Authorization Testing

// The test that most suites are missing entirely.
describe('GET /orders/:id', () => {
  let order: Order;

  beforeEach(async () => {
    order = await createOrder({ tenant: 'acme', owner: 'alice' });
  });

  it.each([
    ['the owner',           () => authAs('alice', 'acme'),  200],
    ['a colleague',         () => authAs('bob', 'acme'),    200],
    ['an admin',            () => authAs('root', 'acme'),   200],
    ['another tenant',      () => authAs('mallory', 'evil'), 404],  // not 403: do not confirm it exists
    ['a revoked user',      () => authAs('carol', 'acme', { revoked: true }), 401],
    ['nobody',              () => ({}),                      401]
  ])('as %s returns %i', async (_who, auth, expected) => {
    await request(app).get(`/orders/${order.id}`).set(auth()).expect(expected);
  });
});

// C#, xUnit — the matrix as data.
public static TheoryData<string, string, HttpStatusCode> AccessMatrix => new()
{
    { "owner",       "GET",    HttpStatusCode.OK },
    { "member",      "GET",    HttpStatusCode.OK },
    { "member",      "DELETE", HttpStatusCode.Forbidden },
    { "other-tenant","GET",    HttpStatusCode.NotFound },
    { "anonymous",   "GET",    HttpStatusCode.Unauthorized }
};

[Theory]
[MemberData(nameof(AccessMatrix))]
public async Task Order_access_is_enforced(string who, string method, HttpStatusCode expected)
{
    var client = factory.CreateClientAs(who);

    var response = await client.SendAsync(new HttpRequestMessage(new HttpMethod(method), $"/orders/{_order.Id}"));

    response.StatusCode.Should().Be(expected);
}

-- The bug: authenticated, but any tenant's order.
SELECT * FROM orders WHERE id = $1;

-- The fix, and what the test proves is present.
SELECT * FROM orders WHERE id = $1 AND tenant_id = $2;

it('ignores fields the caller is not allowed to set', async () => {
  await request(app)
    .patch(`/users/${alice.id}`)
    .set(authAs('alice'))
    .send({ displayName: 'Alice A', role: 'admin', tenantId: 'other' })
    .expect(200);

  const updated = await users.find(alice.id);
  expect(updated.displayName).toBe('Alice A');
  expect(updated.role).toBe('member');      // unchanged
  expect(updated.tenantId).toBe('acme');    // unchanged
});

// One helper, and the barrier is gone.
export function authAs(user: string, tenant = 'acme', options: { revoked?: boolean } = {}) {
  return { Authorization: `Bearer ${signTestToken({ sub: user, tenant, ...options })}` };
}

// Playwright: two browser contexts, two signed-in users, in one test.
const aliceContext = await browser.newContext({ storageState: '.auth/alice.json' });
const malloryContext = await browser.newContext({ storageState: '.auth/mallory.json' });

// A meta-test: fail the build when a protected route has no access test.
it('every protected route has an authorization test', () => {
  const routes = listRoutes(app).filter((r) => r.requiresAuth);
  const covered = new Set(readAuthorizationTestTargets());

  const uncovered = routes.filter((r) => !covered.has(`${r.method} ${r.path}`));

  expect(uncovered).toEqual([]);
});