Sporalize-api / tests /analysis-admin.test.ts
Shoraky's picture
Verify cross-roster admin analysis and log actor role
dffa291
Raw History Blame Contribute Delete
2.99 kB
import assert from "node:assert/strict";
import { createServer } from "node:http";
import type { AddressInfo } from "node:net";
import { test } from "node:test";
import express from "express";
import type { SupabaseClient } from "@supabase/supabase-js";
test("an administrator can start analysis for another user's player", async () => {
Object.assign(process.env, {
NODE_ENV: "test",
FRONTEND_URL: "http://127.0.0.1:3000",
BACKEND_URL: "http://127.0.0.1:4000",
ANALYSIS_PROXY_SECRET: "test-analysis-proxy-secret-32-chars",
SUPABASE_URL: "http://127.0.0.1:54321",
SUPABASE_ANON_KEY: "test-anon-key",
SUPABASE_SERVICE_ROLE_KEY: "test-service-role-key",
});
const { analysisRouter } = await import("../src/analysis.js");
const adminId = "11111111-1111-4111-8111-111111111111";
const ownerId = "22222222-2222-4222-8222-222222222222";
const playerId = "33333333-3333-4333-8333-333333333333";
const clientId = "44444444-4444-4444-8444-444444444444";
const filters: [string, string][] = [];
const rpcCalls: { name: string; args: Record<string, unknown> }[] = [];
const db = {
from(table: string) {
assert.equal(table, "players");
const query = {
select() { return query; },
eq(column: string, value: string) { filters.push([column, value]); return query; },
async maybeSingle() { return { data: { player_id: playerId, user_id: ownerId }, error: null }; },
};
return query;
},
async rpc(name: string, args: Record<string, unknown>) {
rpcCalls.push({ name, args });
return { error: null };
},
} as unknown as SupabaseClient;
const secret = "test-analysis-proxy-secret-32-chars";
const app = express();
app.use("/internal/analysis", analysisRouter(db, secret));
const server = createServer(app);
await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
try {
const port = (server.address() as AddressInfo).port;
const response = await fetch(`http://127.0.0.1:${port}/internal/analysis`, {
method: "POST",
headers: {
"content-type": "application/json",
"x-sporalize-proxy-secret": secret,
"x-sporalize-user-id": adminId,
"x-sporalize-admin": "true",
},
body: JSON.stringify({ clientId, playerId, name: "Admin analysis" }),
});
assert.equal(response.status, 200);
assert.deepEqual(await response.json(), {
session_id: clientId, player_id: playerId, user_id: ownerId,
by_admin: true, actor_is_admin: true,
});
assert.deepEqual(filters, [["player_id", playerId]]);
assert.deepEqual(rpcCalls, [{ name: "admin_create_analysis_session", args: {
p_session_id: clientId, p_user_id: ownerId, p_player_id: playerId,
p_name: "Admin analysis", p_path: `sessions/${clientId}`, p_by_admin: true,
} }]);
} finally {
await new Promise<void>((resolve, reject) => server.close((error) => error ? reject(error) : resolve()));
}
});