93 lines
3.0 KiB
TypeScript
93 lines
3.0 KiB
TypeScript
import type { Request, Response } from "express";
|
|
import type { NextApiRequest, NextApiResponse } from "next";
|
|
import { createMocks } from "node-mocks-http";
|
|
import { describe, it, expect } from "vitest";
|
|
|
|
import type { HttpError } from "@calcom/lib/http-error";
|
|
import prisma from "@calcom/prisma";
|
|
|
|
import authMiddleware from "../../../pages/api/bookings/[id]/_auth-middleware";
|
|
|
|
type CustomNextApiRequest = NextApiRequest & Request;
|
|
type CustomNextApiResponse = NextApiResponse & Response;
|
|
|
|
describe("Bookings auth middleware", () => {
|
|
it("Returns 403 when user has no permission to the booking", async () => {
|
|
const trialUser = await prisma.user.findFirstOrThrow({ where: { email: "trial@example.com" } });
|
|
const proUser = await prisma.user.findFirstOrThrow({ where: { email: "pro@example.com" } });
|
|
const booking = await prisma.booking.findFirstOrThrow({ where: { userId: proUser.id } });
|
|
|
|
const { req } = createMocks<CustomNextApiRequest, CustomNextApiResponse>({
|
|
method: "GET",
|
|
body: {},
|
|
query: {
|
|
id: booking.id,
|
|
},
|
|
});
|
|
|
|
req.userId = trialUser.id;
|
|
|
|
try {
|
|
await authMiddleware(req);
|
|
} catch (error) {
|
|
const httpError = error as HttpError;
|
|
expect(httpError.statusCode).toBe(403);
|
|
}
|
|
});
|
|
|
|
it("No error is thrown when user is the booking user", async () => {
|
|
const proUser = await prisma.user.findFirstOrThrow({ where: { email: "pro@example.com" } });
|
|
const booking = await prisma.booking.findFirstOrThrow({ where: { userId: proUser.id } });
|
|
|
|
const { req } = createMocks<CustomNextApiRequest, CustomNextApiResponse>({
|
|
method: "GET",
|
|
body: {},
|
|
query: {
|
|
id: booking.id,
|
|
},
|
|
});
|
|
|
|
req.userId = proUser.id;
|
|
|
|
await authMiddleware(req);
|
|
});
|
|
|
|
it("No error is thrown when user is system-wide admin", async () => {
|
|
const adminUser = await prisma.user.findFirstOrThrow({ where: { email: "admin@example.com" } });
|
|
const proUser = await prisma.user.findFirstOrThrow({ where: { email: "pro@example.com" } });
|
|
const booking = await prisma.booking.findFirstOrThrow({ where: { userId: proUser.id } });
|
|
|
|
const { req } = createMocks<CustomNextApiRequest, CustomNextApiResponse>({
|
|
method: "GET",
|
|
body: {},
|
|
query: {
|
|
id: booking.id,
|
|
},
|
|
});
|
|
|
|
req.userId = adminUser.id;
|
|
req.isSystemWideAdmin = true;
|
|
|
|
await authMiddleware(req);
|
|
});
|
|
|
|
it("No error is thrown when user is org-wide admin", async () => {
|
|
const adminUser = await prisma.user.findFirstOrThrow({ where: { email: "owner1-acme@example.com" } });
|
|
const memberUser = await prisma.user.findFirstOrThrow({ where: { email: "member1-acme@example.com" } });
|
|
const booking = await prisma.booking.findFirstOrThrow({ where: { userId: memberUser.id } });
|
|
|
|
const { req } = createMocks<CustomNextApiRequest, CustomNextApiResponse>({
|
|
method: "GET",
|
|
body: {},
|
|
query: {
|
|
id: booking.id,
|
|
},
|
|
});
|
|
|
|
req.userId = adminUser.id;
|
|
req.isOrganizationOwnerOrAdmin = true;
|
|
|
|
await authMiddleware(req);
|
|
});
|
|
});
|