/** * Tests for permission utility functions */ import { describe, it, expect, beforeEach, afterEach } from 'vitest' import { prisma } from '../db' import { canAccessList, canEditList, canDeleteList, getPermission, } from '../permissions' import bcrypt from 'bcryptjs' describe('Permission Utilities', () => { let testUser1Id: string let testUser2Id: string let testListId: string beforeEach(async () => { // Create test users const passwordHash = await bcrypt.hash('password123', 10) const user1 = await prisma.user.create({ data: { email: `test-perm-user1-${Date.now()}@example.com`, passwordHash, name: 'Test User 1', }, }) testUser1Id = user1.id const user2 = await prisma.user.create({ data: { email: `test-perm-user2-${Date.now()}@example.com`, passwordHash, name: 'Test User 2', }, }) testUser2Id = user2.id // Create a test list owned by user1 const list = await prisma.list.create({ data: { title: 'Test List', color: '#3B82F6', ownerId: testUser1Id, }, }) testListId = list.id }) afterEach(async () => { // Clean up test data await prisma.list.deleteMany({ where: { id: testListId, }, }) await prisma.user.deleteMany({ where: { id: { in: [testUser1Id, testUser2Id], }, }, }) }) describe('canAccessList', () => { it('should return true for list owner', async () => { const result = await canAccessList(testUser1Id, testListId) expect(result).toBe(true) }) it('should return false for non-owner without collaboration', async () => { const result = await canAccessList(testUser2Id, testListId) expect(result).toBe(false) }) it('should return true for editor collaborator', async () => { // Add user2 as editor await prisma.collaborator.create({ data: { userId: testUser2Id, listId: testListId, permission: 'editor', }, }) const result = await canAccessList(testUser2Id, testListId) expect(result).toBe(true) }) it('should return true for viewer collaborator', async () => { // Add user2 as viewer await prisma.collaborator.create({ data: { userId: testUser2Id, listId: testListId, permission: 'viewer', }, }) const result = await canAccessList(testUser2Id, testListId) expect(result).toBe(true) }) it('should return false for invalid user ID', async () => { const result = await canAccessList('', testListId) expect(result).toBe(false) }) it('should return false for invalid list ID', async () => { const result = await canAccessList(testUser1Id, '') expect(result).toBe(false) }) }) describe('canEditList', () => { it('should return true for list owner', async () => { const result = await canEditList(testUser1Id, testListId) expect(result).toBe(true) }) it('should return false for non-owner without collaboration', async () => { const result = await canEditList(testUser2Id, testListId) expect(result).toBe(false) }) it('should return true for editor collaborator', async () => { // Add user2 as editor await prisma.collaborator.create({ data: { userId: testUser2Id, listId: testListId, permission: 'editor', }, }) const result = await canEditList(testUser2Id, testListId) expect(result).toBe(true) }) it('should return false for viewer collaborator', async () => { // Add user2 as viewer await prisma.collaborator.create({ data: { userId: testUser2Id, listId: testListId, permission: 'viewer', }, }) const result = await canEditList(testUser2Id, testListId) expect(result).toBe(false) }) it('should return false for invalid user ID', async () => { const result = await canEditList('', testListId) expect(result).toBe(false) }) it('should return false for invalid list ID', async () => { const result = await canEditList(testUser1Id, '') expect(result).toBe(false) }) }) describe('canDeleteList', () => { it('should return true for list owner', async () => { const result = await canDeleteList(testUser1Id, testListId) expect(result).toBe(true) }) it('should return false for non-owner', async () => { const result = await canDeleteList(testUser2Id, testListId) expect(result).toBe(false) }) it('should return false for editor collaborator', async () => { // Add user2 as editor await prisma.collaborator.create({ data: { userId: testUser2Id, listId: testListId, permission: 'editor', }, }) const result = await canDeleteList(testUser2Id, testListId) expect(result).toBe(false) }) it('should return false for viewer collaborator', async () => { // Add user2 as viewer await prisma.collaborator.create({ data: { userId: testUser2Id, listId: testListId, permission: 'viewer', }, }) const result = await canDeleteList(testUser2Id, testListId) expect(result).toBe(false) }) it('should return false for invalid user ID', async () => { const result = await canDeleteList('', testListId) expect(result).toBe(false) }) it('should return false for invalid list ID', async () => { const result = await canDeleteList(testUser1Id, '') expect(result).toBe(false) }) }) describe('getPermission', () => { it('should return "owner" for list owner', async () => { const result = await getPermission(testUser1Id, testListId) expect(result).toBe('owner') }) it('should return null for non-owner without collaboration', async () => { const result = await getPermission(testUser2Id, testListId) expect(result).toBeNull() }) it('should return "editor" for editor collaborator', async () => { // Add user2 as editor await prisma.collaborator.create({ data: { userId: testUser2Id, listId: testListId, permission: 'editor', }, }) const result = await getPermission(testUser2Id, testListId) expect(result).toBe('editor') }) it('should return "viewer" for viewer collaborator', async () => { // Add user2 as viewer await prisma.collaborator.create({ data: { userId: testUser2Id, listId: testListId, permission: 'viewer', }, }) const result = await getPermission(testUser2Id, testListId) expect(result).toBe('viewer') }) it('should return null for invalid user ID', async () => { const result = await getPermission('', testListId) expect(result).toBeNull() }) it('should return null for invalid list ID', async () => { const result = await getPermission(testUser1Id, '') expect(result).toBeNull() }) }) })