16 lines
659 B
TypeScript
16 lines
659 B
TypeScript
import { expect, test } from "@playwright/test";
|
|
import { API_URL, registerVerifyLogin, uniqueEmail } from "../helpers/api";
|
|
|
|
test.describe("§15.7 scenario 8: IDOR", () => {
|
|
test("user A cannot patch user B via admin route", async ({ request }) => {
|
|
const userA = await registerVerifyLogin(request, uniqueEmail("e2e-a"));
|
|
const userB = await registerVerifyLogin(request, uniqueEmail("e2e-b"));
|
|
|
|
const forbidden = await request.patch(`${API_URL}/api/v1/admin/users/${userB.user.id}`, {
|
|
headers: { Authorization: `Bearer ${userA.accessToken}` },
|
|
data: { status: "blocked" }
|
|
});
|
|
expect(forbidden.status()).toBe(403);
|
|
});
|
|
});
|