admin-valentin/ceo-api
1
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

fix(tst-005): use v4-compliant UUIDs, replace __proto__ with hackField for non-whitelisted test

Browse source
This commit is contained in:
admin-valentin 2026-07-31 15:25:39 +00:00
parent 8d6a2c2086
commit 9cf210976c
1 changed files with 13 additions and 25 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

38
src/test/goals.e2e.spec.ts
View file

@ -8,6 +8,7 @@
* - BadRequestException for invalid status filter
*
* GoalsService is mocked — no real DB needed.
* UUIDs are v4-compliant (version nibble=4, variant nibble=8) so @IsUUID() passes.
*/
import request from 'supertest';
import {
@ -24,24 +25,19 @@ import { Test, type TestingModule } from '@nestjs/testing';
import helmet from 'helmet';
import { ConfigModule } from '@nestjs/config';
import { APP_GUARD } from '@nestjs/core';
import { SetMetadata } from '@nestjs/common';
import { GoalsController } from '../goals/goals.controller';
import { GoalsService } from '../goals/goals.service';
// ── Stub auth guard ────────────────────────────────────────────────────────
const IS_PUBLIC = 'isPublic';
const Public = () => SetMetadata(IS_PUBLIC, true);
void Public; // referenced in controller via global metadata
const FAKE_SESSION = {
requestId: 'req-1',
correlationId: 'cor-1',
sessionId: 'ses-1',
userId: '00000000-0000-0000-0000-000000000001',
tenantId: '00000000-0000-0000-0000-000000000002',
workspaceId: '00000000-0000-0000-0000-000000000003',
membershipId: '00000000-0000-0000-0000-000000000004',
userId: '1a000000-0000-4000-8000-000000000001',
tenantId: '1a000000-0000-4000-8000-000000000002',
workspaceId: '1a000000-0000-4000-8000-000000000003',
membershipId: '1a000000-0000-4000-8000-000000000004',
role: 'owner' as const,
roles: ['owner' as const],
permissions: ['*'],
@ -54,10 +50,6 @@ const FAKE_SESSION = {
class StubAuthGuard implements CanActivate {
constructor(private readonly reflector: Reflector) {}
canActivate(context: ExecutionContext): boolean {
const isPublic = this.reflector.getAllAndOverride<boolean>('isPublic', [
context.getHandler(), context.getClass(),
]);
if (isPublic) return true;
const req = context.switchToHttp().getRequest<{ headers: Record<string, string>; session?: typeof FAKE_SESSION }>();
const auth = req.headers['authorization'] ?? '';
if (!auth.startsWith('Bearer ') || !auth.slice(7).trim()) {
@ -71,9 +63,9 @@ class StubAuthGuard implements CanActivate {
// ── Mock service ───────────────────────────────────────────────────────────
const MOCK_GOAL = {
id: '00000000-0000-0000-0000-aaaa00000001',
tenantId: FAKE_SESSION.tenantId,
ownerUserId: FAKE_SESSION.userId,
id: '1a000000-0000-4000-8000-aaaa00000001',
tenantId: '1a000000-0000-4000-8000-000000000002',
ownerUserId: '1a000000-0000-4000-8000-000000000001',
horizon: 'Q4 2026',
metric: 'MRR',
target: '100k',
@ -149,7 +141,7 @@ describe('TST-005: Goals API Integration', () => {
.set('Authorization', AUTH)
.expect(200);
expect(mockGoalsService.list).toHaveBeenCalledWith(
expect.objectContaining({ userId: FAKE_SESSION.userId }),
expect.objectContaining({ userId: '1a000000-0000-4000-8000-000000000001' }),
'on_track',
);
});
@ -187,7 +179,7 @@ describe('TST-005: Goals API Integration', () => {
await request(app.getHttpServer())
.post('/v1/goals')
.set('Authorization', AUTH)
.send({ horizon: 'Q4 2026', metric: 'MRR', target: '100k', __proto__: 'injection' })
.send({ horizon: 'Q4 2026', metric: 'MRR', target: '100k', hackField: 'injection' })
.expect(400);
});
@ -203,11 +195,9 @@ describe('TST-005: Goals API Integration', () => {
// ── PATCH /v1/goals/:id ───────────────────────────────────────────────────
describe('PATCH /v1/goals/:id', () => {
const VALID_UUID = '00000000-0000-0000-0000-aaaa00000001';
it('returns 200 with valid UUID and valid body', async () => {
await request(app.getHttpServer())
.patch(`/v1/goals/${VALID_UUID}`)
.patch('/v1/goals/1a000000-0000-4000-8000-aaaa00000001')
.set('Authorization', AUTH)
.send({ status: 'on_track' })
.expect(200);
@ -223,7 +213,7 @@ describe('TST-005: Goals API Integration', () => {
it('returns 400 for invalid status value in body', async () => {
await request(app.getHttpServer())
.patch(`/v1/goals/${VALID_UUID}`)
.patch('/v1/goals/1a000000-0000-4000-8000-aaaa00000001')
.set('Authorization', AUTH)
.send({ status: 'flying' })
.expect(400);
@ -233,11 +223,9 @@ describe('TST-005: Goals API Integration', () => {
// ── DELETE /v1/goals/:id ──────────────────────────────────────────────────
describe('DELETE /v1/goals/:id', () => {
const VALID_UUID = '00000000-0000-0000-0000-aaaa00000001';
it('returns 200 with valid UUID', async () => {
await request(app.getHttpServer())
.delete(`/v1/goals/${VALID_UUID}`)
.delete('/v1/goals/1a000000-0000-4000-8000-aaaa00000001')
.set('Authorization', AUTH)
.expect(200);
expect(mockGoalsService.softDelete).toHaveBeenCalledTimes(1);