33 lines
1.3 KiB
TypeScript
33 lines
1.3 KiB
TypeScript
import { describe, it, expect, beforeEach } from 'vitest';
|
|
import { createApp } from '../../src/app';
|
|
import { authToken, bearer, resetDb } from '../helpers';
|
|
|
|
describe('auth lifecycle (create worker → sign in → /api/me → admin route 403)', () => {
|
|
beforeEach(resetDb);
|
|
|
|
it('issues a bearer that authorizes /api/me as a worker but not admin routes', async () => {
|
|
const app = createApp();
|
|
const token = await authToken(app, 'auth-lifecycle@example.com', 'worker');
|
|
|
|
// /api/me returns the full worker identity for the freshly-issued token.
|
|
const meRes = await app.request('/api/me', { headers: bearer(token) });
|
|
expect(meRes.status).toBe(200);
|
|
const { user } = await meRes.json();
|
|
expect(user).toEqual({
|
|
id: expect.any(String),
|
|
email: 'auth-lifecycle@example.com',
|
|
name: 'auth-lifecycle',
|
|
role: 'worker',
|
|
});
|
|
|
|
// The same token is rejected by an admin-only route (worker is not an admin).
|
|
const adminRes = await app.request('/api/admin/users', { headers: bearer(token) });
|
|
expect(adminRes.status).toBe(403);
|
|
|
|
// The bearer keeps working across repeated requests (stateless token, not one-shot).
|
|
for (let i = 0; i < 3; i++) {
|
|
expect((await app.request('/api/me', { headers: bearer(token) })).status).toBe(200);
|
|
}
|
|
});
|
|
});
|