basic-erp/apps/api/test/auth.e2e-spec.ts

import type { INestApplication } from '@nestjs/common';
import request from 'supertest';
import { createTestApp, employee } from './support/create-test-app.js';

describe('Auth (e2e, SAP simulado)', () => {
  let app: INestApplication;

  beforeEach(async () => {
    app = await createTestApp([employee('ana', 7)]);
  });

  afterEach(async () => {
    await app.close();
  });

  const login = (username: string, password: string) =>
    request(app.getHttpServer()).post('/api/auth/login').send({ username, password });

  it('/health es público, /health/sap exige sesión', async () => {
    await request(app.getHttpServer()).get('/api/health').expect(200);
    await request(app.getHttpServer()).get('/api/health/sap').expect(401);
  });

  it('flujo completo: login -> me -> ruta protegida -> logout -> 401', async () => {
    const res = await login('ana', 'secreto').expect(200);
    expect(res.body.user).toMatchObject({ webUser: 'ana', empId: 7, firstName: 'ana' });
    expect(JSON.stringify(res.body)).not.toContain('secreto');
    const auth = { Authorization: `Bearer ${res.body.token}` };

    const me = await request(app.getHttpServer()).get('/api/auth/me').set(auth).expect(200);
    expect(me.body.user.webUser).toBe('ana');
    await request(app.getHttpServer()).get('/api/health/sap').set(auth).expect(200);

    await request(app.getHttpServer()).post('/api/auth/logout').set(auth).expect(204);
    await request(app.getHttpServer()).get('/api/auth/me').set(auth).expect(401);
  });

  it('un segundo login invalida el token del primero', async () => {
    const t1 = (await login('ana', 'secreto').expect(200)).body.token;
    const t2 = (await login('ana', 'secreto').expect(200)).body.token;
    await request(app.getHttpServer()).get('/api/auth/me').set('Authorization', `Bearer ${t1}`).expect(401);
    await request(app.getHttpServer()).get('/api/auth/me').set('Authorization', `Bearer ${t2}`).expect(200);
  });

  it('credenciales inválidas -> 401 y cuerpo inválido -> 400', async () => {
    await login('ana', 'mala').expect(401);
    await login('nadie', 'x').expect(401);
    await request(app.getHttpServer()).post('/api/auth/login').send({ username: 'ana' }).expect(400);
  });

  it('sin token o con token falso -> 401', async () => {
    await request(app.getHttpServer()).get('/api/auth/me').expect(401);
    await request(app.getHttpServer()).get('/api/auth/me').set('Authorization', 'Bearer falso').expect(401);
  });

  it('tras 5 intentos fallidos responde 429', async () => {
    for (let i = 0; i < 5; i++) await login('ana', 'mala').expect(401);
    await login('ana', 'secreto').expect(429);
  });
});