fix faille

Author: maxence

TableMasterApi.Tests/Controllers/AuthControllerTests.cs

@@ -344,5 +344,23 @@ public async Task Refresh_ShouldReturnUnauthorized_WhenUserNoLongerExists()
             userDal.Verify(x => x.DeleteRefreshToken(It.IsAny<string>()), Times.Never);
             userDal.Verify(x => x.SaveRefreshToken(It.IsAny<long>(), It.IsAny<string>(), It.IsAny<DateTime>()), Times.Never);
         }
+
+        [Fact]
+        public async Task Logout_ShouldRevokeHashedRefreshToken()
+        {
+            var userDal = new Mock<IUserDAL>();
+            var authDal = new Mock<IAuthDAL>();
+            var controller = new AuthController(userDal.Object, authDal.Object, _jwtService);
+            const string refreshToken = "refresh-token-to-revoke";
+            var expectedHash = _jwtService.HashToken(refreshToken);
+
+            userDal.Setup(x => x.DeleteRefreshToken(expectedHash)).ReturnsAsync(true);
+
+            var result = await controller.Logout(new LogoutRequest { RefreshToken = refreshToken });
+
+            result.Should().BeOfType<NoContentResult>();
+            userDal.Verify(x => x.DeleteRefreshToken(expectedHash), Times.Once);
+            userDal.Verify(x => x.DeleteRefreshToken(refreshToken), Times.Never);
+        }
     }
 }

TableMasterApi.Tests/Controllers/ClosedDayExceptionControllerTests.cs

@@ -45,10 +45,13 @@ public async Task Post_ShouldReturnBadRequest_WhenInputIsNull()
         public async Task Post_ShouldReturnOk_WhenInputIsValid()
         {
             var dal = new Mock<IClosedDayExceptionDAL>();
-            var controller = CreateController(dal);
+            var restaurantDal = new Mock<IRestaurantDAL>();
+            var controller = CreateController(dal, restaurantDal);
+            ControllerTestHelper.SetBearerToken(controller, _jwtService, 42);
             var input = TestData.ClosedDayExceptionIn();
             var created = TestData.ClosedDayExceptionOut();
 
+            restaurantDal.Setup(x => x.GetRestaurantById(input.RestaurantId)).ReturnsAsync(TestData.RestaurantOut(userId: 42));
             dal.Setup(x => x.InsertAsync(input)).ReturnsAsync(created);
 
             var result = await controller.Post(input);
@@ -57,6 +60,24 @@ public async Task Post_ShouldReturnOk_WhenInputIsValid()
             ok.Value.Should().BeEquivalentTo(created);
         }
 
+        [Fact]
+        public async Task Post_ShouldReturnForbidden_WhenRestaurantBelongsToAnotherUser()
+        {
+            var dal = new Mock<IClosedDayExceptionDAL>();
+            var restaurantDal = new Mock<IRestaurantDAL>();
+            var controller = CreateController(dal, restaurantDal);
+            ControllerTestHelper.SetBearerToken(controller, _jwtService, 42);
+            var input = TestData.ClosedDayExceptionIn();
+
+            restaurantDal.Setup(x => x.GetRestaurantById(input.RestaurantId))
+                .ReturnsAsync(TestData.RestaurantOut(userId: 99));
+
+            var result = await controller.Post(input);
+
+            result.Result.Should().BeOfType<ForbidResult>();
+            dal.Verify(x => x.InsertAsync(It.IsAny<ClosedDayExceptionIn>()), Times.Never);
+        }
+
         [Fact]
         public async Task Put_ShouldReturnUnauthorized_WhenRestaurantBelongsToAnotherUser()
         {

TableMasterApi.Tests/Controllers/DailyActivityControllerTests.cs

@@ -41,6 +41,24 @@ public async Task Post_ShouldReturnBadRequest_WhenInputIsNull()
             dal.Verify(x => x.InsertAsync(It.IsAny<DailyActivityIn>()), Times.Never);
         }
 
+        [Fact]
+        public async Task Post_ShouldReturnForbidden_WhenRestaurantBelongsToAnotherUser()
+        {
+            var dal = new Mock<IDailyActivityDAL>();
+            var restaurantDal = new Mock<IRestaurantDAL>();
+            var controller = CreateController(dal, restaurantDal);
+            ControllerTestHelper.SetBearerToken(controller, _jwtService, 42);
+            var input = TestData.DailyActivityIn();
+
+            restaurantDal.Setup(x => x.GetRestaurantById(input.RestaurantId))
+                .ReturnsAsync(TestData.RestaurantOut(userId: 99));
+
+            var result = await controller.Post(input);
+
+            result.Should().BeOfType<ForbidResult>();
+            dal.Verify(x => x.InsertAsync(It.IsAny<DailyActivityIn>()), Times.Never);
+        }
+
         [Fact]
         public async Task Put_ShouldReturnUnauthorized_WhenRestaurantBelongsToAnotherUser()
         {

TableMasterApi.Tests/Controllers/MenuControllerTests.cs

@@ -45,10 +45,13 @@ public async Task Post_ShouldReturnBadRequest_WhenInputIsNull()
         public async Task Post_ShouldReturnOk_WhenInputIsValid()
         {
             var menuDal = new Mock<IMenuDAL>();
-            var controller = CreateController(menuDal);
+            var restaurantDal = new Mock<IRestaurantDAL>();
+            var controller = CreateController(menuDal, restaurantDal);
+            ControllerTestHelper.SetBearerToken(controller, _jwtService, 42);
             var input = TestData.MenuIn();
             var created = TestData.MenuOut();
 
+            restaurantDal.Setup(x => x.GetRestaurantById(input.RestaurantId)).ReturnsAsync(TestData.RestaurantOut(userId: 42));
             menuDal.Setup(x => x.InsertAsync(input)).ReturnsAsync(created);
 
             var result = await controller.Post(input);
@@ -57,6 +60,24 @@ public async Task Post_ShouldReturnOk_WhenInputIsValid()
             ok.Value.Should().BeEquivalentTo(created);
         }
 
+        [Fact]
+        public async Task Post_ShouldReturnForbidden_WhenRestaurantBelongsToAnotherUser()
+        {
+            var menuDal = new Mock<IMenuDAL>();
+            var restaurantDal = new Mock<IRestaurantDAL>();
+            var controller = CreateController(menuDal, restaurantDal);
+            ControllerTestHelper.SetBearerToken(controller, _jwtService, 42);
+            var input = TestData.MenuIn();
+
+            restaurantDal.Setup(x => x.GetRestaurantById(input.RestaurantId))
+                .ReturnsAsync(TestData.RestaurantOut(userId: 99));
+
+            var result = await controller.Post(input);
+
+            result.Should().BeOfType<ForbidResult>();
+            menuDal.Verify(x => x.InsertAsync(It.IsAny<MenuIn>()), Times.Never);
+        }
+
         [Fact]
         public async Task Delete_ShouldReturnUnauthorized_WhenRestaurantBelongsToAnotherUser()
         {