pedwfrontend/tests/phase22/representation-list-ownership.test.cjs

const assert = require("assert");
const {
    loadModule,
    createRes,
    createNextConnectMock,
    respondSuccessMock,
    respondErrorMock
} = require("../phase21/_shared.cjs");

const tests = [];
const test = (name, fn) => tests.push({ name, fn });

const loadRepresentationList = ({ session = null, administrator = false } = {}) => {
    const calls = { list: [], download: [] };
    const mod = loadModule("pages/api/file/getrepsblob.js", {
        nextConnect: createNextConnectMock(),
        middleware: () => {},
        getServerSession: async () => session,
        authOptions: () => ({}),
        readAdminSessionCookie: () =>
            administrator ? "valid-admin-session" : null,
        validateAdminSession: () => administrator,
        hashAPIPath: () => "&hash=expected",
        respondError: respondErrorMock,
        respondSuccess: respondSuccessMock,
        consoleLogger: () => {},
        getRepsBlobs: async (...args) => {
            calls.list.push(args);
            return [{ path: "CASE/REP_rep.json" }];
        },
        downloadAllRepsFiles: async (...args) => {
            calls.download.push(args);
            return { value: [{ id: "rep-1" }] };
        }
    });

    return { mod, calls };
};

const representationListRequest = (query = {}) => ({
    query: {
        container: "organisation-container",
        hash: "expected",
        ...query
    },
    headers: {}
});

test("representation listing rejects a missing session before Azure access", async () => {
    const loaded = loadRepresentationList();
    const res = createRes();

    await loaded.mod.default.handler(representationListRequest(), res);

    assert.strictEqual(res.state.statusCode, 403);
    assert.strictEqual(res.state.jsonBody.error.code, "FORBIDDEN");
    assert.strictEqual(loaded.calls.list.length, 0);
    assert.strictEqual(loaded.calls.download.length, 0);
});

test("representation listing rejects cross-user container access before Azure access", async () => {
    const loaded = loadRepresentationList({
        session: { user: { id: "different-container" } }
    });
    const res = createRes();

    await loaded.mod.default.handler(representationListRequest(), res);

    assert.strictEqual(res.state.statusCode, 403);
    assert.strictEqual(loaded.calls.list.length, 0);
    assert.strictEqual(loaded.calls.download.length, 0);
});

test("representation listing preserves authorised organisation-container access", async () => {
    const loaded = loadRepresentationList({
        session: { user: { id: "organisation-container" } }
    });
    const res = createRes();

    await loaded.mod.default.handler(representationListRequest(), res);

    assert.strictEqual(res.state.statusCode, 200);
    assert.deepStrictEqual(loaded.calls.list, [["organisation-container"]]);
    assert.strictEqual(loaded.calls.download.length, 1);
});

test("representation listing preserves existing administrative access", async () => {
    const loaded = loadRepresentationList({ administrator: true });
    const res = createRes();

    await loaded.mod.default.handler(representationListRequest(), res);

    assert.strictEqual(res.state.statusCode, 200);
    assert.strictEqual(loaded.calls.list.length, 1);
});

test("representation listing rejects a missing identifier before authentication or Azure access", async () => {
    let sessionCalls = 0;
    const loaded = loadRepresentationList({
        session: { user: { id: "organisation-container" } }
    });
    loaded.mod = loadModule("pages/api/file/getrepsblob.js", {
        nextConnect: createNextConnectMock(),
        middleware: () => {},
        getServerSession: async () => {
            sessionCalls += 1;
            return { user: { id: "organisation-container" } };
        },
        authOptions: () => ({}),
        readAdminSessionCookie: () => null,
        validateAdminSession: () => false,
        hashAPIPath: () => "&hash=expected",
        respondError: respondErrorMock,
        respondSuccess: respondSuccessMock,
        consoleLogger: () => {},
        getRepsBlobs: async () => {
            loaded.calls.list.push([]);
            return [];
        },
        downloadAllRepsFiles: async () => {
            loaded.calls.download.push([]);
            return {};
        }
    });
    const res = createRes();

    await loaded.mod.default.handler(
        representationListRequest({ container: "" }),
        res
    );

    assert.strictEqual(res.state.statusCode, 400);
    assert.strictEqual(res.state.jsonBody.error.code, "MISSING_REQUIRED_QUERY");
    assert.strictEqual(sessionCalls, 0);
    assert.strictEqual(loaded.calls.list.length, 0);
    assert.strictEqual(loaded.calls.download.length, 0);
});

const run = async () => {
    let passed = 0;
    for (const currentTest of tests) {
        await currentTest.fn();
        passed += 1;
    }
    console.log(
        `Representation listing ownership tests passed (${passed}/${tests.length}).`
    );
};

module.exports = run;

if (require.main === module) {
    run().catch((error) => {
        console.error(error);
        process.exit(1);
    });
}