71 lines
2.5 KiB
TypeScript
71 lines
2.5 KiB
TypeScript
import { test } from '@japa/runner'
|
|
import db from '@adonisjs/lucid/services/db'
|
|
import testUtils from '@adonisjs/core/services/test_utils'
|
|
import Tenant from '#base_modules/Tenant/model/tenant'
|
|
import { createAdminWithToken } from '#tests/utils/auth'
|
|
|
|
test.group('Tenant context', (group) => {
|
|
group.each.setup(() => testUtils.db().wrapInGlobalTransaction())
|
|
|
|
test('rejects an authenticated tenant-scoped request without an X-Tenant-Id header', async ({
|
|
assert,
|
|
client,
|
|
}) => {
|
|
const { token } = await createAdminWithToken([])
|
|
|
|
const response = await client.get('/tenants/current').bearerToken(token)
|
|
|
|
response.assertStatus(400)
|
|
assert.equal(response.body().code, 'E_TENANT_REQUIRED')
|
|
})
|
|
|
|
test('resolves a tenant only for an authenticated member', async ({ assert, client }) => {
|
|
const { admin, token } = await createAdminWithToken([])
|
|
const tenant = await Tenant.create({ name: 'Acme GmbH', slug: 'acme-gmbh', status: 'active' })
|
|
await tenant.related('admins').attach([admin.id])
|
|
|
|
const response = await client
|
|
.get('/tenants/current')
|
|
.header('X-Tenant-Id', String(tenant.id))
|
|
.bearerToken(token)
|
|
|
|
response.assertStatus(200)
|
|
assert.deepEqual(response.body(), {
|
|
tenant: { id: tenant.id, name: tenant.name, slug: tenant.slug },
|
|
})
|
|
})
|
|
|
|
test('rejects a tenant selected by an admin who is not a member', async ({ assert, client }) => {
|
|
const { token } = await createAdminWithToken([])
|
|
const [tenant] = await db
|
|
.table('tenants')
|
|
.insert({ name: 'Other GmbH', slug: 'other-gmbh', status: 'active' })
|
|
.returning(['id'])
|
|
|
|
const response = await client
|
|
.get('/tenants/current')
|
|
.header('X-Tenant-Id', String(tenant.id))
|
|
.bearerToken(token)
|
|
|
|
response.assertStatus(403)
|
|
assert.equal(response.body().code, 'E_TENANT_ACCESS_DENIED')
|
|
})
|
|
|
|
test('rejects membership in an inactive tenant', async ({ assert, client }) => {
|
|
const { admin, token } = await createAdminWithToken([])
|
|
const [tenant] = await db
|
|
.table('tenants')
|
|
.insert({ name: 'Inactive GmbH', slug: 'inactive-gmbh', status: 'inactive' })
|
|
.returning(['id'])
|
|
await db.table('admin_tenants').insert({ admin_id: admin.id, tenant_id: tenant.id })
|
|
|
|
const response = await client
|
|
.get('/tenants/current')
|
|
.header('X-Tenant-Id', String(tenant.id))
|
|
.bearerToken(token)
|
|
|
|
response.assertStatus(403)
|
|
assert.equal(response.body().code, 'E_TENANT_ACCESS_DENIED')
|
|
})
|
|
})
|