chore: add tests for auth middleware

Author: kevinkim-ogp

packages/backend/src/routes/api/__tests__/middleware/authentication.test.ts

@@ -0,0 +1,243 @@
+import type { NextFunction, Request, Response } from 'express'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+import type { UnauthenticatedContext } from '@/types/express/context'
+
+import {
+  getAuthenticatedContext,
+  requireAuthentication,
+  setCurrentUserContext,
+} from '../../middleware/authentication'
+
+const mocks = vi.hoisted(() => ({
+  setGraphQLContext: vi.fn(),
+}))
+
+vi.mock('@/helpers/authentication', () => ({
+  setCurrentUserContext: mocks.setGraphQLContext,
+}))
+
+describe('API Authentication Middleware', () => {
+  let mockReq: Partial<Request>
+  let mockRes: Partial<Response>
+  let mockNext: NextFunction
+
+  beforeEach(() => {
+    mockReq = {
+      headers: {},
+      context: undefined,
+    } as Partial<Request>
+
+    mockRes = {
+      status: vi.fn().mockReturnThis(),
+      json: vi.fn(),
+    } as Partial<Response>
+
+    mockNext = vi.fn()
+  })
+
+  afterEach(() => {
+    vi.restoreAllMocks()
+  })
+
+  describe('setCurrentUserContext', () => {
+    it('should call GraphQL context function and attach context to request', async () => {
+      const mockContext: UnauthenticatedContext = {
+        req: mockReq as Request,
+        res: mockRes as Response,
+        currentUser: {
+          id: 'test-user-id',
+          email: '[email protected]',
+        } as any,
+        isAdminOperation: false,
+      }
+
+      mocks.setGraphQLContext.mockResolvedValueOnce(mockContext)
+
+      await setCurrentUserContext(
+        mockReq as Request,
+        mockRes as Response,
+        mockNext,
+      )
+
+      expect(mocks.setGraphQLContext).toHaveBeenCalledWith({
+        req: mockReq,
+        res: mockRes,
+      })
+      expect(mockReq.context).toEqual(mockContext)
+      expect(mockNext).toHaveBeenCalledOnce()
+    })
+
+    it('should handle admin operations', async () => {
+      const mockContext: UnauthenticatedContext = {
+        req: mockReq as Request,
+        res: mockRes as Response,
+        currentUser: {
+          id: 'admin-user-id',
+          email: '[email protected]',
+        } as any,
+        isAdminOperation: true,
+      }
+
+      mocks.setGraphQLContext.mockResolvedValueOnce(mockContext)
+
+      await setCurrentUserContext(
+        mockReq as Request,
+        mockRes as Response,
+        mockNext,
+      )
+
+      expect(mockReq.context?.isAdminOperation).toBe(true)
+      expect(mockNext).toHaveBeenCalledOnce()
+    })
+
+    it('should attach context even when user is null', async () => {
+      const mockContext: UnauthenticatedContext = {
+        req: mockReq as Request,
+        res: mockRes as Response,
+        currentUser: null,
+        isAdminOperation: false,
+      }
+
+      mocks.setGraphQLContext.mockResolvedValueOnce(mockContext)
+
+      await setCurrentUserContext(
+        mockReq as Request,
+        mockRes as Response,
+        mockNext,
+      )
+
+      expect(mockReq.context).toEqual(mockContext)
+      expect(mockReq.context?.currentUser).toBeNull()
+      expect(mockNext).toHaveBeenCalledOnce()
+    })
+  })
+
+  describe('requireAuthentication', () => {
+    it('should call next() when user is authenticated', () => {
+      mockReq.context = {
+        req: mockReq as Request,
+        res: mockRes as Response,
+        currentUser: {
+          id: 'test-user-id',
+          email: '[email protected]',
+        } as any,
+        isAdminOperation: false,
+      }
+
+      requireAuthentication(mockReq as Request, mockRes as Response, mockNext)
+
+      expect(mockNext).toHaveBeenCalledOnce()
+      expect(mockRes.status).not.toHaveBeenCalled()
+      expect(mockRes.json).not.toHaveBeenCalled()
+    })
+
+    it('should return 401 when context is undefined', () => {
+      mockReq.context = undefined
+
+      requireAuthentication(mockReq as Request, mockRes as Response, mockNext)
+
+      expect(mockRes.status).toHaveBeenCalledWith(401)
+      expect(mockRes.json).toHaveBeenCalledWith({
+        error: 'Not Authorised!',
+      })
+      expect(mockNext).not.toHaveBeenCalled()
+    })
+
+    it('should return 401 when currentUser is null', () => {
+      mockReq.context = {
+        req: mockReq as Request,
+        res: mockRes as Response,
+        currentUser: null,
+        isAdminOperation: false,
+      }
+
+      requireAuthentication(mockReq as Request, mockRes as Response, mockNext)
+
+      expect(mockRes.status).toHaveBeenCalledWith(401)
+      expect(mockRes.json).toHaveBeenCalledWith({
+        error: 'Not Authorised!',
+      })
+      expect(mockNext).not.toHaveBeenCalled()
+    })
+
+    it('should allow admin operations through', () => {
+      mockReq.context = {
+        req: mockReq as Request,
+        res: mockRes as Response,
+        currentUser: {
+          id: 'admin-user-id',
+          email: '[email protected]',
+        } as any,
+        isAdminOperation: true,
+      }
+
+      requireAuthentication(mockReq as Request, mockRes as Response, mockNext)
+
+      expect(mockNext).toHaveBeenCalledOnce()
+      expect(mockRes.status).not.toHaveBeenCalled()
+    })
+  })
+
+  describe('getAuthenticatedContext', () => {
+    it('should return context when user is authenticated', () => {
+      const mockContext = {
+        req: mockReq as Request,
+        res: mockRes as Response,
+        currentUser: {
+          id: 'test-user-id',
+          email: '[email protected]',
+        } as any,
+        isAdminOperation: false,
+      }
+
+      mockReq.context = mockContext
+
+      const result = getAuthenticatedContext(mockReq as Request)
+
+      expect(result).toEqual(mockContext)
+      expect(result.currentUser).toBeDefined()
+      expect(result.currentUser.id).toBe('test-user-id')
+    })
+
+    it('should throw error when context is undefined', () => {
+      mockReq.context = undefined
+
+      expect(() => getAuthenticatedContext(mockReq as Request)).toThrow(
+        'User must be authenticated',
+      )
+    })
+
+    it('should throw error when currentUser is null', () => {
+      mockReq.context = {
+        req: mockReq as Request,
+        res: mockRes as Response,
+        currentUser: null,
+        isAdminOperation: false,
+      }
+
+      expect(() => getAuthenticatedContext(mockReq as Request)).toThrow(
+        'User must be authenticated',
+      )
+    })
+
+    it('should return context for admin users', () => {
+      const mockContext = {
+        req: mockReq as Request,
+        res: mockRes as Response,
+        currentUser: {
+          id: 'admin-user-id',
+          email: '[email protected]',
+        } as any,
+        isAdminOperation: true,
+      }
+
+      mockReq.context = mockContext
+
+      const result = getAuthenticatedContext(mockReq as Request)
+
+      expect(result).toEqual(mockContext)
+      expect(result.isAdminOperation).toBe(true)
+    })
+  })
+})