/* eslint-disable flowtype/require-valid-file-annotation */ import TestServer from 'fetch-test-server'; import app from '../app'; import { flushdb, seed } from '../test/support'; import { buildUser } from '../test/factories'; const server = new TestServer(app.callback()); beforeEach(flushdb); afterAll(server.close); describe('#users.list', async () => { it('should allow filtering by user name', async () => { const user = await buildUser({ name: 'Tester' }); // suspended user should not be returned await buildUser({ name: 'Tester', teamId: user.teamId, suspendedAt: new Date(), }); const res = await server.post('/api/users.list', { body: { query: 'test', token: user.getJwtToken(), }, }); const body = await res.json(); expect(res.status).toEqual(200); expect(body.data.length).toEqual(1); expect(body.data[0].id).toEqual(user.id); }); it('should allow including suspended', async () => { const user = await buildUser({ name: 'Tester' }); await buildUser({ name: 'Tester', teamId: user.teamId, suspendedAt: new Date(), }); const res = await server.post('/api/users.list', { body: { query: 'test', includeSuspended: true, token: user.getJwtToken(), }, }); const body = await res.json(); expect(res.status).toEqual(200); expect(body.data.length).toEqual(2); }); it('should return teams paginated user list', async () => { const { admin, user } = await seed(); const res = await server.post('/api/users.list', { body: { token: admin.getJwtToken() }, }); const body = await res.json(); expect(res.status).toEqual(200); expect(body.data.length).toEqual(2); expect(body.data[0].id).toEqual(user.id); expect(body.data[1].id).toEqual(admin.id); }); it('should require admin for detailed info', async () => { const { user, admin } = await seed(); const res = await server.post('/api/users.list', { body: { token: user.getJwtToken() }, }); const body = await res.json(); expect(res.status).toEqual(200); expect(body.data.length).toEqual(2); expect(body.data[0].email).toEqual(undefined); expect(body.data[1].email).toEqual(undefined); expect(body.data[0].id).toEqual(user.id); expect(body.data[1].id).toEqual(admin.id); }); }); describe('#users.info', async () => { it('should return known user', async () => { const user = await buildUser(); const res = await server.post('/api/users.info', { body: { token: user.getJwtToken() }, }); const body = await res.json(); expect(res.status).toEqual(200); expect(body.data.id).toEqual(user.id); expect(body.data.name).toEqual(user.name); }); it('should require authentication', async () => { const res = await server.post('/api/users.info'); expect(res.status).toEqual(401); }); }); describe('#users.invite', async () => { it('should return sent invites', async () => { const user = await buildUser(); const res = await server.post('/api/users.invite', { body: { token: user.getJwtToken(), invites: [{ email: 'test@example.com', name: 'Test', guest: false }], }, }); const body = await res.json(); expect(res.status).toEqual(200); expect(body.data.sent.length).toEqual(1); }); it('should require authentication', async () => { const res = await server.post('/api/users.invite'); expect(res.status).toEqual(401); }); }); describe('#users.delete', async () => { it('should not allow deleting without confirmation', async () => { const user = await buildUser(); const res = await server.post('/api/users.delete', { body: { token: user.getJwtToken() }, }); expect(res.status).toEqual(400); }); it('should allow deleting last admin if only user', async () => { const user = await buildUser({ isAdmin: true }); const res = await server.post('/api/users.delete', { body: { token: user.getJwtToken(), confirmation: true }, }); expect(res.status).toEqual(200); }); it('should not allow deleting last admin if many users', async () => { const user = await buildUser({ isAdmin: true }); await buildUser({ teamId: user.teamId, isAdmin: false }); const res = await server.post('/api/users.delete', { body: { token: user.getJwtToken(), confirmation: true }, }); expect(res.status).toEqual(400); }); it('should allow deleting user account with confirmation', async () => { const user = await buildUser(); const res = await server.post('/api/users.delete', { body: { token: user.getJwtToken(), confirmation: true }, }); expect(res.status).toEqual(200); }); it('should allow deleting pending user account with admin', async () => { const user = await buildUser({ isAdmin: true }); const pending = await buildUser({ teamId: user.teamId, lastActiveAt: null, }); const res = await server.post('/api/users.delete', { body: { token: user.getJwtToken(), id: pending.id, confirmation: true }, }); expect(res.status).toEqual(200); }); it('should not allow deleting another user account', async () => { const user = await buildUser({ isAdmin: true }); const user2 = await buildUser({ teamId: user.teamId }); const res = await server.post('/api/users.delete', { body: { token: user.getJwtToken(), id: user2.id, confirmation: true }, }); expect(res.status).toEqual(403); }); it('should require authentication', async () => { const res = await server.post('/api/users.delete'); const body = await res.json(); expect(res.status).toEqual(401); expect(body).toMatchSnapshot(); }); }); describe('#users.update', async () => { it('should update user profile information', async () => { const { user } = await seed(); const res = await server.post('/api/users.update', { body: { token: user.getJwtToken(), name: 'New name' }, }); const body = await res.json(); expect(res.status).toEqual(200); expect(body.data.name).toEqual('New name'); }); it('should require authentication', async () => { const res = await server.post('/api/users.update'); const body = await res.json(); expect(res.status).toEqual(401); expect(body).toMatchSnapshot(); }); }); describe('#users.promote', async () => { it('should promote a new admin', async () => { const { admin, user } = await seed(); const res = await server.post('/api/users.promote', { body: { token: admin.getJwtToken(), id: user.id }, }); const body = await res.json(); expect(res.status).toEqual(200); expect(body).toMatchSnapshot(); }); it('should require admin', async () => { const user = await buildUser(); const res = await server.post('/api/users.promote', { body: { token: user.getJwtToken(), id: user.id }, }); const body = await res.json(); expect(res.status).toEqual(403); expect(body).toMatchSnapshot(); }); }); describe('#users.demote', async () => { it('should demote an admin', async () => { const { admin, user } = await seed(); await user.update({ isAdmin: true }); // Make another admin const res = await server.post('/api/users.demote', { body: { token: admin.getJwtToken(), id: user.id, }, }); const body = await res.json(); expect(res.status).toEqual(200); expect(body).toMatchSnapshot(); }); it('should not demote admins if only one available', async () => { const admin = await buildUser({ isAdmin: true }); const res = await server.post('/api/users.demote', { body: { token: admin.getJwtToken(), id: admin.id, }, }); const body = await res.json(); expect(res.status).toEqual(400); expect(body).toMatchSnapshot(); }); it('should require admin', async () => { const user = await buildUser(); const res = await server.post('/api/users.promote', { body: { token: user.getJwtToken(), id: user.id }, }); const body = await res.json(); expect(res.status).toEqual(403); expect(body).toMatchSnapshot(); }); }); describe('#users.suspend', async () => { it('should suspend an user', async () => { const { admin, user } = await seed(); const res = await server.post('/api/users.suspend', { body: { token: admin.getJwtToken(), id: user.id, }, }); const body = await res.json(); expect(res.status).toEqual(200); expect(body).toMatchSnapshot(); }); it('should not allow suspending the user themselves', async () => { const admin = await buildUser({ isAdmin: true }); const res = await server.post('/api/users.suspend', { body: { token: admin.getJwtToken(), id: admin.id, }, }); const body = await res.json(); expect(res.status).toEqual(400); expect(body).toMatchSnapshot(); }); it('should require admin', async () => { const user = await buildUser(); const res = await server.post('/api/users.suspend', { body: { token: user.getJwtToken(), id: user.id }, }); const body = await res.json(); expect(res.status).toEqual(403); expect(body).toMatchSnapshot(); }); }); describe('#users.activate', async () => { it('should activate a suspended user', async () => { const { admin, user } = await seed(); await user.update({ suspendedById: admin.id, suspendedAt: new Date(), }); expect(user.isSuspended).toBe(true); const res = await server.post('/api/users.activate', { body: { token: admin.getJwtToken(), id: user.id, }, }); const body = await res.json(); expect(res.status).toEqual(200); expect(body).toMatchSnapshot(); }); it('should require admin', async () => { const user = await buildUser(); const res = await server.post('/api/users.activate', { body: { token: user.getJwtToken(), id: user.id }, }); const body = await res.json(); expect(res.status).toEqual(403); expect(body).toMatchSnapshot(); }); });