dc0c5fd289
- Add rate limiting (5/hr public, 100/min admin endpoints) - Add honeypot bot protection on public POST - Add audit logging for status changes and deletions - Add input validation (email, phone, date, length limits) - Fix missing auth on private event GET endpoints - Add audit_log table to schema - Fix failing tests (auth.test, rooms-route.test)
63 lines
1.8 KiB
TypeScript
63 lines
1.8 KiB
TypeScript
import { beforeEach, describe, expect, it, vi } from 'vitest';
|
|
import { GET, POST } from '@/app/api/rooms/route';
|
|
|
|
const { query, requireRole } = vi.hoisted(() => ({ query: vi.fn(), requireRole: vi.fn() }));
|
|
|
|
vi.mock('@/lib/db', () => ({
|
|
db: {
|
|
query,
|
|
},
|
|
}));
|
|
|
|
vi.mock('@/lib/auth', () => ({
|
|
requireRole,
|
|
}));
|
|
|
|
describe('/api/rooms', () => {
|
|
beforeEach(() => {
|
|
query.mockReset();
|
|
requireRole.mockReset();
|
|
});
|
|
|
|
it('returns active rooms', async () => {
|
|
// Mock rooms query
|
|
query.mockResolvedValueOnce({ rows: [{ id: 1, name: 'Suite', active: true }] });
|
|
// Mock amenities query
|
|
query.mockResolvedValueOnce({ rows: [] });
|
|
// Mock images query
|
|
query.mockResolvedValueOnce({ rows: [] });
|
|
|
|
const response = await GET();
|
|
const body = await response.json();
|
|
|
|
expect(response.status).toBe(200);
|
|
expect(body).toEqual({ data: [{ id: 1, name: 'Suite', active: true, photos: [], amenities: [] }] });
|
|
});
|
|
|
|
it('creates a room for admins', async () => {
|
|
requireRole.mockResolvedValueOnce({ id: 1, username: 'admin', role: 'admin' });
|
|
query.mockResolvedValueOnce({ rows: [{ id: 7, name: 'Garden Room', price: '120.00' }] });
|
|
|
|
const response = await POST(
|
|
new Request('http://localhost/api/rooms', {
|
|
method: 'POST',
|
|
headers: { 'content-type': 'application/json' },
|
|
body: JSON.stringify({
|
|
name: 'Garden Room',
|
|
description: 'Nice view',
|
|
price: '120.00',
|
|
photos: ['a.jpg'],
|
|
sort_order: 1,
|
|
featured_photo: 'a.jpg',
|
|
}),
|
|
}) as any
|
|
);
|
|
|
|
const body = await response.json();
|
|
|
|
expect(requireRole).toHaveBeenCalledWith('admin');
|
|
expect(response.status).toBe(200);
|
|
expect(body).toEqual({ data: { id: 7, name: 'Garden Room', price: '120.00', photos: [], amenity_ids: [] } });
|
|
});
|
|
});
|