52 lines
2.9 KiB
JavaScript
52 lines
2.9 KiB
JavaScript
import assert from 'node:assert/strict';
|
|
import test from 'node:test';
|
|
import { buildApp } from '../../src/app/build-app.js';
|
|
import { createInventoryImageService } from '../../src/modules/inventory/services/inventory-image-service.js';
|
|
|
|
test('rejects malformed image updates without writes and accepts normalized boundary values', async (context) => {
|
|
const writes = [];
|
|
const app = buildApp({
|
|
authenticateAdmin: async () => ({ sellerId: 'seller-1' }),
|
|
inventoryImageService: createInventoryImageService({ inventoryImageRepository: {
|
|
async updateOrderForSeller(id, sortOrder, sellerId) { writes.push({ id, sortOrder, sellerId }); return { id, sortOrder }; },
|
|
async updateAltTextForSeller(id, altText, sellerId) { writes.push({ id, altText, sellerId }); return { id, altText }; },
|
|
} }),
|
|
});
|
|
context.after(() => app.close());
|
|
const patch = (path, payload) => app.inject({ method: 'PATCH', url: `/api/v1/admin/images/image-1/${path}`, payload });
|
|
for (const payload of [{}, { sortOrder: -1 }, { sortOrder: 0.2 }, { sortOrder: '1' }, { sortOrder: null }, { sortOrder: 2147483648 }, { sortOrder: 0, sellerId: 'other' }]) {
|
|
const response = await patch('order', payload);
|
|
assert.equal(response.statusCode, 400);
|
|
assert.equal(response.json().error.code, 'VALIDATION_ERROR');
|
|
}
|
|
for (const payload of [{}, { altText: 1 }, { altText: {} }, { altText: [] }, { altText: 'x'.repeat(1001) }, { altText: 'Front', private: true }]) {
|
|
assert.equal((await patch('alt-text', payload)).statusCode, 400);
|
|
}
|
|
assert.deepEqual(writes, []);
|
|
for (const sortOrder of [0, 2147483647]) assert.equal((await patch('order', { sortOrder })).json().data.sortOrder, sortOrder);
|
|
for (const [altText, expected] of [[' Front ', 'Front'], [' ', ''], [null, null], ['x'.repeat(1000), 'x'.repeat(1000)]]) {
|
|
const response = await patch('alt-text', { altText });
|
|
assert.equal(response.statusCode, 200);
|
|
assert.equal(response.json().data.altText, expected);
|
|
}
|
|
assert.ok(writes.every(({ sellerId }) => sellerId === 'seller-1'));
|
|
});
|
|
|
|
test('image update validation does not bypass authentication or CSRF', async (context) => {
|
|
for (const signedIn of [false, true]) {
|
|
const app = buildApp({
|
|
authenticateAdmin: async () => signedIn ? { sellerId: 'seller-1' } : null,
|
|
authorizeUnsafeRequest: async () => { throw Object.assign(new Error('Forbidden'), { statusCode: 403 }); },
|
|
inventoryImageService: {
|
|
async updateOrder() { assert.fail('blocked request reached order service'); },
|
|
async updateAltText() { assert.fail('blocked request reached alt-text service'); },
|
|
},
|
|
});
|
|
context.after(() => app.close());
|
|
for (const path of ['order', 'alt-text']) {
|
|
const response = await app.inject({ method: 'PATCH', url: `/api/v1/admin/images/image-1/${path}`, payload: {} });
|
|
assert.equal(response.statusCode, signedIn ? 403 : 401);
|
|
}
|
|
}
|
|
});
|