feat: auto committed

services/content/src/middleware/auth.middleware.test.ts

@@ -0,0 +1,59 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { AuthMiddleware } from "./auth.middleware.js";
+import type { AuthenticatedRequest } from "./auth.middleware.js";
+import { UnauthorizedException } from "@nestjs/common";
+import type { Response, NextFunction } from "express";
+
+describe("AuthMiddleware", () => {
+  let middleware: AuthMiddleware;
+  const next = vi.fn();
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    middleware = new AuthMiddleware();
+  });
+
+  function createReq(headers: Record<string, unknown>): AuthenticatedRequest {
+    return { headers } as unknown as AuthenticatedRequest;
+  }
+
+  it("should set userId and userRoles from headers", () => {
+    const req = createReq({
+      "x-user-id": "user-1",
+      "x-user-roles": "admin,teacher",
+    });
+    middleware.use(req, {} as Response, next as NextFunction);
+    expect(req.userId).toBe("user-1");
+    expect(req.userRoles).toEqual(["admin", "teacher"]);
+    expect(next).toHaveBeenCalled();
+  });
+
+  it("should set empty roles array when x-user-roles missing", () => {
+    const req = createReq({ "x-user-id": "user-1" });
+    middleware.use(req, {} as Response, next as NextFunction);
+    expect(req.userId).toBe("user-1");
+    expect(req.userRoles).toEqual([]);
+  });
+
+  it("should throw UnauthorizedException when x-user-id missing", () => {
+    const req = createReq({});
+    expect(() =>
+      middleware.use(req, {} as Response, next as NextFunction),
+    ).toThrow(UnauthorizedException);
+  });
+
+  it("should throw when x-user-id is not a string", () => {
+    const req = createReq({ "x-user-id": ["not-a-string"] });
+    expect(() =>
+      middleware.use(req, {} as Response, next as NextFunction),
+    ).toThrow(UnauthorizedException);
+  });
+
+  it("should not call next when unauthorized", () => {
+    const req = createReq({});
+    expect(() =>
+      middleware.use(req, {} as Response, next as NextFunction),
+    ).toThrow();
+    expect(next).not.toHaveBeenCalled();
+  });
+});