juice-shop/test/api/wallet.test.ts at f3dc39e553ee252dd8a931a90961419a90b863cb · COG-GTM/juice-shop · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
/*
 * Copyright (c) 2014-2026 Bjoern Kimminich & the OWASP Juice Shop contributors.
 * SPDX-License-Identifier: MIT
 */

import { describe, it, before } from 'node:test'
import assert from 'node:assert/strict'
import request from 'supertest'
import type { Express } from 'express'
import { createTestApp } from './helpers/setup'
import { login } from './helpers/auth'

let app: Express
let authHeader: { Authorization: string, 'content-type': string }

before(async () => {
  const result = await createTestApp()
  app = result.app
  const { token } = await login(app, { email: 'demo', password: 'demo' })
  authHeader = { Authorization: `Bearer ${token}`, 'content-type': 'application/json' }
}, { timeout: 60000 })

void describe('/api/Wallets', () => {
  void it('GET wallet is forbidden via public API', async () => {
    const res = await request(app)
      .get('/rest/wallet/balance')
    assert.equal(res.status, 401)
  })

  void it('GET wallet retrieves wallet amount of requesting user', async () => {
    const res = await request(app)
      .get('/rest/wallet/balance')
      .set(authHeader)
    assert.equal(res.status, 200)
    assert.ok(res.headers['content-type']?.includes('application/json'))
    assert.equal(res.body.data, 200)
  })

  void it('PUT wallet is forbidden via public API', async () => {
    const res = await request(app)
      .put('/rest/wallet/balance')
      .send({ balance: 10 })
    assert.equal(res.status, 401)
  })

  void it('PUT charge wallet from credit card of requesting user', async () => {
    const res = await request(app)
      .put('/rest/wallet/balance')
      .set(authHeader)
      .send({ balance: 10, paymentId: 2 })
    assert.equal(res.status, 200)

    const balanceRes = await request(app)
      .get('/rest/wallet/balance')
      .set(authHeader)
    assert.equal(balanceRes.status, 200)
    assert.ok(balanceRes.headers['content-type']?.includes('application/json'))
    assert.equal(balanceRes.body.data, 210)
  })

  void it('PUT charge wallet with negative amount is rejected', async () => {
    const res = await request(app)
      .put('/rest/wallet/balance')
      .set(authHeader)
      .send({ balance: -500, paymentId: 2 })
    assert.equal(res.status, 400)
  })

  void it('PUT charge wallet with amount above maximum is rejected', async () => {
    const res = await request(app)
      .put('/rest/wallet/balance')
      .set(authHeader)
      .send({ balance: 999999, paymentId: 2 })
    assert.equal(res.status, 400)

    const balanceRes = await request(app)
      .get('/rest/wallet/balance')
      .set(authHeader)
    assert.equal(balanceRes.body.data, 210)
  })

  void it('PUT charge wallet with non-numeric amount is rejected', async () => {
    const res = await request(app)
      .put('/rest/wallet/balance')
      .set(authHeader)
      .send({ balance: 'lots', paymentId: 2 })
    assert.equal(res.status, 400)
  })

  void it('PUT charge wallet with non-integer amount is rejected', async () => {
    const res = await request(app)
      .put('/rest/wallet/balance')
      .set(authHeader)
      .send({ balance: 10.5, paymentId: 2 })
    assert.equal(res.status, 400)
  })

  void it('PUT charge wallet from foreign credit card is forbidden', async () => {
    const res = await request(app)
      .put('/rest/wallet/balance')
      .set(authHeader)
      .send({ balance: 10, paymentId: 1 })
    assert.equal(res.status, 402)
  })

  void it('PUT charge wallet without credit card is forbidden', async () => {
    const res = await request(app)
      .put('/rest/wallet/balance')
      .set(authHeader)
      .send({ balance: 10 })
    assert.equal(res.status, 402)
  })
})