const uidSlug = `${otherProject.uid}-${slugged}`;
|
|
|
|
const res = await agent.get(`/api/project/${uidSlug}`);
|
|
expect(res.status).toBe(403);
|
|
expect(res.body.error).toBe('Forbidden');
|
|
});
|
|
});
|