vlad
86cc3fa541
Align the project baseline with the latest admin interface styling and layout structure while documenting setup and usage updates in README.
65 lines
2.6 KiB
TypeScript
65 lines
2.6 KiB
TypeScript
import { expect, test } from "@playwright/test";
|
|
import { API_URL, adminLogin, loginViaUi, registerVerifyLogin, uniqueEmail } from "../helpers/api";
|
|
|
|
test.describe("§15.7 scenarios 5 & 9: Admin users", () => {
|
|
test("admin blocks user → blocked user cannot login", async ({ page, request }) => {
|
|
const email = uniqueEmail("e2e-block");
|
|
const session = await registerVerifyLogin(request, email);
|
|
const admin = await adminLogin(request);
|
|
const adminToken = (await admin.json()).access_token;
|
|
|
|
const patch = await request.patch(`${API_URL}/api/v1/admin/users/${session.user.id}`, {
|
|
headers: { Authorization: `Bearer ${adminToken}` },
|
|
data: { status: "blocked" }
|
|
});
|
|
expect(patch.ok()).toBeTruthy();
|
|
|
|
await loginViaUi(page, email, "Valid1234");
|
|
await expect(page).toHaveURL(/\/login$/);
|
|
});
|
|
|
|
test("admin can open admin users page", async ({ page }) => {
|
|
await loginViaUi(page, "admin@compton.example", "Admin1234");
|
|
await expect(page).toHaveURL(/\/admin$/);
|
|
await expect(page.getByRole("heading", { name: "Users" })).toBeVisible();
|
|
});
|
|
|
|
test("admin session survives reload on /admin", async ({ page }) => {
|
|
await loginViaUi(page, "admin@compton.example", "Admin1234");
|
|
await expect(page).toHaveURL(/\/admin$/);
|
|
await page.goto("/admin");
|
|
await expect(page.getByRole("heading", { name: "Users" })).toBeVisible();
|
|
});
|
|
|
|
test("non-admin cannot open admin page", async ({ page, request }) => {
|
|
const email = uniqueEmail("e2e-nonadmin");
|
|
await registerVerifyLogin(request, email);
|
|
await loginViaUi(page, email, "Valid1234");
|
|
await expect(page).toHaveURL(/\/profile$/);
|
|
await page.goto("/admin");
|
|
await expect(page).toHaveURL(/\/$/);
|
|
});
|
|
|
|
test("admin cannot block self", async ({ request }) => {
|
|
const admin = await adminLogin(request);
|
|
const body = await admin.json();
|
|
const response = await request.patch(`${API_URL}/api/v1/admin/users/${body.user.id}`, {
|
|
headers: { Authorization: `Bearer ${body.access_token}` },
|
|
data: { status: "blocked" }
|
|
});
|
|
expect(response.status()).toBe(400);
|
|
expect((await response.json()).detail).toBe("SELF_BLOCK_FORBIDDEN");
|
|
});
|
|
|
|
test("admin cannot demote self", async ({ request }) => {
|
|
const admin = await adminLogin(request);
|
|
const body = await admin.json();
|
|
const response = await request.patch(`${API_URL}/api/v1/admin/users/${body.user.id}`, {
|
|
headers: { Authorization: `Bearer ${body.access_token}` },
|
|
data: { role: "user" }
|
|
});
|
|
expect(response.status()).toBe(400);
|
|
expect((await response.json()).detail).toBe("SELF_DEMOTION_FORBIDDEN");
|
|
});
|
|
});
|