poetrySlamManagerAPIAuthorizations.test.js

// ----------------------------------------------------------------------------
// Initialization of test
// CAP Unit Testing: https://cap.cloud.sap/docs/node.js/cds-test?q=cds.test#run
// ----------------------------------------------------------------------------
'strict';

// Adds cds module
const cds = require('@sap/cds');
// Defines required CDS functions for testing
const { expect, GET, POST, axios, test } = cds.test(__dirname + '/../../..');

const { httpCodes } = require('../../../srv/lib/codes');

// ----------------------------------------------------------------------------
// Tests authorizations for authorized user without role assignment for application
// Authorizations of PoetrySlamManagerAPI with User Peter are tested in poetrySlamManagerAPI.test.js
// ----------------------------------------------------------------------------

describe('Authorizations of PoetrySlamManagerAPI with User Denise (authenticated user only)', () => {
  beforeEach(async () => {
    // Authorized user from .cdsrc.json with PoetrySlamManager role
    axios.defaults.auth = { username: 'peter', password: 'welcome' };

    await test.data.reset();
    await POST(`/odata/v4/poetryslamservice/createTestData`);

    // Authentication for tests
    axios.defaults.auth = { username: 'denise', password: 'welcome' };
  });

  it('should reject the reading of the poetry slams', async () => {
    // Read all poetry slams; shall be rejected
    await expect(
      GET(`/odata/v4/poetryslammanagerapi/PoetrySlams`, {
        params: { $select: `ID,status_code` }
      })
    ).to.rejectedWith(httpCodes.forbidden.toString());
  });

  it('should reject the creation of a poetry slam', async () => {
    const poetrySlamToBeCreated = {
      title: 'Poetry Slam 12',
      description: 'Description Poetry Slam 12',
      dateTime: new Date(),
      visitorsFeeAmount: 9.95,
      visitorsFeeCurrency_code: 'EUR'
    };

    // Create a new poetry slam; shall be rejected
    await expect(
      POST(`/odata/v4/poetryslammanagerapi/PoetrySlams`, poetrySlamToBeCreated)
    ).to.rejectedWith(httpCodes.forbidden.toString());
  });

  it('should reject the reading of visitors', async () => {
    // Read all poetry slams; shall be rejected
    await expect(
      GET(`/odata/v4/poetryslammanagerapi/Visitors`, {
        params: { $select: `ID,name` }
      })
    ).to.rejectedWith(httpCodes.forbidden.toString());
  });

  it('should reject the creation of a visitor', async () => {
    const entryToBeCreated = {
      name: 'Max Mustermann',
      email: 'max@mustermann.de'
    };

    // Create a new poetry slam; shall be rejected
    await expect(
      POST(`/odata/v4/poetryslammanagerapi/Visitors`, entryToBeCreated)
    ).to.rejectedWith(httpCodes.forbidden.toString());
  });

  it('should reject the reading of visits', async () => {
    // Read all poetry slams; shall be rejected
    await expect(
      GET(`/odata/v4/poetryslammanagerapi/Visits`, {
        params: { $select: `ID,artists` }
      })
    ).to.rejectedWith(httpCodes.forbidden.toString());
  });

  it('should reject the creation of a visits', async () => {
    const entryToBeCreated = {
      parent_ID: '79ceab87-300d-4b66-8cc3-f82c679b77a8',
      visitor_ID: '79ceab87-300d-4b66-8cc3-c82c679b7c12'
    };

    // Create a new poetry slam; shall be rejected as read-only
    await expect(
      POST(`/odata/v4/poetryslammanagerapi/Visits`, entryToBeCreated)
    ).to.rejectedWith(httpCodes.forbidden.toString());
  });
});

// ----------------------------------------------------------------------------
// Tests authorizations for authorized user with role assignment PoetrySlamVisitor
// ----------------------------------------------------------------------------

describe('Authorizations of PoetrySlamManagerAPI with User Julie (role PoetrySlamVisitor)', () => {
  beforeEach(async () => {
    // Authorized user from .cdsrc.json with PoetrySlamManager role
    axios.defaults.auth = { username: 'peter', password: 'welcome' };

    await test.data.reset();
    await POST(`/odata/v4/poetryslamservice/createTestData`);

    // Authentication for tests
    axios.defaults.auth = { username: 'julie', password: 'welcome' };
  });

  it('should reject to read data of poetry slams in status booked and published', async () => {
    await expect(
      GET(`/odata/v4/poetryslammanagerapi/PoetrySlams`, {
        params: { $select: `ID,status_code` }
      })
    ).to.rejectedWith(httpCodes.forbidden.toString());
  });

  it('should reject the creation of a poetry slam', async () => {
    const poetrySlamToBeCreated = {
      number: '12',
      title: 'Poetry Slam 12',
      description: 'Description Poetry Slam 12',
      dateTime: new Date(),
      visitorsFeeAmount: 9.95,
      visitorsFeeCurrency_code: 'EUR'
    };

    // Create a new poetry slam; shall be rejected
    await expect(
      POST(`/odata/v4/poetryslammanagerapi/PoetrySlams`, poetrySlamToBeCreated)
    ).to.rejectedWith(httpCodes.forbidden.toString());
  });

  it('should reject the reading of visitors', async () => {
    await expect(
      GET(`/odata/v4/poetryslammanagerapi/Visitors`, {
        params: { $select: `ID,name` }
      })
    ).to.rejectedWith(httpCodes.forbidden.toString());
  });

  it('should reject the creation of a visitor', async () => {
    const entryToBeCreated = {
      name: 'Julie',
      email: 'julie@pra.ondemand.com'
    };

    await expect(
      POST(`/odata/v4/poetryslammanagerapi/Visitors`, entryToBeCreated)
    ).to.rejectedWith(httpCodes.forbidden.toString());
  });

  it('should reject reading of visits', async () => {
    await expect(
      GET(`/odata/v4/poetryslammanagerapi/Visits`, {
        params: { $select: `ID,artistIndicator` }
      })
    ).to.rejectedWith(httpCodes.forbidden.toString());
  });

  it('should reject the creation of a visit', async () => {
    const entryToBeCreated = {
      parent_ID: '79ceab87-300d-4b66-8cc3-f82c679b77a8',
      visitor_ID: '79ceab87-300d-4b66-8cc3-c82c679b7c12'
    };

    await expect(
      POST(`/odata/v4/poetryslammanagerapi/Visits`, entryToBeCreated)
    ).to.rejectedWith(httpCodes.forbidden.toString());
  });
});