@vida-global/core 2.5.0 → 3.0.1

package/test/server/serverController.test.js

@@ -1,6 +1,8 @@
+const { Authorizer }           = require('../../lib/server/authorizer');
 const { FooController }        = require('./helpers/controllers/fooController');
 const   Errors                 = require('../../lib/server/errors');
 const { randomPayload }        = require('./helpers/serverController');
+const { TestAuthorizer }       = require('./helpers/authorizer');
 const { buildResponseMock }    = require('./helpers/response');
 const   TestHelpers            = require('@vida-global/test-helpers');
 const {
@@ -775,6 +777,81 @@ describe('VidaServerController', () => {
     });
 
 
+    describe('Authorization', () => {
+        let adminUser;
+        let controller;
+        let currentUser;
+
+        class AuthorizedController extends VidaServerController {
+            get currentUser()     { return currentUser; }
+            get adminUser()       { return adminUser; }
+            get authorizerClass() { return TestAuthorizer; }
+        }
+
+        beforeEach(() => {
+            adminUser   = {id: TestHelpers.Faker.Text.randomString()};
+            currentUser = {id: TestHelpers.Faker.Text.randomString()};
+            controller  = new AuthorizedController({}, {});
+        });
+
+        describe('#authorizerClass', () => {
+            it ('returns Authorizer when a subclass does not override it', () => {
+                expect(new FooController({}, {}).authorizerClass).toBe(Authorizer);
+            });
+        });
+
+
+        describe('#authorizerParameters', () => {
+            it ('returns the current user and the admin user', () => {
+                expect(controller.authorizerParameters).toEqual([currentUser, adminUser]);
+            });
+        });
+
+
+        describe('#authorizer', () => {
+            it ('builds an instance of authorizerClass from authorizerParameters', () => {
+                expect(controller.authorizer).toBeInstanceOf(TestAuthorizer);
+                expect(controller.authorizer.currentUser).toBe(currentUser);
+                expect(controller.authorizer.adminUser).toBe(adminUser);
+            });
+
+            it ('returns the same instance on every read', () => {
+                expect(controller.authorizer).toBe(controller.authorizer);
+            });
+        });
+
+
+        describe('#can', () => {
+            it ('returns the decision made by the authorizer', async () => {
+                const action = TestHelpers.Faker.Text.randomString();
+                const scope  = {};
+                const canSpy = jest.spyOn(controller.authorizer, 'can').mockResolvedValue(true);
+
+                await expect(controller.can(action, scope)).resolves.toBe(true);
+
+                expect(canSpy).toHaveBeenCalledTimes(1);
+                expect(canSpy).toHaveBeenCalledWith(action, scope);
+            });
+        });
+
+
+        describe('#authorize', () => {
+            it ('resolves when the action is allowed', async () => {
+                jest.spyOn(controller, 'can').mockResolvedValue(true);
+
+                await expect(controller.authorize('read', {})).resolves.toBeUndefined();
+            });
+
+            it ('throws a Forbidden error when the action is denied', async () => {
+                jest.spyOn(controller, 'can').mockResolvedValue(false);
+
+                await expect(controller.authorize('read', {}))
+                    .rejects.toBeInstanceOf(Errors.ForbiddenError);
+            });
+        });
+    });
+
+
     describe('#statusText', () => {
         const cases = [
             [200, 'ok'],