86 lines
3.5 KiB
TypeScript
86 lines
3.5 KiB
TypeScript
import { expect, test } from "@playwright/test";
|
|
import { API_URL, adminLogin, loginViaUi, registerVerifyLogin, uniqueEmail } from "../helpers/api";
|
|
|
|
test.describe("§15.7 scenarios 5 & 9: Admin users", () => {
|
|
test("blocked user access token rejected immediately after block", async ({ request }) => {
|
|
const email = uniqueEmail("e2e-block-jwt");
|
|
const session = await registerVerifyLogin(request, email);
|
|
const admin = await adminLogin(request);
|
|
const adminToken = (await admin.json()).access_token;
|
|
|
|
const patch = await request.patch(`${API_URL}/api/v1/admin/users/${session.user.id}`, {
|
|
headers: { Authorization: `Bearer ${adminToken}` },
|
|
data: { status: "blocked" }
|
|
});
|
|
expect(patch.ok()).toBeTruthy();
|
|
|
|
const me = await request.get(`${API_URL}/api/v1/users/me`, {
|
|
headers: { Authorization: `Bearer ${session.accessToken}` }
|
|
});
|
|
expect(me.status()).toBe(401);
|
|
expect((await me.json()).detail).toBe("TOKEN_REVOKED");
|
|
});
|
|
|
|
test("admin blocks user → blocked user cannot login", async ({ page, request }) => {
|
|
const email = uniqueEmail("e2e-block");
|
|
const session = await registerVerifyLogin(request, email);
|
|
const admin = await adminLogin(request);
|
|
const adminToken = (await admin.json()).access_token;
|
|
|
|
const patch = await request.patch(`${API_URL}/api/v1/admin/users/${session.user.id}`, {
|
|
headers: { Authorization: `Bearer ${adminToken}` },
|
|
data: { status: "blocked" }
|
|
});
|
|
expect(patch.ok()).toBeTruthy();
|
|
|
|
await loginViaUi(page, email, "Valid1234");
|
|
await expect(page).toHaveURL(/\/login$/);
|
|
});
|
|
|
|
test("admin can open platform users page", async ({ page }) => {
|
|
await loginViaUi(page, "admin@compton.example", "Admin1234");
|
|
await expect(page).toHaveURL(/\/recipes$/);
|
|
await page.goto("/platform");
|
|
await expect(page.getByRole("heading", { name: "Users" })).toBeVisible();
|
|
});
|
|
|
|
test("admin session survives reload on /platform", async ({ page }) => {
|
|
await loginViaUi(page, "admin@compton.example", "Admin1234");
|
|
await page.goto("/platform");
|
|
await expect(page.getByRole("heading", { name: "Users" })).toBeVisible();
|
|
await page.goto("/platform");
|
|
await expect(page.getByRole("heading", { name: "Users" })).toBeVisible();
|
|
});
|
|
|
|
test("non-admin cannot open platform page", async ({ page, request }) => {
|
|
const email = uniqueEmail("e2e-nonadmin");
|
|
await registerVerifyLogin(request, email);
|
|
await loginViaUi(page, email, "Valid1234");
|
|
await expect(page).toHaveURL(/\/profile$/);
|
|
await page.goto("/platform");
|
|
await expect(page).toHaveURL(/\/$/);
|
|
});
|
|
|
|
test("admin cannot block self", async ({ request }) => {
|
|
const admin = await adminLogin(request);
|
|
const body = await admin.json();
|
|
const response = await request.patch(`${API_URL}/api/v1/admin/users/${body.user.id}`, {
|
|
headers: { Authorization: `Bearer ${body.access_token}` },
|
|
data: { status: "blocked" }
|
|
});
|
|
expect(response.status()).toBe(400);
|
|
expect((await response.json()).detail).toBe("SELF_BLOCK_FORBIDDEN");
|
|
});
|
|
|
|
test("admin cannot demote self", async ({ request }) => {
|
|
const admin = await adminLogin(request);
|
|
const body = await admin.json();
|
|
const response = await request.patch(`${API_URL}/api/v1/admin/users/${body.user.id}`, {
|
|
headers: { Authorization: `Bearer ${body.access_token}` },
|
|
data: { role: "user" }
|
|
});
|
|
expect(response.status()).toBe(400);
|
|
expect((await response.json()).detail).toBe("SELF_DEMOTION_FORBIDDEN");
|
|
});
|
|
});
|