02b7522b87
Add `role: Role` to the shared `PublicUser` contract and return it from `GET /api/me` (defaulting to 'worker' when the session user has no role). This lets the planned admin app gate access by role. Also add the admin dev origin `http://localhost:5174` to the default `WEB_ORIGINS` (env.ts) and to `.env.example`, so the admin SPA on :5174 can reach the API at :3000 cross-origin (drives both hono/cors and better-auth trustedOrigins).
43 lines
1.4 KiB
TypeScript
43 lines
1.4 KiB
TypeScript
import { describe, it, expect } from 'vitest';
|
|
import { createApp } from '../src/app';
|
|
import { authToken, bearer } from './helpers';
|
|
|
|
describe('GET /api/me', () => {
|
|
it('rejects an unauthenticated request', async () => {
|
|
const app = createApp();
|
|
const res = await app.request('/api/me');
|
|
expect(res.status).toBe(401);
|
|
});
|
|
|
|
it('returns the user for a valid bearer token (create -> sign-in -> me)', async () => {
|
|
const app = createApp();
|
|
const email = 'me@example.com';
|
|
const token = await authToken(app, email);
|
|
|
|
const res = await app.request('/api/me', { headers: bearer(token) });
|
|
expect(res.status).toBe(200);
|
|
const body = await res.json();
|
|
expect(body.user.email).toBe(email);
|
|
});
|
|
|
|
it('returns role "worker" for a worker token', async () => {
|
|
const app = createApp();
|
|
const token = await authToken(app, 'worker-role@example.com', 'worker');
|
|
|
|
const res = await app.request('/api/me', { headers: bearer(token) });
|
|
expect(res.status).toBe(200);
|
|
const body = await res.json();
|
|
expect(body.user.role).toBe('worker');
|
|
});
|
|
|
|
it('returns role "admin" for an admin token', async () => {
|
|
const app = createApp();
|
|
const token = await authToken(app, 'admin-role@example.com', 'admin');
|
|
|
|
const res = await app.request('/api/me', { headers: bearer(token) });
|
|
expect(res.status).toBe(200);
|
|
const body = await res.json();
|
|
expect(body.user.role).toBe('admin');
|
|
});
|
|
});
|