92 lines
2.7 KiB
TypeScript
92 lines
2.7 KiB
TypeScript
import { identityApp, type IdentityApp } from './helpers/identity-app';
|
|
import { addressInput, secondActor } from './helpers/commerce';
|
|
|
|
describe('private address book', () => {
|
|
let ctx: IdentityApp;
|
|
beforeAll(async () => {
|
|
ctx = await identityApp();
|
|
}, 60000);
|
|
afterAll(async () => {
|
|
await ctx?.close();
|
|
});
|
|
const auth = { type: 'bearer' as const };
|
|
it('selects one default and selects a replacement after deletion', async () => {
|
|
const first = await ctx
|
|
.api()
|
|
.post('/api/v1/addresses')
|
|
.auth(ctx.token, auth)
|
|
.send(addressInput)
|
|
.expect(201);
|
|
expect(first.body.isDefault).toBe(true);
|
|
const second = await ctx
|
|
.api()
|
|
.post('/api/v1/addresses')
|
|
.auth(ctx.token, auth)
|
|
.send({ ...addressInput, line1: '13 Test Road', isDefault: true })
|
|
.expect(201);
|
|
const list = await ctx
|
|
.api()
|
|
.get('/api/v1/addresses')
|
|
.auth(ctx.token, auth)
|
|
.expect(200);
|
|
expect(
|
|
list.body.filter((row: { isDefault: boolean }) => row.isDefault),
|
|
).toHaveLength(1);
|
|
await ctx
|
|
.api()
|
|
.put(`/api/v1/addresses/${second.body.id}`)
|
|
.auth(ctx.token, auth)
|
|
.send({ ...addressInput, recipient: 'Changed', isDefault: true })
|
|
.expect(200);
|
|
await ctx
|
|
.api()
|
|
.delete(`/api/v1/addresses/${second.body.id}`)
|
|
.auth(ctx.token, auth)
|
|
.expect(204);
|
|
expect(
|
|
await ctx.db.address.findUnique({ where: { id: first.body.id } }),
|
|
).toMatchObject({ isDefault: true });
|
|
});
|
|
it('denies access to another user address, including within the same organization', async () => {
|
|
const owner = await ctx
|
|
.api()
|
|
.post('/api/v1/addresses')
|
|
.auth(ctx.token, auth)
|
|
.send(addressInput)
|
|
.expect(201);
|
|
const actor = await secondActor(ctx);
|
|
const own = await ctx
|
|
.api()
|
|
.get('/api/v1/addresses')
|
|
.auth(actor.token, auth)
|
|
.expect(200);
|
|
expect(own.body).toEqual([]);
|
|
await ctx
|
|
.api()
|
|
.put(`/api/v1/addresses/${owner.body.id}`)
|
|
.auth(actor.token, auth)
|
|
.send(addressInput)
|
|
.expect(404);
|
|
await ctx
|
|
.api()
|
|
.delete(`/api/v1/addresses/${owner.body.id}`)
|
|
.auth(actor.token, auth)
|
|
.expect(404);
|
|
});
|
|
it('rejects invalid contact fields and user-id injection', async () => {
|
|
await ctx
|
|
.api()
|
|
.post('/api/v1/addresses')
|
|
.auth(ctx.token, auth)
|
|
.send({ ...addressInput, phone: '123' })
|
|
.expect(400);
|
|
await ctx
|
|
.api()
|
|
.post('/api/v1/addresses')
|
|
.auth(ctx.token, auth)
|
|
.send({ ...addressInput, userId: ctx.owner.userId })
|
|
.expect(400);
|
|
await ctx.api().get('/api/v1/addresses').expect(401);
|
|
});
|
|
});
|