mirror of
https://github.com/documenso/documenso.git
synced 2025-11-13 08:13:56 +10:00
chore: api tests (#1856)
This commit is contained in:
Catalin Pit
GitHub
@ -0,0 +1,540 @@
|
|||||||
|
import { expect, test } from '@playwright/test';
|
||||||
|
|
||||||
|
import { NEXT_PUBLIC_WEBAPP_URL } from '@documenso/lib/constants/app';
|
||||||
|
import { createApiToken } from '@documenso/lib/server-only/public-api/create-api-token';
|
||||||
|
import { prisma } from '@documenso/prisma';
|
||||||
|
import { FieldType } from '@documenso/prisma/client';
|
||||||
|
import {
|
||||||
|
seedBlankDocument,
|
||||||
|
seedCompletedDocument,
|
||||||
|
seedDraftDocument,
|
||||||
|
seedPendingDocumentWithFullFields,
|
||||||
|
} from '@documenso/prisma/seed/documents';
|
||||||
|
import { seedBlankTemplate } from '@documenso/prisma/seed/templates';
|
||||||
|
import { seedUser } from '@documenso/prisma/seed/users';
|
||||||
|
|
||||||
|
const WEBAPP_BASE_URL = NEXT_PUBLIC_WEBAPP_URL();
|
||||||
|
|
||||||
|
test.describe.configure({
|
||||||
|
mode: 'parallel',
|
||||||
|
});
|
||||||
|
|
||||||
|
test.describe('Document Access API V1', () => {
|
||||||
|
test('should block unauthorized access to documents not owned by the user', async ({
|
||||||
|
request,
|
||||||
|
}) => {
|
||||||
|
const { user: userA, team: teamA } = await seedUser();
|
||||||
|
|
||||||
|
const { user: userB, team: teamB } = await seedUser();
|
||||||
|
const { token: tokenB } = await createApiToken({
|
||||||
|
userId: userB.id,
|
||||||
|
teamId: teamB.id,
|
||||||
|
tokenName: 'userB',
|
||||||
|
expiresIn: null,
|
||||||
|
});
|
||||||
|
|
||||||
|
const documentA = await seedBlankDocument(userA, teamA.id);
|
||||||
|
|
||||||
|
// User B cannot access User A's document
|
||||||
|
const resB = await request.get(`${WEBAPP_BASE_URL}/api/v1/documents/${documentA.id}`, {
|
||||||
|
headers: { Authorization: `Bearer ${tokenB}` },
|
||||||
|
});
|
||||||
|
|
||||||
|
expect(resB.ok()).toBeFalsy();
|
||||||
|
expect(resB.status()).toBe(404);
|
||||||
|
});
|
||||||
|
|
||||||
|
test('should block unauthorized access to document download endpoint', async ({ request }) => {
|
||||||
|
const { user: userA, team: teamA } = await seedUser();
|
||||||
|
|
||||||
|
const { user: userB, team: teamB } = await seedUser();
|
||||||
|
const { token: tokenB } = await createApiToken({
|
||||||
|
userId: userB.id,
|
||||||
|
teamId: teamB.id,
|
||||||
|
tokenName: 'userB',
|
||||||
|
expiresIn: null,
|
||||||
|
});
|
||||||
|
|
||||||
|
const documentA = await seedCompletedDocument(userA, teamA.id, ['test@example.com'], {
|
||||||
|
createDocumentOptions: { title: 'Document 1 - Completed' },
|
||||||
|
});
|
||||||
|
|
||||||
|
const resB = await request.get(`${WEBAPP_BASE_URL}/api/v1/documents/${documentA.id}/download`, {
|
||||||
|
headers: { Authorization: `Bearer ${tokenB}` },
|
||||||
|
});
|
||||||
|
|
||||||
|
expect(resB.ok()).toBeFalsy();
|
||||||
|
expect(resB.status()).toBe(500);
|
||||||
|
});
|
||||||
|
|
||||||
|
test('should block unauthorized access to document delete endpoint', async ({ request }) => {
|
||||||
|
const { user: userA, team: teamA } = await seedUser();
|
||||||
|
|
||||||
|
const { user: userB, team: teamB } = await seedUser();
|
||||||
|
const { token: tokenB } = await createApiToken({
|
||||||
|
userId: userB.id,
|
||||||
|
teamId: teamB.id,
|
||||||
|
tokenName: 'userB',
|
||||||
|
expiresIn: null,
|
||||||
|
});
|
||||||
|
|
||||||
|
const documentA = await seedBlankDocument(userA, teamA.id);
|
||||||
|
|
||||||
|
const resB = await request.delete(`${WEBAPP_BASE_URL}/api/v1/documents/${documentA.id}`, {
|
||||||
|
headers: { Authorization: `Bearer ${tokenB}` },
|
||||||
|
});
|
||||||
|
|
||||||
|
expect(resB.ok()).toBeFalsy();
|
||||||
|
expect(resB.status()).toBe(404);
|
||||||
|
});
|
||||||
|
|
||||||
|
test('should block unauthorized access to document send endpoint', async ({ request }) => {
|
||||||
|
const { user: userA, team: teamA } = await seedUser();
|
||||||
|
|
||||||
|
const { user: userB, team: teamB } = await seedUser();
|
||||||
|
const { token: tokenB } = await createApiToken({
|
||||||
|
userId: userB.id,
|
||||||
|
teamId: teamB.id,
|
||||||
|
tokenName: 'userB',
|
||||||
|
expiresIn: null,
|
||||||
|
});
|
||||||
|
|
||||||
|
const { document: documentA } = await seedPendingDocumentWithFullFields({
|
||||||
|
owner: userA,
|
||||||
|
recipients: ['test@example.com'],
|
||||||
|
teamId: teamA.id,
|
||||||
|
});
|
||||||
|
|
||||||
|
const resB = await request.post(`${WEBAPP_BASE_URL}/api/v1/documents/${documentA.id}/send`, {
|
||||||
|
headers: { Authorization: `Bearer ${tokenB}` },
|
||||||
|
data: {},
|
||||||
|
});
|
||||||
|
|
||||||
|
expect(resB.ok()).toBeFalsy();
|
||||||
|
expect(resB.status()).toBe(500);
|
||||||
|
});
|
||||||
|
|
||||||
|
test('should block unauthorized access to document resend endpoint', async ({ request }) => {
|
||||||
|
const { user: userA, team: teamA } = await seedUser();
|
||||||
|
|
||||||
|
const { user: userB, team: teamB } = await seedUser();
|
||||||
|
const { token: tokenB } = await createApiToken({
|
||||||
|
userId: userB.id,
|
||||||
|
teamId: teamB.id,
|
||||||
|
tokenName: 'userB',
|
||||||
|
expiresIn: null,
|
||||||
|
});
|
||||||
|
|
||||||
|
const { user: recipientUser } = await seedUser();
|
||||||
|
|
||||||
|
const { document: documentA, recipients } = await seedPendingDocumentWithFullFields({
|
||||||
|
owner: userA,
|
||||||
|
recipients: [recipientUser.email],
|
||||||
|
teamId: teamA.id,
|
||||||
|
});
|
||||||
|
|
||||||
|
const resB = await request.post(`${WEBAPP_BASE_URL}/api/v1/documents/${documentA.id}/resend`, {
|
||||||
|
headers: { Authorization: `Bearer ${tokenB}` },
|
||||||
|
data: {
|
||||||
|
recipients: [recipients[0].id],
|
||||||
|
},
|
||||||
|
});
|
||||||
|
|
||||||
|
expect(resB.ok()).toBeFalsy();
|
||||||
|
expect(resB.status()).toBe(500);
|
||||||
|
});
|
||||||
|
|
||||||
|
test('should block unauthorized access to document recipients endpoint', async ({ request }) => {
|
||||||
|
const { user: userA, team: teamA } = await seedUser();
|
||||||
|
|
||||||
|
const { user: userB, team: teamB } = await seedUser();
|
||||||
|
const { token: tokenB } = await createApiToken({
|
||||||
|
userId: userB.id,
|
||||||
|
teamId: teamB.id,
|
||||||
|
tokenName: 'userB',
|
||||||
|
expiresIn: null,
|
||||||
|
});
|
||||||
|
|
||||||
|
const documentA = await seedBlankDocument(userA, teamA.id);
|
||||||
|
|
||||||
|
const resB = await request.post(
|
||||||
|
`${WEBAPP_BASE_URL}/api/v1/documents/${documentA.id}/recipients`,
|
||||||
|
{
|
||||||
|
headers: { Authorization: `Bearer ${tokenB}` },
|
||||||
|
data: { name: 'Test', email: 'test@example.com' },
|
||||||
|
},
|
||||||
|
);
|
||||||
|
|
||||||
|
expect(resB.ok()).toBeFalsy();
|
||||||
|
expect(resB.status()).toBe(401);
|
||||||
|
});
|
||||||
|
|
||||||
|
test('should block unauthorized access to PATCH on recipients endpoint', async ({ request }) => {
|
||||||
|
const { user: userA, team: teamA } = await seedUser();
|
||||||
|
|
||||||
|
const { user: userB, team: teamB } = await seedUser();
|
||||||
|
const { token: tokenB } = await createApiToken({
|
||||||
|
userId: userB.id,
|
||||||
|
teamId: teamB.id,
|
||||||
|
tokenName: 'userB',
|
||||||
|
expiresIn: null,
|
||||||
|
});
|
||||||
|
|
||||||
|
const { user: userRecipient } = await seedUser();
|
||||||
|
|
||||||
|
const documentA = await seedDraftDocument(userA, teamA.id, [userRecipient.email]);
|
||||||
|
|
||||||
|
const recipient = await prisma.recipient.findFirst({
|
||||||
|
where: {
|
||||||
|
documentId: documentA.id,
|
||||||
|
email: userRecipient.email,
|
||||||
|
},
|
||||||
|
});
|
||||||
|
|
||||||
|
const patchRes = await request.patch(
|
||||||
|
`${WEBAPP_BASE_URL}/api/v1/documents/${documentA.id}/recipients/${recipient!.id}`,
|
||||||
|
{
|
||||||
|
headers: { Authorization: `Bearer ${tokenB}` },
|
||||||
|
data: {
|
||||||
|
name: 'New Name',
|
||||||
|
email: 'new@example.com',
|
||||||
|
role: 'SIGNER',
|
||||||
|
signingOrder: null,
|
||||||
|
authOptions: {
|
||||||
|
accessAuth: [],
|
||||||
|
actionAuth: [],
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
);
|
||||||
|
|
||||||
|
expect(patchRes.ok()).toBeFalsy();
|
||||||
|
expect(patchRes.status()).toBe(401);
|
||||||
|
});
|
||||||
|
|
||||||
|
test('should block unauthorized access to DELETE on recipients endpoint', async ({ request }) => {
|
||||||
|
const { user: userA, team: teamA } = await seedUser();
|
||||||
|
|
||||||
|
const { user: userB, team: teamB } = await seedUser();
|
||||||
|
const { token: tokenB } = await createApiToken({
|
||||||
|
userId: userB.id,
|
||||||
|
teamId: teamB.id,
|
||||||
|
tokenName: 'userB',
|
||||||
|
expiresIn: null,
|
||||||
|
});
|
||||||
|
|
||||||
|
const { user: userRecipient } = await seedUser();
|
||||||
|
|
||||||
|
const documentA = await seedDraftDocument(userA, teamA.id, [userRecipient.email]);
|
||||||
|
|
||||||
|
const recipient = await prisma.recipient.findFirst({
|
||||||
|
where: {
|
||||||
|
documentId: documentA.id,
|
||||||
|
email: userRecipient.email,
|
||||||
|
},
|
||||||
|
});
|
||||||
|
|
||||||
|
const deleteRes = await request.delete(
|
||||||
|
`${WEBAPP_BASE_URL}/api/v1/documents/${documentA.id}/recipients/${recipient!.id}`,
|
||||||
|
{
|
||||||
|
headers: { Authorization: `Bearer ${tokenB}` },
|
||||||
|
data: {},
|
||||||
|
},
|
||||||
|
);
|
||||||
|
|
||||||
|
expect(deleteRes.ok()).toBeFalsy();
|
||||||
|
expect(deleteRes.status()).toBe(401);
|
||||||
|
});
|
||||||
|
|
||||||
|
test('should block unauthorized access to document fields endpoint', async ({ request }) => {
|
||||||
|
const { user: userA, team: teamA } = await seedUser();
|
||||||
|
|
||||||
|
const { user: userB, team: teamB } = await seedUser();
|
||||||
|
const { token: tokenB } = await createApiToken({
|
||||||
|
userId: userB.id,
|
||||||
|
teamId: teamB.id,
|
||||||
|
tokenName: 'userB',
|
||||||
|
expiresIn: null,
|
||||||
|
});
|
||||||
|
|
||||||
|
const { user: recipientUser } = await seedUser();
|
||||||
|
|
||||||
|
const documentA = await seedDraftDocument(userA, teamA.id, [recipientUser.email]);
|
||||||
|
|
||||||
|
const documentRecipient = await prisma.recipient.findFirst({
|
||||||
|
where: {
|
||||||
|
documentId: documentA.id,
|
||||||
|
email: recipientUser.email,
|
||||||
|
},
|
||||||
|
});
|
||||||
|
|
||||||
|
const resB = await request.post(`${WEBAPP_BASE_URL}/api/v1/documents/${documentA.id}/fields`, {
|
||||||
|
headers: { Authorization: `Bearer ${tokenB}` },
|
||||||
|
data: {
|
||||||
|
recipientId: documentRecipient!.id,
|
||||||
|
type: 'SIGNATURE',
|
||||||
|
pageNumber: 1,
|
||||||
|
pageX: 1,
|
||||||
|
pageY: 1,
|
||||||
|
pageWidth: 1,
|
||||||
|
pageHeight: 1,
|
||||||
|
},
|
||||||
|
});
|
||||||
|
|
||||||
|
expect(resB.ok()).toBeFalsy();
|
||||||
|
expect(resB.status()).toBe(404);
|
||||||
|
});
|
||||||
|
|
||||||
|
test('should block unauthorized access to template get endpoint', async ({ request }) => {
|
||||||
|
const { user: userA, team: teamA } = await seedUser();
|
||||||
|
|
||||||
|
const { user: userB, team: teamB } = await seedUser();
|
||||||
|
const { token: tokenB } = await createApiToken({
|
||||||
|
userId: userB.id,
|
||||||
|
teamId: teamB.id,
|
||||||
|
tokenName: 'userB',
|
||||||
|
expiresIn: null,
|
||||||
|
});
|
||||||
|
|
||||||
|
const templateA = await seedBlankTemplate(userA, teamA.id);
|
||||||
|
|
||||||
|
const resB = await request.get(`${WEBAPP_BASE_URL}/api/v1/templates/${templateA.id}`, {
|
||||||
|
headers: { Authorization: `Bearer ${tokenB}` },
|
||||||
|
});
|
||||||
|
|
||||||
|
expect(resB.ok()).toBeFalsy();
|
||||||
|
expect(resB.status()).toBe(404);
|
||||||
|
});
|
||||||
|
|
||||||
|
test('should block unauthorized access to template delete endpoint', async ({ request }) => {
|
||||||
|
const { user: userA, team: teamA } = await seedUser();
|
||||||
|
|
||||||
|
const { user: userB, team: teamB } = await seedUser();
|
||||||
|
const { token: tokenB } = await createApiToken({
|
||||||
|
userId: userB.id,
|
||||||
|
teamId: teamB.id,
|
||||||
|
tokenName: 'userB',
|
||||||
|
expiresIn: null,
|
||||||
|
});
|
||||||
|
|
||||||
|
const templateA = await seedBlankTemplate(userA, teamA.id);
|
||||||
|
|
||||||
|
const resB = await request.delete(`${WEBAPP_BASE_URL}/api/v1/templates/${templateA.id}`, {
|
||||||
|
headers: { Authorization: `Bearer ${tokenB}` },
|
||||||
|
});
|
||||||
|
|
||||||
|
expect(resB.ok()).toBeFalsy();
|
||||||
|
expect(resB.status()).toBe(404);
|
||||||
|
});
|
||||||
|
|
||||||
|
test('should block unauthorized access to PATCH on fields endpoint', async ({ request }) => {
|
||||||
|
const { user: userA, team: teamA } = await seedUser();
|
||||||
|
|
||||||
|
const { user: userB, team: teamB } = await seedUser();
|
||||||
|
const { token: tokenB } = await createApiToken({
|
||||||
|
userId: userB.id,
|
||||||
|
teamId: teamB.id,
|
||||||
|
tokenName: 'userB',
|
||||||
|
expiresIn: null,
|
||||||
|
});
|
||||||
|
|
||||||
|
const { user: userRecipient } = await seedUser();
|
||||||
|
const documentA = await seedDraftDocument(userA, teamA.id, [userRecipient.email]);
|
||||||
|
|
||||||
|
const recipient = await prisma.recipient.findFirst({
|
||||||
|
where: {
|
||||||
|
documentId: documentA.id,
|
||||||
|
email: userRecipient.email,
|
||||||
|
},
|
||||||
|
});
|
||||||
|
|
||||||
|
const field = await prisma.field.create({
|
||||||
|
data: {
|
||||||
|
documentId: documentA.id,
|
||||||
|
recipientId: recipient!.id,
|
||||||
|
type: FieldType.TEXT,
|
||||||
|
page: 1,
|
||||||
|
positionX: 5,
|
||||||
|
positionY: 5,
|
||||||
|
width: 10,
|
||||||
|
height: 5,
|
||||||
|
customText: '',
|
||||||
|
inserted: false,
|
||||||
|
fieldMeta: {
|
||||||
|
type: 'text',
|
||||||
|
label: 'Default Text Field',
|
||||||
|
},
|
||||||
|
},
|
||||||
|
});
|
||||||
|
|
||||||
|
const patchRes = await request.patch(
|
||||||
|
`${WEBAPP_BASE_URL}/api/v1/documents/${documentA.id}/fields/${field.id}`,
|
||||||
|
{
|
||||||
|
headers: { Authorization: `Bearer ${tokenB}` },
|
||||||
|
data: {
|
||||||
|
recipientId: recipient!.id,
|
||||||
|
type: FieldType.TEXT,
|
||||||
|
pageNumber: 1,
|
||||||
|
pageX: 99,
|
||||||
|
pageY: 99,
|
||||||
|
pageWidth: 99,
|
||||||
|
pageHeight: 99,
|
||||||
|
fieldMeta: {
|
||||||
|
type: 'text',
|
||||||
|
label: 'My new field',
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
);
|
||||||
|
expect(patchRes.ok()).toBeFalsy();
|
||||||
|
expect(patchRes.status()).toBe(401);
|
||||||
|
});
|
||||||
|
|
||||||
|
test('should block unauthorized access to DELETE on fields endpoint', async ({ request }) => {
|
||||||
|
const { user: userA, team: teamA } = await seedUser();
|
||||||
|
|
||||||
|
const { user: userB, team: teamB } = await seedUser();
|
||||||
|
const { token: tokenB } = await createApiToken({
|
||||||
|
userId: userB.id,
|
||||||
|
teamId: teamB.id,
|
||||||
|
tokenName: 'userB',
|
||||||
|
expiresIn: null,
|
||||||
|
});
|
||||||
|
|
||||||
|
const { user: userRecipient } = await seedUser();
|
||||||
|
const documentA = await seedDraftDocument(userA, teamA.id, [userRecipient.email]);
|
||||||
|
|
||||||
|
const recipient = await prisma.recipient.findFirst({
|
||||||
|
where: {
|
||||||
|
documentId: documentA.id,
|
||||||
|
email: userRecipient.email,
|
||||||
|
},
|
||||||
|
});
|
||||||
|
|
||||||
|
const field = await prisma.field.create({
|
||||||
|
data: {
|
||||||
|
documentId: documentA.id,
|
||||||
|
recipientId: recipient!.id,
|
||||||
|
type: FieldType.NUMBER,
|
||||||
|
page: 1,
|
||||||
|
positionX: 5,
|
||||||
|
positionY: 5,
|
||||||
|
width: 10,
|
||||||
|
height: 5,
|
||||||
|
customText: '',
|
||||||
|
inserted: false,
|
||||||
|
fieldMeta: {
|
||||||
|
type: 'number',
|
||||||
|
label: 'Default Number Field',
|
||||||
|
},
|
||||||
|
},
|
||||||
|
});
|
||||||
|
|
||||||
|
const deleteRes = await request.delete(
|
||||||
|
`${WEBAPP_BASE_URL}/api/v1/documents/${documentA.id}/fields/${field.id}`,
|
||||||
|
{
|
||||||
|
headers: { Authorization: `Bearer ${tokenB}` },
|
||||||
|
data: {},
|
||||||
|
},
|
||||||
|
);
|
||||||
|
|
||||||
|
expect(deleteRes.ok()).toBeFalsy();
|
||||||
|
expect(deleteRes.status()).toBe(401);
|
||||||
|
});
|
||||||
|
|
||||||
|
test('should block unauthorized access to documents list endpoint', async ({ request }) => {
|
||||||
|
const { user: userA, team: teamA } = await seedUser();
|
||||||
|
|
||||||
|
const { user: userB, team: teamB } = await seedUser();
|
||||||
|
const { token: tokenB } = await createApiToken({
|
||||||
|
userId: userB.id,
|
||||||
|
teamId: teamB.id,
|
||||||
|
tokenName: 'userB',
|
||||||
|
expiresIn: null,
|
||||||
|
});
|
||||||
|
|
||||||
|
await seedBlankDocument(userA, teamA.id);
|
||||||
|
|
||||||
|
const resB = await request.get(`${WEBAPP_BASE_URL}/api/v1/documents`, {
|
||||||
|
headers: { Authorization: `Bearer ${tokenB}` },
|
||||||
|
});
|
||||||
|
|
||||||
|
const reqData = await resB.json();
|
||||||
|
|
||||||
|
expect(resB.ok()).toBeTruthy();
|
||||||
|
expect(resB.status()).toBe(200);
|
||||||
|
expect(reqData.documents.every((doc: { userId: number }) => doc.userId !== userA.id)).toBe(
|
||||||
|
true,
|
||||||
|
);
|
||||||
|
expect(reqData.documents.length).toBe(0);
|
||||||
|
expect(reqData.totalPages).toBe(0);
|
||||||
|
});
|
||||||
|
|
||||||
|
test('should block unauthorized access to templates list endpoint', async ({ request }) => {
|
||||||
|
const { user: userA, team: teamA } = await seedUser();
|
||||||
|
|
||||||
|
const { user: userB, team: teamB } = await seedUser();
|
||||||
|
const { token: tokenB } = await createApiToken({
|
||||||
|
userId: userB.id,
|
||||||
|
teamId: teamB.id,
|
||||||
|
tokenName: 'userB',
|
||||||
|
expiresIn: null,
|
||||||
|
});
|
||||||
|
|
||||||
|
await seedBlankTemplate(userA, teamA.id);
|
||||||
|
|
||||||
|
const resB = await request.get(`${WEBAPP_BASE_URL}/api/v1/templates`, {
|
||||||
|
headers: { Authorization: `Bearer ${tokenB}` },
|
||||||
|
});
|
||||||
|
|
||||||
|
const reqData = await resB.json();
|
||||||
|
|
||||||
|
expect(resB.ok()).toBeTruthy();
|
||||||
|
expect(resB.status()).toBe(200);
|
||||||
|
expect(reqData.templates.every((tpl: { userId: number }) => tpl.userId !== userA.id)).toBe(
|
||||||
|
true,
|
||||||
|
);
|
||||||
|
expect(reqData.templates.length).toBe(0);
|
||||||
|
expect(reqData.totalPages).toBe(0);
|
||||||
|
});
|
||||||
|
|
||||||
|
test('should block unauthorized access to create-document-from-template endpoint', async ({
|
||||||
|
request,
|
||||||
|
}) => {
|
||||||
|
const { user: userA, team: teamA } = await seedUser();
|
||||||
|
|
||||||
|
const { user: userB, team: teamB } = await seedUser();
|
||||||
|
const { token: tokenB } = await createApiToken({
|
||||||
|
userId: userB.id,
|
||||||
|
teamId: teamB.id,
|
||||||
|
tokenName: 'userB',
|
||||||
|
expiresIn: null,
|
||||||
|
});
|
||||||
|
|
||||||
|
const templateA = await seedBlankTemplate(userA, teamA.id);
|
||||||
|
|
||||||
|
const resB = await request.post(
|
||||||
|
`${WEBAPP_BASE_URL}/api/v1/templates/${templateA.id}/create-document`,
|
||||||
|
{
|
||||||
|
headers: {
|
||||||
|
Authorization: `Bearer ${tokenB}`,
|
||||||
|
'Content-Type': 'application/json',
|
||||||
|
},
|
||||||
|
data: {
|
||||||
|
title: 'Should not work',
|
||||||
|
recipients: [{ name: 'Test user', email: 'test@example.com' }],
|
||||||
|
meta: {
|
||||||
|
subject: 'Test',
|
||||||
|
message: 'Test',
|
||||||
|
timezone: 'UTC',
|
||||||
|
dateFormat: 'yyyy-MM-dd',
|
||||||
|
redirectUrl: 'https://example.com',
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
);
|
||||||
|
|
||||||
|
expect(resB.ok()).toBeFalsy();
|
||||||
|
expect(resB.status()).toBe(401);
|
||||||
|
});
|
||||||
|
});
|
||||||
1323
packages/app-tests/e2e/api/v2/test-unauthorized-api-access.spec.ts
Normal file
1323
packages/app-tests/e2e/api/v2/test-unauthorized-api-access.spec.ts
Normal file
File diff suppressed because it is too large
Load Diff
@ -0,0 +1,100 @@
|
|||||||
|
import { expect, test } from '@playwright/test';
|
||||||
|
|
||||||
|
import { NEXT_PUBLIC_WEBAPP_URL } from '@documenso/lib/constants/app';
|
||||||
|
import {
|
||||||
|
seedBlankDocument,
|
||||||
|
seedCompletedDocument,
|
||||||
|
seedPendingDocument,
|
||||||
|
} from '@documenso/prisma/seed/documents';
|
||||||
|
import { seedUser } from '@documenso/prisma/seed/users';
|
||||||
|
|
||||||
|
import { apiSignin } from '../fixtures/authentication';
|
||||||
|
|
||||||
|
test.describe.configure({
|
||||||
|
mode: 'parallel',
|
||||||
|
});
|
||||||
|
|
||||||
|
test.describe('Unauthorized Access to Documents', () => {
|
||||||
|
test('should block unauthorized access to the draft document page', async ({ page }) => {
|
||||||
|
const { user, team } = await seedUser();
|
||||||
|
const document = await seedBlankDocument(user, team.id);
|
||||||
|
|
||||||
|
const { user: unauthorizedUser } = await seedUser();
|
||||||
|
|
||||||
|
await apiSignin({
|
||||||
|
page,
|
||||||
|
email: unauthorizedUser.email,
|
||||||
|
redirectPath: `/t/${team.url}/documents`,
|
||||||
|
});
|
||||||
|
|
||||||
|
await page.goto(`${NEXT_PUBLIC_WEBAPP_URL()}/t/${team.url}/documents/${document.id}`);
|
||||||
|
await expect(page.getByRole('heading', { name: 'Oops! Something went wrong.' })).toBeVisible();
|
||||||
|
});
|
||||||
|
|
||||||
|
test('should block unauthorized access to the draft document edit page', async ({ page }) => {
|
||||||
|
const { user, team } = await seedUser();
|
||||||
|
const document = await seedBlankDocument(user, team.id);
|
||||||
|
|
||||||
|
const { user: unauthorizedUser } = await seedUser();
|
||||||
|
|
||||||
|
await apiSignin({
|
||||||
|
page,
|
||||||
|
email: unauthorizedUser.email,
|
||||||
|
redirectPath: `/t/${team.url}/documents/${document.id}/edit`,
|
||||||
|
});
|
||||||
|
|
||||||
|
await page.goto(`${NEXT_PUBLIC_WEBAPP_URL()}/t/${team.url}/documents/${document.id}/edit`);
|
||||||
|
await expect(page.getByRole('heading', { name: 'Oops! Something went wrong.' })).toBeVisible();
|
||||||
|
});
|
||||||
|
|
||||||
|
test('should block unauthorized access to the pending document page', async ({ page }) => {
|
||||||
|
const { user, team } = await seedUser();
|
||||||
|
const { user: recipient } = await seedUser();
|
||||||
|
const document = await seedPendingDocument(user, team.id, [recipient]);
|
||||||
|
|
||||||
|
const { user: unauthorizedUser } = await seedUser();
|
||||||
|
|
||||||
|
await apiSignin({
|
||||||
|
page,
|
||||||
|
email: unauthorizedUser.email,
|
||||||
|
redirectPath: `/t/${team.url}/documents/${document.id}`,
|
||||||
|
});
|
||||||
|
|
||||||
|
await page.goto(`${NEXT_PUBLIC_WEBAPP_URL()}/t/${team.url}/documents/${document.id}`);
|
||||||
|
await expect(page.getByRole('heading', { name: 'Oops! Something went wrong.' })).toBeVisible();
|
||||||
|
});
|
||||||
|
|
||||||
|
test('should block unauthorized access to pending document edit page', async ({ page }) => {
|
||||||
|
const { user, team } = await seedUser();
|
||||||
|
const { user: recipient } = await seedUser();
|
||||||
|
const document = await seedPendingDocument(user, team.id, [recipient]);
|
||||||
|
|
||||||
|
const { user: unauthorizedUser } = await seedUser();
|
||||||
|
|
||||||
|
await apiSignin({
|
||||||
|
page,
|
||||||
|
email: unauthorizedUser.email,
|
||||||
|
redirectPath: `/t/${team.url}/documents/${document.id}/edit`,
|
||||||
|
});
|
||||||
|
|
||||||
|
await page.goto(`${NEXT_PUBLIC_WEBAPP_URL()}/t/${team.url}/documents/${document.id}/edit`);
|
||||||
|
await expect(page.getByRole('heading', { name: 'Oops! Something went wrong.' })).toBeVisible();
|
||||||
|
});
|
||||||
|
|
||||||
|
test('should block unauthorized access to completed document page', async ({ page }) => {
|
||||||
|
const { user, team } = await seedUser();
|
||||||
|
const { user: recipient } = await seedUser();
|
||||||
|
const document = await seedCompletedDocument(user, team.id, [recipient]);
|
||||||
|
|
||||||
|
const { user: unauthorizedUser } = await seedUser();
|
||||||
|
|
||||||
|
await apiSignin({
|
||||||
|
page,
|
||||||
|
email: unauthorizedUser.email,
|
||||||
|
redirectPath: `/t/${team.url}/documents/${document.id}`,
|
||||||
|
});
|
||||||
|
|
||||||
|
await page.goto(`${NEXT_PUBLIC_WEBAPP_URL()}/t/${team.url}/documents/${document.id}`);
|
||||||
|
await expect(page.getByRole('heading', { name: 'Oops! Something went wrong.' })).toBeVisible();
|
||||||
|
});
|
||||||
|
});
|
||||||
@ -0,0 +1,45 @@
|
|||||||
|
import { expect, test } from '@playwright/test';
|
||||||
|
|
||||||
|
import { NEXT_PUBLIC_WEBAPP_URL } from '@documenso/lib/constants/app';
|
||||||
|
import { seedBlankTemplate } from '@documenso/prisma/seed/templates';
|
||||||
|
import { seedUser } from '@documenso/prisma/seed/users';
|
||||||
|
|
||||||
|
import { apiSignin } from '../fixtures/authentication';
|
||||||
|
|
||||||
|
test.describe.configure({
|
||||||
|
mode: 'parallel',
|
||||||
|
});
|
||||||
|
|
||||||
|
test.describe('Unauthorized Access to Templates', () => {
|
||||||
|
test('should block unauthorized access to the template page', async ({ page }) => {
|
||||||
|
const { user, team } = await seedUser();
|
||||||
|
const template = await seedBlankTemplate(user, team.id);
|
||||||
|
|
||||||
|
const { user: unauthorizedUser } = await seedUser();
|
||||||
|
|
||||||
|
await apiSignin({
|
||||||
|
page,
|
||||||
|
email: unauthorizedUser.email,
|
||||||
|
redirectPath: `/t/${team.url}/templates/${template.id}`,
|
||||||
|
});
|
||||||
|
|
||||||
|
await page.goto(`${NEXT_PUBLIC_WEBAPP_URL()}/t/${team.url}/templates/${template.id}`);
|
||||||
|
await expect(page.getByRole('heading', { name: 'Oops! Something went wrong.' })).toBeVisible();
|
||||||
|
});
|
||||||
|
|
||||||
|
test('should block unauthorized access to the template edit page', async ({ page }) => {
|
||||||
|
const { user, team } = await seedUser();
|
||||||
|
const template = await seedBlankTemplate(user, team.id);
|
||||||
|
|
||||||
|
const { user: unauthorizedUser } = await seedUser();
|
||||||
|
|
||||||
|
await apiSignin({
|
||||||
|
page,
|
||||||
|
email: unauthorizedUser.email,
|
||||||
|
redirectPath: `/t/${team.url}/templates/${template.id}/edit`,
|
||||||
|
});
|
||||||
|
|
||||||
|
await page.goto(`${NEXT_PUBLIC_WEBAPP_URL()}/t/${team.url}/templates/${template.id}/edit`);
|
||||||
|
await expect(page.getByRole('heading', { name: 'Oops! Something went wrong.' })).toBeVisible();
|
||||||
|
});
|
||||||
|
});
|
||||||
Reference in New Issue
Block a user