rikrdo/mercadodevida
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(ADM-018): completed feature

Browse Source
This commit is contained in:
chattie
2026-08-17 22:23:10 +02:00
parent cf1c69fc8b
commit d595b4871f
871 changed files with 47411 additions and 281 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
legacy/specs-old/F-006-users-rbac/TESTS.md Normal file
View File

@@ -0,0 +1,20 @@
# TESTS — F-006 Users: profile, addresses, RBAC
## Unit — src/shared/tests/auth.test.ts
1. requireRole allows matching role, throws 403 AppError otherwise
## Unit — src/modules/users/tests/ownership.test.ts
1. canAccessUser: owner true, admin true, other customer false
2. same decisions regardless of target existence (authz before lookup)
## Integration — src/app/tests/users.itest.ts (real PostgreSQL)
1. unauthenticated GET /users/:id -> 401 UNAUTHORIZED
2. register+login A and B; A GET /users/:idB -> 403 FORBIDDEN (AC1); A GET own -> 200
3. PATCH own profile upserts; GET returns it
4. GET /users as customer -> 403 (AC2)
5. promote A to admin via SQL; GET /users -> 200 with items (AC3)
6. address CRUD end-to-end for own addresses: POST 201, GET list, PATCH 200, DELETE 204 (AC4)
7. A cannot POST/PATCH/DELETE addresses on B's resource -> 403
8. PATCH/DELETE unknown address id on own resource -> 404
9. invalid address uuid param -> 400 VALIDATION_ERROR
10. F-005 regression: login still 200 + cookie; /auth routes intact