forked from wangziqi/gongxue-base
82 lines
2.5 KiB
TypeScript
82 lines
2.5 KiB
TypeScript
import { UnauthorizedException } from '@nestjs/common';
|
|
import { JwtStrategy } from './jwt.strategy';
|
|
|
|
describe('JwtStrategy', () => {
|
|
const config = { get: jest.fn().mockReturnValue('secret') };
|
|
|
|
it('refreshes permissions from the database instead of trusting stale JWT permissions', async () => {
|
|
const userRepo = {
|
|
findOne: jest.fn().mockResolvedValue({
|
|
id: 7,
|
|
username: 'teacher',
|
|
isActive: true,
|
|
isArchived: false,
|
|
roles: [
|
|
{
|
|
name: '老师',
|
|
status: 1,
|
|
permissions: [{ code: 'class:view' }, { code: 'attendance:view' }],
|
|
},
|
|
],
|
|
}),
|
|
};
|
|
const strategy = new JwtStrategy(config as never, userRepo as never);
|
|
|
|
await expect(
|
|
strategy.validate({ sub: 7, username: 'teacher', permissions: ['user:delete'] }),
|
|
).resolves.toEqual({
|
|
id: 7,
|
|
username: 'teacher',
|
|
permissions: ['class:view', 'attendance:view'],
|
|
isSuperAdmin: false,
|
|
roles: ['老师'],
|
|
});
|
|
});
|
|
|
|
it('recognizes the canonical super_admin role code even when the display name changes', async () => {
|
|
const userRepo = {
|
|
findOne: jest.fn().mockResolvedValue({
|
|
id: 1,
|
|
username: 'admin',
|
|
isActive: true,
|
|
isArchived: false,
|
|
roles: [{ name: '系统管理员', code: 'super_admin', status: 1, permissions: [] }],
|
|
}),
|
|
};
|
|
const strategy = new JwtStrategy(config as never, userRepo as never);
|
|
|
|
await expect(strategy.validate({ sub: 1 })).resolves.toEqual(
|
|
expect.objectContaining({ isSuperAdmin: true }),
|
|
);
|
|
});
|
|
|
|
it.each([[{ id: 7, isArchived: true, roles: [] }], [null]])(
|
|
'rejects archived or deleted users',
|
|
async (user) => {
|
|
const userRepo = { findOne: jest.fn().mockResolvedValue(user) };
|
|
const strategy = new JwtStrategy(config as never, userRepo as never);
|
|
|
|
await expect(strategy.validate({ sub: 7, username: 'teacher' })).rejects.toBeInstanceOf(
|
|
UnauthorizedException,
|
|
);
|
|
},
|
|
);
|
|
|
|
it('accepts a legacy disabled user when the account is not archived', async () => {
|
|
const userRepo = {
|
|
findOne: jest.fn().mockResolvedValue({
|
|
id: 7,
|
|
username: 'teacher',
|
|
isActive: false,
|
|
isArchived: false,
|
|
roles: [],
|
|
}),
|
|
};
|
|
const strategy = new JwtStrategy(config as never, userRepo as never);
|
|
|
|
await expect(strategy.validate({ sub: 7, username: 'teacher' })).resolves.toEqual(
|
|
expect.objectContaining({ id: 7, username: 'teacher' }),
|
|
);
|
|
});
|
|
});
|