Updated frontend

nodejs/tests/invite.test.js

@@ -0,0 +1,139 @@
+'use strict';
+
+const { TEST_CREDS, login, request, app } = require('./setup');
+
+let token;
+let inviteTokenId; // the invite token string returned by POST /api/user/invite
+
+beforeAll(async () => {
+	token = await login();
+});
+
+// Clean up any invite tokens we created — there's no bulk delete API so we
+// rely on the DELETE endpoint tests and the fact that Redis keys are flushed
+// by globalSetup before every run.
+
+describe('Invite — POST /api/user/invite (create)', () => {
+	test('requires auth — 401 without token', async () => {
+		const res = await request(app)
+			.post('/api/user/invite')
+			.send({ mail: 'nobody@example.com', groups: [] });
+		expect(res.status).toBe(401);
+	});
+
+	test('admin can create an invite with no mail and no groups', async () => {
+		const res = await request(app)
+			.post('/api/user/invite')
+			.set('auth-token', token)
+			.send({});
+
+		expect(res.status).toBe(200);
+		expect(res.body).toHaveProperty('token');
+		expect(typeof res.body.token).toBe('string');
+		expect(res.body.token.length).toBeGreaterThan(0);
+		expect(res.body).toHaveProperty('link');
+		// mail was not provided, so mail_sent should be false
+		expect(res.body.mail_sent).toBe(false);
+
+		inviteTokenId = res.body.token;
+	});
+
+	test('admin can create an invite with groups', async () => {
+		const res = await request(app)
+			.post('/api/user/invite')
+			.set('auth-token', token)
+			.send({ groups: ['app_sso_admin'] });
+
+		expect(res.status).toBe(200);
+		expect(res.body).toHaveProperty('token');
+	});
+});
+
+describe('Invite — GET /api/user/invite (list)', () => {
+	test('requires auth — 401 without token', async () => {
+		const res = await request(app).get('/api/user/invite');
+		expect(res.status).toBe(401);
+	});
+
+	test('admin can list invite tokens', async () => {
+		const res = await request(app)
+			.get('/api/user/invite')
+			.set('auth-token', token);
+
+		expect(res.status).toBe(200);
+		expect(Array.isArray(res.body.results)).toBe(true);
+	});
+
+	test('list includes the token created above', async () => {
+		expect(inviteTokenId).toBeDefined();
+
+		const res = await request(app)
+			.get('/api/user/invite')
+			.set('auth-token', token);
+
+		const found = res.body.results.find(t => t.token === inviteTokenId);
+		expect(found).toBeDefined();
+		// isPrivate field on the base token class must be exposed in the list response
+		expect(found).toHaveProperty('token', inviteTokenId);
+	});
+});
+
+describe('Invite — PUT /api/user/invite/:token (update)', () => {
+	test('requires auth — 401 without token', async () => {
+		expect(inviteTokenId).toBeDefined();
+		const res = await request(app)
+			.put(`/api/user/invite/${inviteTokenId}`)
+			.send({ groups: ['app_sso_users'] });
+		expect(res.status).toBe(401);
+	});
+
+	test('admin can update groups on an invite token', async () => {
+		expect(inviteTokenId).toBeDefined();
+		const res = await request(app)
+			.put(`/api/user/invite/${inviteTokenId}`)
+			.set('auth-token', token)
+			.send({ groups: ['app_sso_users'] });
+
+		expect(res.status).toBe(200);
+		expect(res.body).toHaveProperty('results');
+		expect(res.body.results).toHaveProperty('token', inviteTokenId);
+	});
+
+	test('updating a nonexistent token returns an error', async () => {
+		const res = await request(app)
+			.put('/api/user/invite/00000000-0000-0000-0000-000000000000')
+			.set('auth-token', token)
+			.send({ groups: [] });
+		expect(res.status).toBeGreaterThanOrEqual(400);
+	});
+});
+
+describe('Invite — DELETE /api/user/invite/:token (invalidate)', () => {
+	test('requires auth — 401 without token', async () => {
+		expect(inviteTokenId).toBeDefined();
+		const res = await request(app)
+			.delete(`/api/user/invite/${inviteTokenId}`);
+		expect(res.status).toBe(401);
+	});
+
+	test('admin can invalidate an invite token', async () => {
+		expect(inviteTokenId).toBeDefined();
+		const res = await request(app)
+			.delete(`/api/user/invite/${inviteTokenId}`)
+			.set('auth-token', token);
+
+		expect(res.status).toBe(200);
+		expect(res.body).toHaveProperty('results', true);
+	});
+
+	test('invalidated token can no longer be updated', async () => {
+		expect(inviteTokenId).toBeDefined();
+		const res = await request(app)
+			.put(`/api/user/invite/${inviteTokenId}`)
+			.set('auth-token', token)
+			.send({ groups: [] });
+
+		// Should be 400 (token is no longer valid)
+		expect(res.status).toBe(400);
+	});
+});