tests/test_advanced_access_control.sh

#!/bin/bash

# Advanced test script to verify merchant settings access control with different user roles
echo "🔐 Advanced Merchant Settings Access Control Test"
echo "=================================================="

BASE_URL="http://127.0.0.1:8001"

echo ""
echo "1️⃣ Testing SuperAdmin Access"
echo "-----------------------------"
superadmin_response=$(curl -s -X POST "$BASE_URL/auth/login" \
    -H "Content-Type: application/json" \
    -d '{"email_or_phone": "superadmin", "password": "SuperAdmin@123"}')

if echo "$superadmin_response" | grep -q "access_token"; then
    echo "✅ SuperAdmin login successful"
    superadmin_token=$(echo "$superadmin_response" | grep -o '"access_token":"[^"]*"' | cut -d'"' -f4)
    
    settings_response=$(curl -s \
        -H "Authorization: Bearer $superadmin_token" \
        "$BASE_URL/merchant-settings")
    
    settings_count=$(echo "$settings_response" | grep -o '"merchant_id"' | wc -l | tr -d ' ')
    echo "📊 SuperAdmin can see $settings_count merchant settings"
else
    echo "❌ SuperAdmin login failed"
fi

echo ""
echo "2️⃣ Testing cnf Manager Access (Should be restricted)"
echo "-----------------------------------------------------"
cnf_response=$(curl -s -X POST "$BASE_URL/auth/login" \
    -H "Content-Type: application/json" \
    -d '{"email_or_phone": "north.manager@cuatrolabs.com", "password": "cnfManager@123"}')

if echo "$cnf_response" | grep -q "access_token"; then
    echo "✅ cnf Manager login successful"
    cnf_token=$(echo "$cnf_response" | grep -o '"access_token":"[^"]*"' | cut -d'"' -f4)
    
    # Test cnf manager access to merchant settings
    cnf_settings_response=$(curl -s \
        -H "Authorization: Bearer $cnf_token" \
        "$BASE_URL/merchant-settings")
    
    cnf_settings_count=$(echo "$cnf_settings_response" | grep -o '"merchant_id"' | wc -l | tr -d ' ')
    echo "📊 cnf Manager can see $cnf_settings_count merchant settings"
    
    # Test /my-settings for cnf manager
    my_settings_response=$(curl -s -w "HTTP_CODE:%{http_code}" \
        -H "Authorization: Bearer $cnf_token" \
        "$BASE_URL/merchant-settings/my-settings")
    
    http_code=$(echo "$my_settings_response" | grep -o "HTTP_CODE:[0-9]*" | cut -d: -f2)
    if [ "$http_code" = "200" ]; then
        echo "✅ cnf Manager can access /my-settings"
    else
        echo "❌ cnf Manager /my-settings failed with code $http_code"
    fi
else
    echo "❌ cnf Manager login failed:"
    echo "$cnf_response"
fi

echo ""
echo "3️⃣ Testing distributor Manager Access (Should be most restricted)"
echo "------------------------------------------------------------------"
dist_response=$(curl -s -X POST "$BASE_URL/auth/login" \
    -H "Content-Type: application/json" \
    -d '{"email_or_phone": "delhi.manager@premiumbeauty.com", "password": "DistManager@123"}')

if echo "$dist_response" | grep -q "access_token"; then
    echo "✅ distributor Manager login successful"
    dist_token=$(echo "$dist_response" | grep -o '"access_token":"[^"]*"' | cut -d'"' -f4)
    
    # Test distributor manager access to merchant settings
    dist_settings_response=$(curl -s \
        -H "Authorization: Bearer $dist_token" \
        "$BASE_URL/merchant-settings")
    
    dist_settings_count=$(echo "$dist_settings_response" | grep -o '"merchant_id"' | wc -l | tr -d ' ')
    echo "📊 distributor Manager can see $dist_settings_count merchant settings"
    
    # Test /my-settings for distributor manager
    my_settings_response=$(curl -s -w "HTTP_CODE:%{http_code}" \
        -H "Authorization: Bearer $dist_token" \
        "$BASE_URL/merchant-settings/my-settings")
    
    http_code=$(echo "$my_settings_response" | grep -o "HTTP_CODE:[0-9]*" | cut -d: -f2)
    if [ "$http_code" = "200" ]; then
        echo "✅ distributor Manager can access /my-settings"
    else
        echo "❌ distributor Manager /my-settings failed with code $http_code"
    fi
    
    # Test trying to access another merchant's settings (should fail)
    other_merchant_response=$(curl -s -w "HTTP_CODE:%{http_code}" \
        -H "Authorization: Bearer $dist_token" \
        "$BASE_URL/merchant-settings/company_cuatro_beauty_ltd")
    
    http_code=$(echo "$other_merchant_response" | grep -o "HTTP_CODE:[0-9]*" | cut -d: -f2)
    if [ "$http_code" = "403" ]; then
        echo "✅ distributor Manager correctly blocked from accessing other merchant (403)"
    else
        echo "❌ distributor Manager should be blocked from other merchants, got code $http_code"
    fi
else
    echo "❌ distributor Manager login failed:"
    echo "$dist_response"
fi

echo ""
echo "=================================================="
echo "🎯 Advanced Access Control Test Complete"
echo "=================================================="