site/apps/web/e2e/admin/admin-users.spec.ts

import { expect, test } from "@playwright/test";
import { API_URL, adminLogin, loginViaUi, registerVerifyLogin, uniqueEmail } from "../helpers/api";

test.describe("§15.7 scenarios 5 & 9: Admin users", () => {
  test("blocked user access token rejected immediately after block", async ({ request }) => {
    const email = uniqueEmail("e2e-block-jwt");
    const session = await registerVerifyLogin(request, email);
    const admin = await adminLogin(request);
    const adminToken = (await admin.json()).access_token;

    const patch = await request.patch(`${API_URL}/api/v1/admin/users/${session.user.id}`, {
      headers: { Authorization: `Bearer ${adminToken}` },
      data: { status: "blocked" }
    });
    expect(patch.ok()).toBeTruthy();

    const me = await request.get(`${API_URL}/api/v1/users/me`, {
      headers: { Authorization: `Bearer ${session.accessToken}` }
    });
    expect(me.status()).toBe(401);
    expect((await me.json()).detail).toBe("TOKEN_REVOKED");
  });

  test("admin blocks user → blocked user cannot login", async ({ page, request }) => {
    const email = uniqueEmail("e2e-block");
    const session = await registerVerifyLogin(request, email);
    const admin = await adminLogin(request);
    const adminToken = (await admin.json()).access_token;

    const patch = await request.patch(`${API_URL}/api/v1/admin/users/${session.user.id}`, {
      headers: { Authorization: `Bearer ${adminToken}` },
      data: { status: "blocked" }
    });
    expect(patch.ok()).toBeTruthy();

    await loginViaUi(page, email, "Valid1234");
    await expect(page).toHaveURL(/\/login$/);
  });

  test("admin can open admin users page", async ({ page }) => {
    await loginViaUi(page, "admin@compton.example", "Admin1234");
    await expect(page).toHaveURL(/\/admin$/);
    await expect(page.getByRole("heading", { name: "Users" })).toBeVisible();
  });

  test("admin session survives reload on /admin", async ({ page }) => {
    await loginViaUi(page, "admin@compton.example", "Admin1234");
    await expect(page).toHaveURL(/\/admin$/);
    await page.goto("/admin");
    await expect(page.getByRole("heading", { name: "Users" })).toBeVisible();
  });

  test("non-admin cannot open admin page", async ({ page, request }) => {
    const email = uniqueEmail("e2e-nonadmin");
    await registerVerifyLogin(request, email);
    await loginViaUi(page, email, "Valid1234");
    await expect(page).toHaveURL(/\/profile$/);
    await page.goto("/admin");
    await expect(page).toHaveURL(/\/$/);
  });

  test("admin cannot block self", async ({ request }) => {
    const admin = await adminLogin(request);
    const body = await admin.json();
    const response = await request.patch(`${API_URL}/api/v1/admin/users/${body.user.id}`, {
      headers: { Authorization: `Bearer ${body.access_token}` },
      data: { status: "blocked" }
    });
    expect(response.status()).toBe(400);
    expect((await response.json()).detail).toBe("SELF_BLOCK_FORBIDDEN");
  });

  test("admin cannot demote self", async ({ request }) => {
    const admin = await adminLogin(request);
    const body = await admin.json();
    const response = await request.patch(`${API_URL}/api/v1/admin/users/${body.user.id}`, {
      headers: { Authorization: `Bearer ${body.access_token}` },
      data: { role: "user" }
    });
    expect(response.status()).toBe(400);
    expect((await response.json()).detail).toBe("SELF_DEMOTION_FORBIDDEN");
  });
});