GeorgeandClaude Sonnet 5.5
73fffee2f7
- SQLite (better-sqlite3 + TypeORM, WAL) con tabla menu_permissions (usuario web, patrón de ruta); archivo fuera del repo. - GET /api/user/menu para el frontend; GET/PUT/DELETE /api/permissions solo para administradores (acceso "*"). - ADMIN_WEB_USERS garantiza el acceso total al arrancar; no se puede quitar el "*" al último administrador (409, dentro de una transacción). - Patrones validados (`*`, `/modulo/ruta`, `/modulo/*`). A diferencia del frontend anterior, `/inventario/*` ya no habilita `/inventario-x`. - Helper de e2e compartido (SAP simulado, SQLite en memoria). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
61 lines
2.6 KiB
TypeScript
61 lines
2.6 KiB
TypeScript
import type { INestApplication } from '@nestjs/common';
|
|
import request from 'supertest';
|
|
import { createTestApp, employee } from './support/create-test-app.js';
|
|
|
|
describe('Auth (e2e, SAP simulado)', () => {
|
|
let app: INestApplication;
|
|
|
|
beforeEach(async () => {
|
|
app = await createTestApp([employee('ana', 7)]);
|
|
});
|
|
|
|
afterEach(async () => {
|
|
await app.close();
|
|
});
|
|
|
|
const login = (username: string, password: string) =>
|
|
request(app.getHttpServer()).post('/api/auth/login').send({ username, password });
|
|
|
|
it('/health es público, /health/sap exige sesión', async () => {
|
|
await request(app.getHttpServer()).get('/api/health').expect(200);
|
|
await request(app.getHttpServer()).get('/api/health/sap').expect(401);
|
|
});
|
|
|
|
it('flujo completo: login -> me -> ruta protegida -> logout -> 401', async () => {
|
|
const res = await login('ana', 'secreto').expect(200);
|
|
expect(res.body.user).toMatchObject({ webUser: 'ana', empId: 7, firstName: 'ana' });
|
|
expect(JSON.stringify(res.body)).not.toContain('secreto');
|
|
const auth = { Authorization: `Bearer ${res.body.token}` };
|
|
|
|
const me = await request(app.getHttpServer()).get('/api/auth/me').set(auth).expect(200);
|
|
expect(me.body.user.webUser).toBe('ana');
|
|
await request(app.getHttpServer()).get('/api/health/sap').set(auth).expect(200);
|
|
|
|
await request(app.getHttpServer()).post('/api/auth/logout').set(auth).expect(204);
|
|
await request(app.getHttpServer()).get('/api/auth/me').set(auth).expect(401);
|
|
});
|
|
|
|
it('un segundo login invalida el token del primero', async () => {
|
|
const t1 = (await login('ana', 'secreto').expect(200)).body.token;
|
|
const t2 = (await login('ana', 'secreto').expect(200)).body.token;
|
|
await request(app.getHttpServer()).get('/api/auth/me').set('Authorization', `Bearer ${t1}`).expect(401);
|
|
await request(app.getHttpServer()).get('/api/auth/me').set('Authorization', `Bearer ${t2}`).expect(200);
|
|
});
|
|
|
|
it('credenciales inválidas -> 401 y cuerpo inválido -> 400', async () => {
|
|
await login('ana', 'mala').expect(401);
|
|
await login('nadie', 'x').expect(401);
|
|
await request(app.getHttpServer()).post('/api/auth/login').send({ username: 'ana' }).expect(400);
|
|
});
|
|
|
|
it('sin token o con token falso -> 401', async () => {
|
|
await request(app.getHttpServer()).get('/api/auth/me').expect(401);
|
|
await request(app.getHttpServer()).get('/api/auth/me').set('Authorization', 'Bearer falso').expect(401);
|
|
});
|
|
|
|
it('tras 5 intentos fallidos responde 429', async () => {
|
|
for (let i = 0; i < 5; i++) await login('ana', 'mala').expect(401);
|
|
await login('ana', 'secreto').expect(429);
|
|
});
|
|
});
|