49 lines
2.0 KiB
JavaScript
49 lines
2.0 KiB
JavaScript
import assert from 'node:assert/strict';
|
|
import test from 'node:test';
|
|
|
|
import { buildApp } from '../../src/app/build-app.js';
|
|
|
|
function createTestApp({ authorizeUnsafeRequest } = {}) {
|
|
const views = [];
|
|
return buildApp({
|
|
authenticateAdmin: async () => ({ sellerId: 'seller-1' }),
|
|
authorizeUnsafeRequest,
|
|
savedViewService: {
|
|
async list() { return views; },
|
|
async create({ view }) { const result = { id: 'view-1', ...view }; views.push(result); return result; },
|
|
async update({ view }) { return { id: 'view-1', ...view }; },
|
|
async delete() { return { id: 'view-1' }; },
|
|
},
|
|
});
|
|
}
|
|
|
|
test('creates, lists, updates, and deletes saved views', async (testContext) => {
|
|
const app = createTestApp();
|
|
testContext.after(() => app.close());
|
|
|
|
const createResponse = await app.inject({ method: 'POST', url: '/api/v1/admin/saved-views', payload: { name: 'Needs Attention', filters: { missingImages: true } } });
|
|
const listResponse = await app.inject({ method: 'GET', url: '/api/v1/admin/saved-views' });
|
|
const updateResponse = await app.inject({ method: 'PATCH', url: '/api/v1/admin/saved-views/view-1', payload: { name: 'Recent', filters: { sort: 'recent' } } });
|
|
const deleteResponse = await app.inject({ method: 'DELETE', url: '/api/v1/admin/saved-views/view-1' });
|
|
|
|
assert.equal(createResponse.statusCode, 201);
|
|
assert.equal(listResponse.statusCode, 200);
|
|
assert.equal(updateResponse.statusCode, 200);
|
|
assert.equal(deleteResponse.statusCode, 204);
|
|
});
|
|
|
|
test('protects saved-view mutations with CSRF validation', async (testContext) => {
|
|
const app = createTestApp({
|
|
authorizeUnsafeRequest: async () => {
|
|
const error = new Error('CSRF validation failed.');
|
|
error.code = 'FORBIDDEN';
|
|
error.statusCode = 403;
|
|
throw error;
|
|
},
|
|
});
|
|
testContext.after(() => app.close());
|
|
|
|
const response = await app.inject({ method: 'POST', url: '/api/v1/admin/saved-views', payload: { name: 'Recent', filters: {} } });
|
|
assert.equal(response.statusCode, 403);
|
|
});
|