rikrdo/mercadodevida
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
546971280f43e48facdc419b102e8003afd72593
mercadodevida/specs/F-006-users-rbac/TESTS.md
rikrdo 546971280f feat(F-006): users profile, addresses and RBAC 
- users module: profile + address CRUD behind use cases (users_profiles,
  users_addresses)
- roles customer/admin on identity_users; role resolved from DB per request
- shared auth contract (Authenticate, requireRole, requireOwnerOrAdmin)
  injected from composition root; users never imports identity
- authorization runs before existence checks; address SQL scoped by user_id
- @fastify/cookie registered once at app root (cross-module)
- migrations 003_identity_roles + 004_users (reversible)
- no new npm dependencies; tests: unit 52, integration 22

Gates: reviewer/security/qa APPROVED; verify.sh green
2026-08-15 09:28:15 +02:00

1.0 KiB
Raw Blame History

TESTS — F-006 Users: profile, addresses, RBAC

Unit — src/shared/tests/auth.test.ts

  1. requireRole allows matching role, throws 403 AppError otherwise

Unit — src/modules/users/tests/ownership.test.ts

  1. canAccessUser: owner true, admin true, other customer false
  2. same decisions regardless of target existence (authz before lookup)

Integration — src/app/tests/users.itest.ts (real PostgreSQL)

  1. unauthenticated GET /users/:id -> 401 UNAUTHORIZED
  2. register+login A and B; A GET /users/:idB -> 403 FORBIDDEN (AC1); A GET own -> 200
  3. PATCH own profile upserts; GET returns it
  4. GET /users as customer -> 403 (AC2)
  5. promote A to admin via SQL; GET /users -> 200 with items (AC3)
  6. address CRUD end-to-end for own addresses: POST 201, GET list, PATCH 200, DELETE 204 (AC4)
  7. A cannot POST/PATCH/DELETE addresses on B's resource -> 403
  8. PATCH/DELETE unknown address id on own resource -> 404
  9. invalid address uuid param -> 400 VALIDATION_ERROR
  10. F-005 regression: login still 200 + cookie; /auth routes intact