textbee

mirror of https://github.com/vernu/textbee.git synced 2026-07-30 17:07:46 -04:00

Files

isra el 68e72d8bdc test(api): lock the three authorization guards

The guards that prevent cross-tenant access had zero tests, which is the
highest-risk gap in the backend: a silent regression here would let one
account reach another account's devices or api keys.

These specs pin the current authz contract without changing any code:

- AuthGuard: valid bearer resolves the user; invalid/expired bearer is
  401; a valid x-api-key resolves via findActiveApiKeyByClientKey plus a
  matching bcrypt hash and attaches request.apiKey; a non-matching hash,
  an unknown key, and no credentials are all rejected; a token that
  resolves an id for a user that no longer exists is 401.
- CanModifyDevice / CanModifyApiKey: owner passes; non-owner is rejected
  (the cross-tenant case); admin passes regardless; an invalid ObjectId
  is 400 before any lookup; a missing record is rejected.

Guards are plain constructor-injected classes, so they are instantiated
directly with mocked services and a minimal ExecutionContext, which is
lighter than a testing module and equally faithful.

17 tests, all passing against the current unchanged guards.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-19 18:21:38 +03:00