tilbudgivern/backend/__tests__/smartPackagesReadAuthorization.test.js

const express = require('express');
const request = require('supertest');
const jwt = require('jsonwebtoken');

process.env.JWT_ACCESS_SECRET = process.env.JWT_ACCESS_SECRET || 'smart-package-route-inventory-secret';
process.env.JWT_REFRESH_SECRET = process.env.JWT_REFRESH_SECRET || 'smart-package-route-inventory-refresh-secret';
process.env.AUTH_USERNAME = 'configured-operator';

jest.mock('uuid', () => ({ v4: () => 'route-inventory-correlation-id' }));
jest.mock('../src/utils/logger', () => ({
  info: jest.fn(),
  warn: jest.fn(),
  error: jest.fn(),
  debug: jest.fn(),
  logInfo: jest.fn()
}));

const smartPackagesRoutes = require('../src/routes/smartPackagesRoutes');

const BASE_PATH = '/api/smart-packages';
const PUBLIC_READ_ROUTES = [
  { method: 'get', path: '/', requestPath: '' },
  { method: 'get', path: '/:id', requestPath: '/7' }
];
const INTERNAL_READ_ROUTES = [
  { method: 'get', path: '/management', requestPath: '/management' },
  { method: 'get', path: '/tasks', requestPath: '/tasks' },
  { method: 'get', path: '/categories', requestPath: '/categories' },
  { method: 'get', path: '/integrity-report', requestPath: '/integrity-report' },
  { method: 'get', path: '/haandvaerkpriser-preview', requestPath: '/haandvaerkpriser-preview' },
  { method: 'get', path: '/review-queue', requestPath: '/review-queue' },
  { method: 'get', path: '/material-master-search', requestPath: '/material-master-search?q=tagrende' },
  { method: 'get', path: '/excel-uploads', requestPath: '/excel-uploads' },
  { method: 'get', path: '/excel-uploads/:filename/packages', requestPath: '/excel-uploads/example.xlsx/packages' },
  { method: 'get', path: '/excel-mapping/:jobId', requestPath: '/excel-mapping/job-1' },
  { method: 'post', path: '/excel-standard-preview', requestPath: '/excel-standard-preview' },
  { method: 'get', path: '/excel-validation/:jobId', requestPath: '/excel-validation/job-1' },
  { method: 'post', path: '/history-search', requestPath: '/history-search' },
  { method: 'post', path: '/combined-history-search', requestPath: '/combined-history-search' },
  { method: 'get', path: '/components', requestPath: '/components' },
  { method: 'get', path: '/statistics', requestPath: '/statistics' },
  { method: 'get', path: '/export', requestPath: '/export' },
  { method: 'get', path: '/templates', requestPath: '/templates' },
  { method: 'get', path: '/management/:id', requestPath: '/management/7' },
  { method: 'get', path: '/custom-tasks', requestPath: '/custom-tasks' },
  { method: 'get', path: '/:id/work-description', requestPath: '/7/work-description' },
  { method: 'get', path: '/:id/related', requestPath: '/7/related' },
  { method: 'get', path: '/custom-packages', requestPath: '/custom-packages' }
];
const READ_LIKE_POST_PATHS = new Set([
  '/excel-standard-preview',
  '/history-search',
  '/combined-history-search'
]);

const buildApp = () => {
  const app = express();
  app.use(express.json());
  app.use(BASE_PATH, smartPackagesRoutes);
  return app;
};

const authHeader = username => (
  `Bearer ${jwt.sign({ id: 1, username }, process.env.JWT_ACCESS_SECRET)}`
);

const routeKey = ({ method, path }) => `${method.toUpperCase()} ${path}`;

const inventoryReadRoutes = () => smartPackagesRoutes.stack
  .filter(layer => layer.route)
  .flatMap(layer => Object.keys(layer.route.methods)
    .filter(method => method === 'get' || (method === 'post' && READ_LIKE_POST_PATHS.has(layer.route.path)))
    .map(method => ({ method, path: layer.route.path })))
  .sort((left, right) => routeKey(left).localeCompare(routeKey(right)));

const findRoute = ({ method, path }) => smartPackagesRoutes.stack.find(layer => (
  layer.route?.path === path && layer.route.methods[method]
));

const runAuthChain = (route, authorization) => {
  const middleware = findRoute(route).route.stack.slice(0, -1).map(layer => layer.handle);
  const req = { headers: { authorization } };
  const res = {
    locals: {},
    status: jest.fn().mockReturnThis(),
    json: jest.fn().mockReturnThis()
  };

  return new Promise((resolve, reject) => {
    let index = 0;
    const next = error => {
      if (error) return reject(error);
      if (index === middleware.length) return resolve({ req, res });
      const handler = middleware[index++];
      try {
        return handler(req, res, next);
      } catch (caught) {
        return reject(caught);
      }
    };
    next();
  });
};

describe('Smart Package route authorization inventory', () => {
  afterEach(() => {
    delete global.smartPackageManagementService;
  });

  test('inventories every read route and allowlists only the active verified composition list/detail', () => {
    const expected = [...PUBLIC_READ_ROUTES, ...INTERNAL_READ_ROUTES]
      .map(({ method, path }) => ({ method, path }))
      .sort((left, right) => routeKey(left).localeCompare(routeKey(right)));

    expect(inventoryReadRoutes()).toEqual(expected);
  });

  test.each(INTERNAL_READ_ROUTES)('$method $path rejects unauthenticated and ordinary JWT requests', async route => {
    const app = buildApp();
    const unauthenticated = await request(app)[route.method](`${BASE_PATH}${route.requestPath}`).send({});
    const ordinaryJwt = await request(app)[route.method](`${BASE_PATH}${route.requestPath}`)
      .set('Authorization', authHeader('ordinary-user'))
      .send({});

    expect(unauthenticated.status).toBe(401);
    expect(ordinaryJwt.status).toBe(403);
  });

  test.each(INTERNAL_READ_ROUTES)('$method $path admits the configured operator through the complete auth chain', async route => {
    const { req, res } = await runAuthChain(route, authHeader(process.env.AUTH_USERNAME));

    expect(req.user).toEqual(expect.objectContaining({ username: process.env.AUTH_USERNAME }));
    expect(res.status).not.toHaveBeenCalled();
    expect(res.json).not.toHaveBeenCalled();
  });

  test('keeps the active verified public composition list and detail unauthenticated and allowlisted', async () => {
    const internalFields = {
      created_by: 'excel-import',
      excel_source_sheet: 'Internal prices',
      validation_notes: 'internal review',
      search_text: 'internal aggregate'
    };
    global.smartPackageManagementService = {
      getPackages: jest.fn().mockResolvedValue([{
        id: 7,
        name: 'Tagrende',
        validation_status: 'verified',
        is_active: 1,
        total_count: 1,
        ...internalFields
      }]),
      getPackageDetails: jest.fn().mockResolvedValue({
        id: 7,
        name: 'Tagrende',
        validation_status: 'verified',
        is_active: 1,
        materials: [{ id: 11, name: 'Zink', raw_line: 'internal raw line' }],
        ...internalFields
      })
    };

    const app = buildApp();
    const list = await request(app).get(BASE_PATH);
    const detail = await request(app).get(`${BASE_PATH}/7`);

    expect(list.status).toBe(200);
    expect(detail.status).toBe(200);
    expect(list.body.packages).toEqual([{ id: 7, name: 'Tagrende', validation_status: 'verified' }]);
    expect(detail.body.package).toEqual({
      id: 7,
      name: 'Tagrende',
      validation_status: 'verified',
      materials: [{ id: 11, name: 'Zink' }]
    });
  });
});

// Route fixtures include the live account required by the shared authorization boundary.
beforeEach(() => {
  jest.spyOn(require('../src/services/userService'), 'findByUsername').mockImplementation(async username => ({ id: 1, username, role: 'admin' }));
});
afterEach(() => jest.restoreAllMocks());