75 lines
3.1 KiB
TypeScript
75 lines
3.1 KiB
TypeScript
import assert from 'node:assert/strict'
|
|
import test from 'node:test'
|
|
import prisma from '../../utils/prisma'
|
|
import { getDisposalDetail, getDisposalList, getEquipmentDisposalHistory } from '../disposalController'
|
|
|
|
const response = (role: string) => {
|
|
const state = { code: 200, body: null as any }
|
|
const res = {
|
|
locals: { user: { id: 6, role } },
|
|
status(code: number) { state.code = code; return this },
|
|
json(body: any) { state.body = body; return this }
|
|
}
|
|
return { state, res }
|
|
}
|
|
|
|
test('disposal history limits IT to applicant across root and child equipment records', async () => {
|
|
const original = prisma.disposalRecord.findMany
|
|
const records = [{ id: 1, applied_by: 6 }, { id: 2, applied_by: 99 }]
|
|
const queries: any[] = []
|
|
;(prisma.disposalRecord.findMany as any) = async (args: any) => {
|
|
queries.push(args.where)
|
|
const userId = args.where.AND[0].applied_by
|
|
return records.filter((item) => !userId || item.applied_by === userId)
|
|
}
|
|
try {
|
|
for (const role of ['it', 'administrative', 'admin']) {
|
|
const { state, res } = response(role)
|
|
await getEquipmentDisposalHistory({ params: { equipment_id: '10' } } as any, res as any)
|
|
assert.equal(state.code, 200)
|
|
assert.deepEqual(state.body.data.map((item: any) => item.id), role === 'it' ? [1] : [1, 2])
|
|
}
|
|
assert.deepEqual(queries[0].AND, [
|
|
{ applied_by: 6 },
|
|
{ OR: [{ equipment_id: 10 }, { items: { some: { equipment_id: 10 } } }] }
|
|
])
|
|
} finally {
|
|
;(prisma.disposalRecord.findMany as any) = original
|
|
}
|
|
})
|
|
|
|
test('disposal detail permits IT own record and rejects another applicant', async () => {
|
|
const original = prisma.disposalRecord.findUnique
|
|
;(prisma.disposalRecord.findUnique as any) = async (args: any) => ({
|
|
id: args.where.id, applied_by: args.where.id === 1 ? 6 : 99, status: 'pending'
|
|
})
|
|
try {
|
|
for (const [role, id, code] of [['it', '1', 200], ['it', '2', 403], ['admin', '2', 200], ['administrative', '2', 200]] as const) {
|
|
const { res, state } = response(role)
|
|
await getDisposalDetail({ params: { id } } as any, res as any)
|
|
assert.equal(state.code, code)
|
|
if (code === 403) assert.equal(state.body.data, null)
|
|
}
|
|
} finally {
|
|
;(prisma.disposalRecord.findUnique as any) = original
|
|
}
|
|
})
|
|
|
|
test('disposal read endpoints reject unsupported roles and malformed IDs before DB access', async () => {
|
|
for (const handler of [getDisposalList, getDisposalDetail, getEquipmentDisposalHistory]) {
|
|
const { res, state } = response('user')
|
|
await handler({ query: {}, params: { id: '1', equipment_id: '1' } } as any, res as any)
|
|
assert.equal(state.code, 403)
|
|
}
|
|
for (const handler of [getDisposalDetail, getEquipmentDisposalHistory]) {
|
|
for (const value of ['0', '-1', 'NaN', '9007199254740992', ['1', '2']]) {
|
|
const { res, state } = response('it')
|
|
await handler({ params: { id: value, equipment_id: value } } as any, res as any)
|
|
assert.equal(state.code, 422)
|
|
}
|
|
}
|
|
const { res, state } = response('administrative')
|
|
await getDisposalList({ query: { scope: 'all' } } as any, res as any)
|
|
assert.equal(state.code, 403)
|
|
})
|