definma-api/src/routes/user.spec.ts

import should from 'should/as-function';
import UserModel from '../models/user';
import TestHelper from "../test/helper";


describe('/user', () => {
  let server;
  before(done => TestHelper.before(done));
  beforeEach(done => server = TestHelper.beforeEach(server, done));
  afterEach(done => TestHelper.afterEach(server, done));

  describe('GET /users', () => {
    it('returns all users', done => {
      TestHelper.request(server, done, {
        method: 'get',
        url: '/users',
        auth: {basic: 'admin'},
        httpStatus: 200
      }).end((err, res) => {
        if (err) return done(err);
        const json = require('../test/db.json');
        should(res.body).have.lengthOf(json.collections.users.length);
        should(res.body).matchEach(user => {
          should(user).have.only.keys('_id', 'email', 'name', 'level', 'location', 'device_name');
          should(user).have.property('_id').be.type('string');
          should(user).have.property('email').be.type('string');
          should(user).have.property('name').be.type('string');
          should(user).have.property('level').be.type('string');
          should(user).have.property('location').be.type('string');
          should(user).have.property('device_name').be.type('string');
        });
        done();
      });
    });
    it('rejects requests from non-admins', done => {
      TestHelper.request(server, done, {
        method: 'get',
        url: '/users',
        auth: {basic: 'janedoe'},
        httpStatus: 403
      });
    });
    it('rejects requests from an admin API key', done => {
      TestHelper.request(server, done, {
        method: 'get',
        url: '/users',
        auth: {key: 'admin'},
        httpStatus: 401
      });
    });
    it('rejects unauthorized requests', done => {
      TestHelper.request(server, done, {
        method: 'get',
        url: '/users',
        httpStatus: 401
      });
    });
  });

  describe('GET /user/{name}', () => {
    it('returns own user details', done => {
      TestHelper.request(server, done, {
        method: 'get',
        url: '/user',
        auth: {basic: 'janedoe'},
        httpStatus: 200
      }).end((err, res) => {
        if (err) return done (err);
        should(res.body).have.only.keys('_id', 'email', 'name', 'level', 'location', 'device_name');
        should(res.body).have.property('_id').be.type('string');
        should(res.body).have.property('email', 'jane.doe@bosch.com');
        should(res.body).have.property('name', 'janedoe');
        should(res.body).have.property('level', 'write');
        should(res.body).have.property('location', 'Rng');
        should(res.body).have.property('device_name', 'Alpha I');
        done();
      });
    });
    it('returns other user details for admin', done => {
      TestHelper.request(server, done, {
        method: 'get',
        url: '/user/janedoe',
        auth: {basic: 'admin'},
        httpStatus: 200
      }).end((err, res) => {
          if (err) return done (err);
          should(res.body).have.only.keys('_id', 'email', 'name', 'level', 'location', 'device_name');
          should(res.body).have.property('_id').be.type('string');
          should(res.body).have.property('email', 'jane.doe@bosch.com');
          should(res.body).have.property('name', 'janedoe');
          should(res.body).have.property('level', 'write');
          should(res.body).have.property('location', 'Rng');
          should(res.body).have.property('device_name', 'Alpha I');
          done();
        });
    });
    it('rejects requests from non-admins for another user', done => {
      TestHelper.request(server, done, {
        method: 'get',
        url: '/user/admin',
        auth: {basic: 'janedoe'},
        httpStatus: 403
      });
    });
    it('rejects requests from a user API key', done => {
      TestHelper.request(server, done, {
        method: 'get',
        url: '/user',
        auth: {key: 'janedoe'},
        httpStatus: 401
      });
    });
    it('rejects requests from an admin API key', done => {
      TestHelper.request(server, done, {
        method: 'get',
        url: '/user/janedoe',
        auth: {key: 'janedoe'},
        httpStatus: 401
      });
    });
    it('returns 404 for an unknown user', done => {
      TestHelper.request(server, done, {
        method: 'get',
        url: '/user/unknown',
        auth: {basic: 'admin'},
        httpStatus: 404
      });
    });
    it('rejects requests from an admin API key', done => {
      TestHelper.request(server, done, {
        method: 'get',
        url: '/user/janedoe',
        httpStatus: 401
      });
    });
  });

  describe('PUT /user/{name}', () => {
    it('returns own user details', done => {
      TestHelper.request(server, done, {
        method: 'put',
        url: '/user',
        auth: {basic: 'janedoe'},
        httpStatus: 200,
        req: {}
      }).end((err, res) => {
          if (err) return done (err);
          should(res.body).have.only.keys('_id', 'email', 'name', 'level', 'location', 'device_name');
          should(res.body).have.property('_id').be.type('string');
          should(res.body).have.property('email', 'jane.doe@bosch.com');
          should(res.body).have.property('name', 'janedoe');
          should(res.body).have.property('level', 'write');
          should(res.body).have.property('location', 'Rng');
          should(res.body).have.property('device_name', 'Alpha I');
          done();
        });
    });
    it('returns other user details for admin', done => {
      TestHelper.request(server, done, {
        method: 'put',
        url: '/user/janedoe',
        auth: {basic: 'admin'},
        httpStatus: 200,
        req: {}
      }).end((err, res) => {
          if (err) return done (err);
          should(res.body).have.only.keys('_id', 'email', 'name', 'level', 'location', 'device_name');
          should(res.body).have.property('_id').be.type('string');
          should(res.body).have.property('email', 'jane.doe@bosch.com');
          should(res.body).have.property('name', 'janedoe');
          should(res.body).have.property('level', 'write');
          should(res.body).have.property('location', 'Rng');
          should(res.body).have.property('device_name', 'Alpha I');
          done();
        });
    });
    it('changes user details as given', done => {
      TestHelper.request(server, done, {
        method: 'put',
        url: '/user',
        auth: {basic: 'admin'},
        httpStatus: 200,
        req: {name: 'adminnew', email: 'adminnew@bosch.com', pass: 'Abc123##', location: 'Abt', device_name: 'test'}
      }).end(err => {
          if (err) return done (err);
          UserModel.find({name: 'adminnew'}).lean().exec( (err, data) => {
            if (err) return done(err);
            should(data).have.lengthOf(1);
            should(data[0]).have.only.keys('_id', 'name', 'pass', 'email', 'level', 'location', 'device_name', 'key', '__v');
            should(data[0]).have.property('_id');
            should(data[0]).have.property('name', 'adminnew');
            should(data[0]).have.property('email', 'adminnew@bosch.com');
            should(data[0]).have.property('pass').not.eql('Abc123##');
            should(data[0]).have.property('level', 'admin');
            should(data[0]).have.property('location', 'Abt');
            should(data[0]).have.property('device_name', 'test');
            done();
          });
        });
    });
    it('lets the admin change a user level', done => {
      TestHelper.request(server, done, {
        method: 'put',
        url: '/user/janedoe',
        auth: {basic: 'admin'},
        httpStatus: 200,
        req: {level: 'read'}
      }).end(err => {
          if (err) return done (err);
          UserModel.find({name: 'janedoe'}).lean().exec( (err, data) => {
            if (err) return done(err);
            should(data).have.lengthOf(1);
            should(data[0]).have.property('level', 'read');
            done();
          });
        });
    });
    it('does not change the level', done => {
      TestHelper.request(server, done, {
        method: 'put',
        url: '/user',
        auth: {basic: 'janedoe'},
        httpStatus: 400, default: false,
        req: {level: 'read'}
      }).end((err, res) => {
          if (err) return done (err);
          should(res.body).be.eql({status: 'Invalid body format', details: '"level" is not allowed'});
          UserModel.find({name: 'janedoe'}).lean().exec( (err, data) => {
            if (err) return done(err);
            should(data).have.lengthOf(1);
            should(data[0]).have.property('level', 'write');
            done();
          });
        });
    });
    it('rejects a username already in use', done => {
      TestHelper.request(server, done, {
        method: 'put',
        url: '/user',
        auth: {basic: 'admin'},
        httpStatus: 400, default: false,
        req: {name: 'janedoe'}
      }).end((err, res) => {
          if (err) return done (err);
          should(res.body).be.eql({status: 'Username already taken'});
          UserModel.find({name: 'janedoe'}).lean().exec( (err, data) => {
            if (err) return done(err);
            should(data).have.lengthOf(1);
            done();
          });
        });
    });
    it('rejects a username which is in the special names', done => {
      TestHelper.request(server, done, {
        method: 'post',
        url: '/user/new',
        auth: {basic: 'admin'},
        httpStatus: 400, default: false,
        req: {email: 'j.doe@bosch.com', name: 'passreset', pass: 'Abc123!#', level: 'read', location: 'Rng', device_name: 'Alpha II'},
        res: {status: 'Username already taken'}
      });
    });
    it('rejects invalid user details', done => {
      TestHelper.request(server, done, {
        method: 'put',
        url: '/user',
        auth: {basic: 'admin'},
        httpStatus: 400,
        req: {email: 'john.doe@bosch.com', name: 'johndoe', pass: 'Abc123!#', location: 44, device_name: 'Alpha II'},
        res: {status: 'Invalid body format', details: '"location" must be a string'}
      });
    });
    it('rejects an invalid email address', done => {
      TestHelper.request(server, done, {
        method: 'put',
        url: '/user',
        auth: {basic: 'admin'},
        httpStatus: 400,
        req: {email: 'john.doe'},
        res: {status: 'Invalid body format', details: '"email" must be a valid email'}
      });
    });
    it('rejects an invalid password', done => {
      TestHelper.request(server, done, {
        method: 'put',
        url: '/user',
        auth: {basic: 'admin'},
        httpStatus: 400,
        req: {pass: 'password'},
        res: {status: 'Invalid body format', details: '"pass" with value "password" fails to match the required pattern: /^(?=.*[0-9])(?=.*[a-z])(?=.*[A-Z])(?=.*[!"#%&\'()*+,-.\\/:;<=>?@[\\]^_`{|}~])(?=\\S+$).{8,}$/'}
      });
    });
    it('rejects requests from non-admins for another user', done => {
      TestHelper.request(server, done, {
        method: 'put',
        url: '/user/admin',
        auth: {basic: 'janedoe'},
        httpStatus: 403,
        req: {}
      });
    });
    it('rejects requests from a user API key', done => {
      TestHelper.request(server, done, {
        method: 'put',
        url: '/user',
        auth: {key: 'janedoe'},
        httpStatus: 401,
        req: {}
      });
    });
    it('rejects requests from an admin API key', done => {
      TestHelper.request(server, done, {
        method: 'put',
        url: '/user/janedoe',
        auth: {key: 'admin'},
        httpStatus: 401,
        req: {}
      });
    });
    it('returns 404 for an unknown user', done => {
      TestHelper.request(server, done, {
        method: 'put',
        url: '/user/unknown',
        auth: {basic: 'admin'},
        httpStatus: 404,
        req: {}
      });
    });
    it('rejects unauthorized requests', done => {
      TestHelper.request(server, done, {
        method: 'put',
        url: '/user/janedoe',
        httpStatus: 401,
        req: {}
      });
    });
  });

  describe('DELETE /user/{name}', () => {
    it('deletes own user details', done => {
      TestHelper.request(server, done, {
        method: 'delete',
        url: '/user',
        auth: {basic: 'janedoe'},
        httpStatus: 200
      }).end((err, res) => {
        if (err) return done (err);
        should(res.body).be.eql({status: 'OK'});
        UserModel.find({name: 'janedoe'}).lean().exec( (err, data) => {
          if (err) return done(err);
          should(data).have.lengthOf(0);
          done();
        });
      });
    });
    it('deletes other user details for admin', done => {
      TestHelper.request(server, done, {
        method: 'delete',
        url: '/user/janedoe',
        auth: {basic: 'admin'},
        httpStatus: 200
      }).end((err, res) => {
        if (err) return done (err);
        should(res.body).be.eql({status: 'OK'});
        UserModel.find({name: 'janedoe'}).lean().exec( (err, data) => {
          if (err) return done(err);
          should(data).have.lengthOf(0);
          done();
        });
      });
    });
    it('rejects requests from non-admins for another user', done => {
      TestHelper.request(server, done, {
        method: 'delete',
        url: '/user/admin',
        auth: {basic: 'janedoe'},
        httpStatus: 403
      });
    });
    it('rejects requests from a user API key', done => {
      TestHelper.request(server, done, {
        method: 'delete',
        url: '/user',
        auth: {key: 'janedoe'},
        httpStatus: 401
      });
    });
    it('rejects requests from an admin API key', done => {
      TestHelper.request(server, done, {
        method: 'delete',
        url: '/user/janedoe',
        auth: {key: 'admin'},
        httpStatus: 401
      });
    });
    it('returns 404 for an unknown user', done => {
      TestHelper.request(server, done, {
        method: 'delete',
        url: '/user/unknown',
        auth: {basic: 'admin'},
        httpStatus: 404
      });
    });
    it('rejects unauthorized requests', done => {
      TestHelper.request(server, done, {
        method: 'delete',
        url: '/user/janedoe',
        httpStatus: 401
      });
    });
  });

  describe('GET /user/key', () => {
    it('returns the right API key', done => {
      TestHelper.request(server, done, {
        method: 'get',
        url: '/user/key',
        auth: {basic: 'janedoe'},
        httpStatus: 200,
        res: {key: TestHelper.auth.janedoe.key}
      });
    });
    it('rejects requests from an API key', done => {
      TestHelper.request(server, done, {
        method: 'get',
        url: '/user/key',
        auth: {key: 'janedoe'},
        httpStatus: 401
      });
    });
    it('rejects requests from an API key', done => {
      TestHelper.request(server, done, {
        method: 'get',
        url: '/user/key',
        httpStatus: 401
      });
    });
  });

  describe('POST /user/new', () => {
    it('returns the added user data', done => {
      TestHelper.request(server, done, {
        method: 'post',
        url: '/user/new',
        auth: {basic: 'admin'},
        httpStatus: 200,
        req: {email: 'john.doe@bosch.com', name: 'johndoe', pass: 'Abc123!#', level: 'read', location: 'Rng', device_name: 'Alpha II'}
      }).end((err, res) => {
          if (err) return done (err);
          should(res.body).have.only.keys('_id', 'email', 'name', 'level', 'location', 'device_name');
          should(res.body).have.property('_id').be.type('string');
          should(res.body).have.property('email', 'john.doe@bosch.com');
          should(res.body).have.property('name', 'johndoe');
          should(res.body).have.property('level', 'read');
          should(res.body).have.property('location', 'Rng');
          should(res.body).have.property('device_name', 'Alpha II');
          done();
        });
    });
    it('stores the data', done => {
      TestHelper.request(server, done, {
        method: 'post',
        url: '/user/new',
        auth: {basic: 'admin'},
        httpStatus: 200,
        req: {email: 'john.doe@bosch.com', name: 'johndoe', pass: 'Abc123!#', level: 'read', location: 'Rng', device_name: 'Alpha II'}
      }).end(err => {
          if (err) return done (err);
          UserModel.find({name: 'johndoe'}).lean().exec( (err, data) => {
            if (err) return done(err);
            should(data).have.lengthOf(1);
            should(data[0]).have.only.keys('_id', 'name', 'pass', 'email', 'level', 'location', 'device_name', 'key', '__v');
            should(data[0]).have.property('_id');
            should(data[0]).have.property('name', 'johndoe');
            should(data[0]).have.property('email', 'john.doe@bosch.com');
            should(data[0]).have.property('pass').not.eql('Abc123!#');
            should(data[0]).have.property('level', 'read');
            should(data[0]).have.property('location', 'Rng');
            should(data[0]).have.property('device_name', 'Alpha II');
            done();
          });
        });
    });
    it('rejects a username already in use', done => {
      TestHelper.request(server, done, {
        method: 'post',
        url: '/user/new',
        auth: {basic: 'admin'},
        httpStatus: 400, default: false,
        req: {email: 'j.doe@bosch.com', name: 'janedoe', pass: 'Abc123!#', level: 'read', location: 'Rng', device_name: 'Alpha II'}
      }).end((err, res) => {
          if (err) return done (err);
          should(res.body).be.eql({status: 'Username already taken'});
          UserModel.find({name: 'janedoe'}).lean().exec( (err, data) => {
            if (err) return done(err);
            should(data).have.lengthOf(1);
            done();
          });
        });
    });
    it('rejects a username which is in the special names', done => {
      TestHelper.request(server, done, {
        method: 'post',
        url: '/user/new',
        auth: {basic: 'admin'},
        httpStatus: 400, default: false,
        req: {email: 'j.doe@bosch.com', name: 'passreset', pass: 'Abc123!#', level: 'read', location: 'Rng', device_name: 'Alpha II'},
        res: {status: 'Username already taken'}
      });
    });
    it('rejects invalid user details', done => {
      TestHelper.request(server, done, {
        method: 'post',
        url: '/user/new',
        auth: {basic: 'admin'},
        httpStatus: 400,
        req: {email: 'john.doe@bosch.com', name: 'johndoe', pass: 'Abc123!#', level: 'read', location: 44, device_name: 'Alpha II'},
        res: {status: 'Invalid body format', details: '"location" must be a string'}
      });
    });
    it('rejects an invalid user level', done => {
      TestHelper.request(server, done, {
        method: 'post',
        url: '/user/new',
        auth: {basic: 'admin'},
        httpStatus: 400,
        req: {email: 'john.doe@bosch.com', name: 'johndoe', pass: 'Abc123!#', level: 'xxx', location: 'Rng', device_name: 'Alpha II'},
        res: {status: 'Invalid body format', details: '"level" must be one of [read, write, maintain, dev, admin]'}
      });
    });
    it('rejects an invalid email address', done => {
      TestHelper.request(server, done, {
        method: 'post',
        url: '/user/new',
        auth: {basic: 'admin'},
        httpStatus: 400,
        req: {email: 'john.doe', name: 'johndoe', pass: 'Abc123!#', level: 'read', location: 'Rng', device_name: 'Alpha II'},
        res: {status: 'Invalid body format',  details: '"email" must be a valid email'}
      });
    });
    it('rejects an invalid password', done => {
      TestHelper.request(server, done, {
        method: 'post',
        url: '/user/new',
        auth: {basic: 'admin'},
        httpStatus: 400,
        req: {email: 'john.doe@bosch.com', name: 'johndoe', pass: 'password', level: 'read', location: 'Rng', device_name: 'Alpha II'},
        res: {status: 'Invalid body format', details: '"pass" with value "password" fails to match the required pattern: /^(?=.*[0-9])(?=.*[a-z])(?=.*[A-Z])(?=.*[!"#%&\'()*+,-.\\/:;<=>?@[\\]^_`{|}~])(?=\\S+$).{8,}$/'}
      });
    });
    it('rejects requests from non-admins', done => {
      TestHelper.request(server, done, {
        method: 'post',
        url: '/user/new',
        auth: {basic: 'janedoe'},
        httpStatus: 403,
        req: {email: 'john.doe@bosch.com', name: 'johndoe', pass: 'Abc123!#', level: 'read', location: 'Rng', device_name: 'Alpha II'}
      });
    });
    it('rejects requests from an admin API key', done => {
      TestHelper.request(server, done, {
        method: 'post',
        url: '/user/new',
        auth: {key: 'admin'},
        httpStatus: 401,
        req: {email: 'john.doe@bosch.com', name: 'johndoe', pass: 'Abc123!#', level: 'read', location: 'Rng', device_name: 'Alpha II'}
      });
    });
    it('rejects unauthorized requests', done => {
      TestHelper.request(server, done, {
        method: 'post',
        url: '/user/new',
        httpStatus: 401,
        req: {email: 'john.doe@bosch.com', name: 'johndoe', pass: 'Abc123!#', level: 'read', location: 'Rng', device_name: 'Alpha II'}
      });
    });
  });

  describe('POST /user/passreset', () => {
    it('returns the ok response', done => {
      TestHelper.request(server, done, {
        method: 'post',
        url: '/user/passreset',
        httpStatus: 200,
        req: {email: 'jane.doe@bosch.com', name: 'janedoe'},
        res: {status: 'OK'}
      });
    });
    it('returns 404 for wrong username/email combo', done => {
      TestHelper.request(server, done, {
        method: 'post',
        url: '/user/passreset',
        httpStatus: 404,
        req: {email: 'jane.doe@bosch.com', name: 'admin'}
      });
    });
    it('returns 404 for unknown username', done => {
      TestHelper.request(server, done, {
        method: 'post',
        url: '/user/passreset',
        httpStatus: 404,
        req: {email: 'jane.doe@bosch.com', name: 'username'}
      });
    });
    it('changes the user password', done => {
      UserModel.find({name: 'janedoe'}).lean().exec( (err, data: any) => {
        if (err) return done(err);
        const oldpass = data[0].pass;
        TestHelper.request(server, done, {
          method: 'post',
          url: '/user/passreset',
          httpStatus: 200,
          req: {email: 'jane.doe@bosch.com', name: 'janedoe'}
        }).end((err, res) => {
            if (err) return done(err);
            should(res.body).be.eql({status: 'OK'});
            UserModel.find({name: 'janedoe'}).lean().exec(  (err, data: any) => {
              if (err) return done(err);
              should(data[0].pass).not.eql(oldpass);
              done();
            });
          });
      });
    });
  });
});