Liquifact-backend/smeAuth.stub.test.js at main · onyemaechiezekiel9/Liquifact-backend · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
'use strict';

const { authorizeSmeWallet, verifyInvoiceOwner } = require('./src/middleware/smeAuth');
const AppError = require('./src/errors/AppError');

describe('SME Auth Middleware Stub', () => {
  let req, res, next;

  beforeEach(() => {
    req = {
      headers: {},
      params: {},
      user: null,
      originalUrl: '/api/test'
    };
    res = {
      status: jest.fn().mockReturnThis(),
      json: jest.fn().mockReturnThis()
    };
    next = jest.fn();
  });

  describe('authorizeSmeWallet', () => {
    it('should fail if user is not authenticated', () => {
      authorizeSmeWallet(req, res, next);
      expect(next).toHaveBeenCalledWith(expect.any(AppError));
      const error = next.mock.calls[0][0];
      expect(error.status).toBe(401);
      expect(error.title).toBe('Unauthorized');
    });

    it('should fail if no wallet is bound and no header provided', () => {
      req.user = { id: 'user1' };
      authorizeSmeWallet(req, res, next);
      expect(next).toHaveBeenCalledWith(expect.any(AppError));
      const error = next.mock.calls[0][0];
      expect(error.status).toBe(403);
      expect(error.detail).toContain('No Stellar wallet address is bound');
    });

    it('should fail if wallet address is invalid format', () => {
      req.user = { id: 'user1', walletAddress: 'invalid-stellar-address' };
      authorizeSmeWallet(req, res, next);
      expect(next).toHaveBeenCalledWith(expect.any(AppError));
      const error = next.mock.calls[0][0];
      expect(error.status).toBe(400);
      expect(error.title).toBe('Invalid Wallet Address');
    });

    it('should succeed if wallet is bound to user record', () => {
      const validAddress = 'G' + 'A'.repeat(55);
      req.user = { id: 'user1', walletAddress: validAddress };
      authorizeSmeWallet(req, res, next);
      expect(next).toHaveBeenCalledWith();
      expect(req.walletAddress).toBe(validAddress);
    });

    it('should succeed if wallet is provided via x-stellar-address header (stub behavior)', () => {
      const validAddress = 'G' + 'A'.repeat(55);
      req.user = { id: 'user1' };
      req.headers['x-stellar-address'] = validAddress;
      authorizeSmeWallet(req, res, next);
      expect(next).toHaveBeenCalledWith();
      expect(req.walletAddress).toBe(validAddress);
    });
  });

  describe('verifyInvoiceOwner', () => {
    const validWallet = 'G' + 'A'.repeat(55);
    const invoices = [
      { id: 'inv1', ownerId: 'user1', smeWallet: validWallet },
      { id: 'inv2', ownerId: 'user2', smeWallet: 'G' + 'B'.repeat(55) }
    ];

    it('should fail if invoice ID is missing from params', () => {
      req.params = {};
      verifyInvoiceOwner(invoices)(req, res, next);
      expect(next).toHaveBeenCalledWith(expect.any(AppError));
      const error = next.mock.calls[0][0];
      expect(error.status).toBe(400);
      expect(error.detail).toBe('Invoice ID is required.');
    });

    it('should fail if invoice is not found', () => {
      req.params.id = 'missing-id';
      verifyInvoiceOwner(invoices)(req, res, next);
      expect(next).toHaveBeenCalledWith(expect.any(AppError));
      const error = next.mock.calls[0][0];
      expect(error.status).toBe(404);
      expect(error.detail).toContain('was not found');
    });

    it('should succeed if user is owner via userId match', () => {
      req.params.id = 'inv1';
      req.user = { id: 'user1' };
      verifyInvoiceOwner(invoices)(req, res, next);
      expect(next).toHaveBeenCalledWith();
      expect(req.invoice).toBe(invoices[0]);
    });

    it('should succeed if user is owner via walletAddress match', () => {
      req.params.id = 'inv1';
      req.walletAddress = validWallet;
      verifyInvoiceOwner(invoices)(req, res, next);
      expect(next).toHaveBeenCalledWith();
      expect(req.invoice).toBe(invoices[0]);
    });

    it('should fail if user/wallet does not match invoice owner info', () => {
      req.params.id = 'inv2';
      req.user = { id: 'user1' };
      req.walletAddress = validWallet;
      verifyInvoiceOwner(invoices)(req, res, next);
      expect(next).toHaveBeenCalledWith(expect.any(AppError));
      const error = next.mock.calls[0][0];
      expect(error.status).toBe(403);
      expect(error.title).toBe('Forbidden');
    });
  });
});