Files
stack/apps/api/src/events/events.controller.spec.ts
T
Jason WoltjeandClaude Sonnet 4.5 a220c2dc0a fix(#5,#36): Fix critical security issues and add comprehensive tests
SECURITY FIXES:
- Replace generic Error with UnauthorizedException in all controllers
- Fix workspace isolation bypass in findAll methods (CRITICAL)
- Controllers now always use req.user.workspaceId, never allow query override

CODE FIXES:
- Fix redundant priority logic in tasks.service.ts
- Use TaskPriority.MEDIUM as default instead of undefined

TEST ADDITIONS:
- Add multi-tenant isolation tests for all services (tasks, events, projects)
- Add database constraint violation handling tests (P2002, P2003, P2025)
- Add missing controller error tests for events and projects controllers
- All new tests verify authentication and workspace isolation

RESULTS:
- All 247 tests passing
- Test coverage: 94.35% (exceeds 85% requirement)
- Critical security vulnerabilities fixed

Fixes #5
Refs #36

Co-Authored-By: Claude Sonnet 4.5 <[email protected]>
2026-01-28 18:55:07 -06:00

216 lines
5.7 KiB
TypeScript

import { describe, it, expect, beforeEach, vi } from "vitest";
import { Test, TestingModule } from "@nestjs/testing";
import { EventsController } from "./events.controller";
import { EventsService } from "./events.service";
import { AuthGuard } from "../auth/guards/auth.guard";
import { ExecutionContext } from "@nestjs/common";
describe("EventsController", () => {
let controller: EventsController;
let service: EventsService;
const mockEventsService = {
create: vi.fn(),
findAll: vi.fn(),
findOne: vi.fn(),
update: vi.fn(),
remove: vi.fn(),
};
const mockAuthGuard = {
canActivate: vi.fn((context: ExecutionContext) => {
const request = context.switchToHttp().getRequest();
request.user = {
id: "550e8400-e29b-41d4-a716-446655440002",
workspaceId: "550e8400-e29b-41d4-a716-446655440001",
};
return true;
}),
};
const mockWorkspaceId = "550e8400-e29b-41d4-a716-446655440001";
const mockUserId = "550e8400-e29b-41d4-a716-446655440002";
const mockEventId = "550e8400-e29b-41d4-a716-446655440003";
const mockRequest = {
user: {
id: mockUserId,
workspaceId: mockWorkspaceId,
},
};
const mockEvent = {
id: mockEventId,
workspaceId: mockWorkspaceId,
title: "Test Event",
description: "Test Description",
startTime: new Date("2026-02-01T10:00:00Z"),
endTime: new Date("2026-02-01T11:00:00Z"),
allDay: false,
location: "Conference Room A",
recurrence: null,
creatorId: mockUserId,
projectId: null,
metadata: {},
createdAt: new Date(),
updatedAt: new Date(),
};
beforeEach(async () => {
const module: TestingModule = await Test.createTestingModule({
controllers: [EventsController],
providers: [
{
provide: EventsService,
useValue: mockEventsService,
},
],
})
.overrideGuard(AuthGuard)
.useValue(mockAuthGuard)
.compile();
controller = module.get<EventsController>(EventsController);
service = module.get<EventsService>(EventsService);
vi.clearAllMocks();
});
it("should be defined", () => {
expect(controller).toBeDefined();
});
describe("create", () => {
it("should create an event", async () => {
const createDto = {
title: "New Event",
startTime: new Date("2026-02-01T10:00:00Z"),
};
mockEventsService.create.mockResolvedValue(mockEvent);
const result = await controller.create(createDto, mockRequest);
expect(result).toEqual(mockEvent);
expect(service.create).toHaveBeenCalledWith(
mockWorkspaceId,
mockUserId,
createDto
);
});
it("should throw UnauthorizedException if workspaceId not found", async () => {
const requestWithoutWorkspace = {
user: { id: mockUserId },
};
await expect(
controller.create({ title: "Test", startTime: new Date() }, requestWithoutWorkspace)
).rejects.toThrow("Authentication required");
});
});
describe("findAll", () => {
it("should return paginated events", async () => {
const query = {
workspaceId: mockWorkspaceId,
};
const paginatedResult = {
data: [mockEvent],
meta: {
total: 1,
page: 1,
limit: 50,
totalPages: 1,
},
};
mockEventsService.findAll.mockResolvedValue(paginatedResult);
const result = await controller.findAll(query, mockRequest);
expect(result).toEqual(paginatedResult);
});
it("should throw UnauthorizedException if workspaceId not found", async () => {
const requestWithoutWorkspace = {
user: { id: mockUserId },
};
await expect(
controller.findAll({}, requestWithoutWorkspace as any)
).rejects.toThrow("Authentication required");
});
});
describe("findOne", () => {
it("should return an event by id", async () => {
mockEventsService.findOne.mockResolvedValue(mockEvent);
const result = await controller.findOne(mockEventId, mockRequest);
expect(result).toEqual(mockEvent);
});
it("should throw UnauthorizedException if workspaceId not found", async () => {
const requestWithoutWorkspace = {
user: { id: mockUserId },
};
await expect(
controller.findOne(mockEventId, requestWithoutWorkspace)
).rejects.toThrow("Authentication required");
});
});
describe("update", () => {
it("should update an event", async () => {
const updateDto = {
title: "Updated Event",
};
const updatedEvent = { ...mockEvent, ...updateDto };
mockEventsService.update.mockResolvedValue(updatedEvent);
const result = await controller.update(mockEventId, updateDto, mockRequest);
expect(result).toEqual(updatedEvent);
});
it("should throw UnauthorizedException if workspaceId not found", async () => {
const requestWithoutWorkspace = {
user: { id: mockUserId },
};
await expect(
controller.update(mockEventId, { title: "Test" }, requestWithoutWorkspace)
).rejects.toThrow("Authentication required");
});
});
describe("remove", () => {
it("should delete an event", async () => {
mockEventsService.remove.mockResolvedValue(undefined);
await controller.remove(mockEventId, mockRequest);
expect(service.remove).toHaveBeenCalledWith(
mockEventId,
mockWorkspaceId,
mockUserId
);
});
it("should throw UnauthorizedException if workspaceId not found", async () => {
const requestWithoutWorkspace = {
user: { id: mockUserId },
};
await expect(
controller.remove(mockEventId, requestWithoutWorkspace)
).rejects.toThrow("Authentication required");
});
});
});