update

2026-09-02 09:19:43 +03:00
parent 74cb5b6176
commit 962f489142
34 changed files with 1190 additions and 124 deletions
@@ -0,0 +1,70 @@
+import { test } from '@japa/runner'
+import db from '@adonisjs/lucid/services/db'
+import testUtils from '@adonisjs/core/services/test_utils'
+import Tenant from '#base_modules/Tenant/model/tenant'
+import { createAdminWithToken } from '#tests/utils/auth'
+
+test.group('Tenant context', (group) => {
+  group.each.setup(() => testUtils.db().wrapInGlobalTransaction())
+
+  test('rejects an authenticated tenant-scoped request without an X-Tenant-Id header', async ({
+    assert,
+    client,
+  }) => {
+    const { token } = await createAdminWithToken([])
+
+    const response = await client.get('/tenants/current').bearerToken(token)
+
+    response.assertStatus(400)
+    assert.equal(response.body().code, 'E_TENANT_REQUIRED')
+  })
+
+  test('resolves a tenant only for an authenticated member', async ({ assert, client }) => {
+    const { admin, token } = await createAdminWithToken([])
+    const tenant = await Tenant.create({ name: 'Acme GmbH', slug: 'acme-gmbh', status: 'active' })
+    await tenant.related('admins').attach([admin.id])
+
+    const response = await client
+      .get('/tenants/current')
+      .header('X-Tenant-Id', String(tenant.id))
+      .bearerToken(token)
+
+    response.assertStatus(200)
+    assert.deepEqual(response.body(), {
+      tenant: { id: tenant.id, name: tenant.name, slug: tenant.slug },
+    })
+  })
+
+  test('rejects a tenant selected by an admin who is not a member', async ({ assert, client }) => {
+    const { token } = await createAdminWithToken([])
+    const [tenant] = await db
+      .table('tenants')
+      .insert({ name: 'Other GmbH', slug: 'other-gmbh', status: 'active' })
+      .returning(['id'])
+
+    const response = await client
+      .get('/tenants/current')
+      .header('X-Tenant-Id', String(tenant.id))
+      .bearerToken(token)
+
+    response.assertStatus(403)
+    assert.equal(response.body().code, 'E_TENANT_ACCESS_DENIED')
+  })
+
+  test('rejects membership in an inactive tenant', async ({ assert, client }) => {
+    const { admin, token } = await createAdminWithToken([])
+    const [tenant] = await db
+      .table('tenants')
+      .insert({ name: 'Inactive GmbH', slug: 'inactive-gmbh', status: 'inactive' })
+      .returning(['id'])
+    await db.table('admin_tenants').insert({ admin_id: admin.id, tenant_id: tenant.id })
+
+    const response = await client
+      .get('/tenants/current')
+      .header('X-Tenant-Id', String(tenant.id))
+      .bearerToken(token)
+
+    response.assertStatus(403)
+    assert.equal(response.body().code, 'E_TENANT_ACCESS_DENIED')
+  })
+})