tilbudgivern/backend/__tests__/usersAuthorization.test.js

process.env.JWT_ACCESS_SECRET = process.env.JWT_ACCESS_SECRET || 'users-authorization-access-test-secret';
process.env.JWT_REFRESH_SECRET = process.env.JWT_REFRESH_SECRET || 'users-authorization-refresh-test-secret';

const express = require('express');
const request = require('supertest');
const jwt = require('jsonwebtoken');
const userService = require('../src/services/userService');
const usersRouter = require('../src/routes/users');

const app = express();
app.use(express.json());
app.use('/api/users', usersRouter);

const token = (claims = {}) => `Bearer ${jwt.sign({ id: 7, username: 'operator', role: 'admin', ...claims }, process.env.JWT_ACCESS_SECRET)}`;

afterEach(() => jest.restoreAllMocks());

test.each([
  ['deleted account', null],
  ['demoted account', { id: 7, username: 'operator', role: 'user' }],
  ['different account id', { id: 8, username: 'operator', role: 'admin' }]
])('rejects an otherwise valid admin JWT for a %s', async (_label, current) => {
  jest.spyOn(userService, 'findByUsername').mockResolvedValue(current);
  const list = jest.spyOn(userService, 'listUsers').mockResolvedValue([]);

  const response = await request(app).get('/api/users').set('Authorization', token());

  expect(response.status).toBe(403);
  expect(list).not.toHaveBeenCalled();
});

test('uses the current database role rather than the JWT role for privileged requests', async () => {
  jest.spyOn(userService, 'findByUsername').mockResolvedValue({ id: 7, username: 'operator', role: 'admin' });
  jest.spyOn(userService, 'listUsers').mockResolvedValue([{ id: 7, username: 'operator', role: 'admin' }]);

  const response = await request(app).get('/api/users')
    .set('Authorization', token({ role: 'user' }));

  expect(response.status).toBe(200);
  expect(response.body.users).toHaveLength(1);
});

test('fails closed when current account state cannot be loaded', async () => {
  jest.spyOn(userService, 'findByUsername').mockRejectedValue(new Error('database unavailable'));

  const response = await request(app).get('/api/users').set('Authorization', token());

  expect(response.status).toBe(503);
});