diff --git a/e2e/src/specs/server/api/partner.e2e-spec.ts b/e2e/src/specs/server/api/partner.e2e-spec.ts index 9047a97055..0eb7d6db3d 100644 --- a/e2e/src/specs/server/api/partner.e2e-spec.ts +++ b/e2e/src/specs/server/api/partner.e2e-spec.ts @@ -1,6 +1,5 @@ import { LoginResponseDto, createPartner } from '@immich/sdk'; import { createUserDto } from 'src/fixtures'; -import { errorDto } from 'src/responses'; import { app, asBearerAuth, utils } from 'src/utils'; import request from 'supertest'; import { beforeAll, describe, expect, it } from 'vitest'; @@ -29,13 +28,6 @@ describe('/partners', () => { }); describe('GET /partners', () => { - it('should require authentication', async () => { - const { status, body } = await request(app).get('/partners'); - - expect(status).toBe(401); - expect(body).toEqual(errorDto.unauthorized); - }); - it('should get all partners shared by user', async () => { const { status, body } = await request(app) .get('/partners') @@ -58,13 +50,6 @@ describe('/partners', () => { }); describe('POST /partners/:id', () => { - it('should require authentication', async () => { - const { status, body } = await request(app).post(`/partners/${user3.userId}`); - - expect(status).toBe(401); - expect(body).toEqual(errorDto.unauthorized); - }); - it('should share with new partner', async () => { const { status, body } = await request(app) .post(`/partners/${user3.userId}`) @@ -85,13 +70,6 @@ describe('/partners', () => { }); describe('PUT /partners/:id', () => { - it('should require authentication', async () => { - const { status, body } = await request(app).put(`/partners/${user2.userId}`); - - expect(status).toBe(401); - expect(body).toEqual(errorDto.unauthorized); - }); - it('should update partner', async () => { const { status, body } = await request(app) .put(`/partners/${user2.userId}`) @@ -104,13 +82,6 @@ describe('/partners', () => { }); describe('DELETE /partners/:id', () => { - it('should require authentication', async () => { - const { status, body } = await request(app).delete(`/partners/${user3.userId}`); - - expect(status).toBe(401); - expect(body).toEqual(errorDto.unauthorized); - }); - it('should delete partner', async () => { const { status } = await request(app) .delete(`/partners/${user3.userId}`) diff --git a/e2e/src/specs/server/api/server.e2e-spec.ts b/e2e/src/specs/server/api/server.e2e-spec.ts index 53857a31fa..f0eed82f7a 100644 --- a/e2e/src/specs/server/api/server.e2e-spec.ts +++ b/e2e/src/specs/server/api/server.e2e-spec.ts @@ -22,12 +22,6 @@ describe('/server', () => { }); describe('GET /server/about', () => { - it('should require authentication', async () => { - const { status, body } = await request(app).get('/server/about'); - expect(status).toBe(401); - expect(body).toEqual(errorDto.unauthorized); - }); - it('should return about information', async () => { const { status, body } = await request(app) .get('/server/about') @@ -56,12 +50,6 @@ describe('/server', () => { }); describe('GET /server/storage', () => { - it('should require authentication', async () => { - const { status, body } = await request(app).get('/server/storage'); - expect(status).toBe(401); - expect(body).toEqual(errorDto.unauthorized); - }); - it('should return the disk information', async () => { const { status, body } = await request(app) .get('/server/storage') @@ -149,12 +137,6 @@ describe('/server', () => { }); describe('GET /server/statistics', () => { - it('should require authentication', async () => { - const { status, body } = await request(app).get('/server/statistics'); - expect(status).toBe(401); - expect(body).toEqual(errorDto.unauthorized); - }); - it('should only work for admins', async () => { const { status, body } = await request(app) .get('/server/statistics') @@ -213,12 +195,6 @@ describe('/server', () => { }); describe('GET /server/license', () => { - it('should require authentication', async () => { - const { status, body } = await request(app).get('/server/license'); - expect(status).toBe(401); - expect(body).toEqual(errorDto.unauthorized); - }); - it('should only work for admins', async () => { const { status, body } = await request(app) .get('/server/license') @@ -241,12 +217,6 @@ describe('/server', () => { }); describe('DELETE /server/license', () => { - it('should require authentication', async () => { - const { status, body } = await request(app).delete('/server/license'); - expect(status).toBe(401); - expect(body).toEqual(errorDto.unauthorized); - }); - it('should only work for admins', async () => { const { status, body } = await request(app) .delete('/server/license') @@ -266,12 +236,6 @@ describe('/server', () => { }); describe('PUT /server/license', () => { - it('should require authentication', async () => { - const { status, body } = await request(app).put('/server/license'); - expect(status).toBe(401); - expect(body).toEqual(errorDto.unauthorized); - }); - it('should only work for admins', async () => { const { status, body } = await request(app) .put('/server/license') diff --git a/e2e/src/specs/server/api/session.e2e-spec.ts b/e2e/src/specs/server/api/session.e2e-spec.ts index 0b632f78ba..1766b732cd 100644 --- a/e2e/src/specs/server/api/session.e2e-spec.ts +++ b/e2e/src/specs/server/api/session.e2e-spec.ts @@ -15,12 +15,6 @@ describe('/sessions', () => { }); describe('GET /sessions', () => { - it('should require authentication', async () => { - const { status, body } = await request(app).get('/sessions'); - expect(status).toBe(401); - expect(body).toEqual(errorDto.unauthorized); - }); - it('should get a list of authorized devices', async () => { const { status, body } = await request(app).get('/sessions').set('Authorization', `Bearer ${admin.accessToken}`); expect(status).toBe(200); @@ -29,12 +23,6 @@ describe('/sessions', () => { }); describe('DELETE /sessions', () => { - it('should require authentication', async () => { - const { status, body } = await request(app).delete(`/sessions`); - expect(status).toBe(401); - expect(body).toEqual(errorDto.unauthorized); - }); - it('should logout all devices (except the current one)', async () => { for (let i = 0; i < 5; i++) { await login({ loginCredentialDto: loginDto.admin }); diff --git a/e2e/src/specs/server/api/shared-link.e2e-spec.ts b/e2e/src/specs/server/api/shared-link.e2e-spec.ts index 8cdf2dc03c..b9f695b48e 100644 --- a/e2e/src/specs/server/api/shared-link.e2e-spec.ts +++ b/e2e/src/specs/server/api/shared-link.e2e-spec.ts @@ -137,13 +137,6 @@ describe('/shared-links', () => { }); describe('GET /shared-links', () => { - it('should require authentication', async () => { - const { status, body } = await request(app).get('/shared-links'); - - expect(status).toBe(401); - expect(body).toEqual(errorDto.unauthorized); - }); - it('should get all shared links created by user', async () => { const { status, body } = await request(app) .get('/shared-links') @@ -200,12 +193,6 @@ describe('/shared-links', () => { }); describe('GET /shared-links/me', () => { - it('should not require admin authentication', async () => { - const { status } = await request(app).get('/shared-links/me').set('Authorization', `Bearer ${admin.accessToken}`); - - expect(status).toBe(403); - }); - it('should get data for correct shared link', async () => { const { status, body } = await request(app).get('/shared-links/me').query({ key: linkWithAlbum.key }); @@ -293,13 +280,6 @@ describe('/shared-links', () => { }); describe('GET /shared-links/:id', () => { - it('should require authentication', async () => { - const { status, body } = await request(app).get(`/shared-links/${linkWithAlbum.id}`); - - expect(status).toBe(401); - expect(body).toEqual(errorDto.unauthorized); - }); - it('should get shared link by id', async () => { const { status, body } = await request(app) .get(`/shared-links/${linkWithAlbum.id}`) @@ -326,26 +306,6 @@ describe('/shared-links', () => { }); describe('POST /shared-links', () => { - it('should require authentication', async () => { - const { status, body } = await request(app) - .post('/shared-links') - .send({ type: SharedLinkType.Album, albumId: uuidDto.notFound }); - - expect(status).toBe(401); - expect(body).toEqual(errorDto.unauthorized); - }); - - it('should require a type and the correspondent asset/album id', async () => { - const { status, body } = await request(app) - .post('/shared-links') - .set('Authorization', `Bearer ${user1.accessToken}`); - - expect(status).toBe(400); - expect(body).toEqual( - errorDto.validationError([{ path: [], message: 'Invalid input: expected object, received undefined' }]), - ); - }); - it('should require an asset/album id', async () => { const { status, body } = await request(app) .post('/shared-links') @@ -383,15 +343,6 @@ describe('/shared-links', () => { }); describe('PATCH /shared-links/:id', () => { - it('should require authentication', async () => { - const { status, body } = await request(app) - .patch(`/shared-links/${linkWithAlbum.id}`) - .send({ description: 'foo' }); - - expect(status).toBe(401); - expect(body).toEqual(errorDto.unauthorized); - }); - it('should fail if invalid link', async () => { const { status, body } = await request(app) .patch(`/shared-links/${uuidDto.notFound}`) @@ -474,13 +425,6 @@ describe('/shared-links', () => { }); describe('DELETE /shared-links/:id', () => { - it('should require authentication', async () => { - const { status, body } = await request(app).delete(`/shared-links/${linkWithAlbum.id}`); - - expect(status).toBe(401); - expect(body).toEqual(errorDto.unauthorized); - }); - it('should fail if invalid link', async () => { const { status, body } = await request(app) .delete(`/shared-links/${uuidDto.notFound}`) diff --git a/e2e/src/specs/server/api/stack.e2e-spec.ts b/e2e/src/specs/server/api/stack.e2e-spec.ts index 76bf514dc8..3b8f642334 100644 --- a/e2e/src/specs/server/api/stack.e2e-spec.ts +++ b/e2e/src/specs/server/api/stack.e2e-spec.ts @@ -1,5 +1,5 @@ import { AssetMediaResponseDto, LoginResponseDto, searchStacks } from '@immich/sdk'; -import { createUserDto, uuidDto } from 'src/fixtures'; +import { createUserDto } from 'src/fixtures'; import { errorDto } from 'src/responses'; import { app, asBearerAuth, utils } from 'src/utils'; import request from 'supertest'; @@ -25,42 +25,6 @@ describe('/stacks', () => { }); describe('POST /stacks', () => { - it('should require authentication', async () => { - const { status, body } = await request(app) - .post('/stacks') - .send({ assetIds: [asset.id] }); - - expect(status).toBe(401); - expect(body).toEqual(errorDto.unauthorized); - }); - - it('should require at least two assets', async () => { - const { status, body } = await request(app) - .post('/stacks') - .set('Authorization', `Bearer ${user1.accessToken}`) - .send({ assetIds: [asset.id] }); - - expect(status).toBe(400); - expect(body).toEqual( - errorDto.validationError([{ path: ['assetIds'], message: 'Too small: expected array to have >=2 items' }]), - ); - }); - - it('should require a valid id', async () => { - const { status, body } = await request(app) - .post('/stacks') - .set('Authorization', `Bearer ${user1.accessToken}`) - .send({ assetIds: [uuidDto.invalid, uuidDto.invalid] }); - - expect(status).toBe(400); - expect(body).toEqual( - errorDto.validationError([ - { path: ['assetIds', 0], message: 'Invalid UUID' }, - { path: ['assetIds', 1], message: 'Invalid UUID' }, - ]), - ); - }); - it('should require access', async () => { const user2Asset = await utils.createAsset(user2.accessToken); const { status, body } = await request(app) diff --git a/e2e/src/specs/server/api/system-metadata.e2e-spec.ts b/e2e/src/specs/server/api/system-metadata.e2e-spec.ts index bd17bf2524..114ed2f995 100644 --- a/e2e/src/specs/server/api/system-metadata.e2e-spec.ts +++ b/e2e/src/specs/server/api/system-metadata.e2e-spec.ts @@ -16,12 +16,6 @@ describe('/server-info', () => { }); describe('POST /system-metadata/admin-onboarding', () => { - it('should require authentication', async () => { - const { status, body } = await request(app).post('/system-metadata/admin-onboarding').send({ isOnboarded: true }); - expect(status).toBe(401); - expect(body).toEqual(errorDto.unauthorized); - }); - it('should only work for admins', async () => { const { status, body } = await request(app) .post('/system-metadata/admin-onboarding') @@ -47,12 +41,6 @@ describe('/server-info', () => { }); describe('GET /system-metadata/reverse-geocoding-state', () => { - it('should require authentication', async () => { - const { status, body } = await request(app).get('/system-metadata/reverse-geocoding-state'); - expect(status).toBe(401); - expect(body).toEqual(errorDto.unauthorized); - }); - it('should only work for admins', async () => { const { status, body } = await request(app) .get('/system-metadata/reverse-geocoding-state') diff --git a/e2e/src/specs/server/api/tag.e2e-spec.ts b/e2e/src/specs/server/api/tag.e2e-spec.ts index d303a1e98d..98d66f6350 100644 --- a/e2e/src/specs/server/api/tag.e2e-spec.ts +++ b/e2e/src/specs/server/api/tag.e2e-spec.ts @@ -41,12 +41,6 @@ describe('/tags', () => { }); describe('POST /tags', () => { - it('should require authentication', async () => { - const { status, body } = await request(app).post('/tags').send({ name: 'TagA' }); - expect(status).toBe(401); - expect(body).toEqual(errorDto.unauthorized); - }); - it('should require authorization (api key)', async () => { const { secret } = await utils.createApiKey(user.accessToken, [Permission.AssetRead]); const { status, body } = await request(app).post('/tags').set('x-api-key', secret).send({ name: 'TagA' }); @@ -117,12 +111,6 @@ describe('/tags', () => { }); describe('GET /tags', () => { - it('should require authentication', async () => { - const { status, body } = await request(app).get('/tags'); - expect(status).toBe(401); - expect(body).toEqual(errorDto.unauthorized); - }); - it('should require authorization (api key)', async () => { const { secret } = await utils.createApiKey(user.accessToken, [Permission.AssetRead]); const { status, body } = await request(app).get('/tags').set('x-api-key', secret); @@ -169,12 +157,6 @@ describe('/tags', () => { }); describe('PUT /tags', () => { - it('should require authentication', async () => { - const { status, body } = await request(app).put(`/tags`).send({ name: 'TagA/TagB' }); - expect(status).toBe(401); - expect(body).toEqual(errorDto.unauthorized); - }); - it('should require authorization (api key)', async () => { const { secret } = await utils.createApiKey(user.accessToken, [Permission.AssetRead]); const { status, body } = await request(app).put('/tags').set('x-api-key', secret).send({ name: 'TagA' }); @@ -213,12 +195,6 @@ describe('/tags', () => { }); describe('PUT /tags/assets', () => { - it('should require authentication', async () => { - const { status, body } = await request(app).put(`/tags/assets`).send({ tagIds: [], assetIds: [] }); - expect(status).toBe(401); - expect(body).toEqual(errorDto.unauthorized); - }); - it('should require authorization (api key)', async () => { const { secret } = await utils.createApiKey(user.accessToken, [Permission.AssetRead]); const { status, body } = await request(app) @@ -279,12 +255,6 @@ describe('/tags', () => { }); describe('GET /tags/:id', () => { - it('should require authentication', async () => { - const { status, body } = await request(app).get(`/tags/${uuidDto.notFound}`); - expect(status).toBe(401); - expect(body).toEqual(errorDto.unauthorized); - }); - it('should require authorization', async () => { const tag = await create(user.accessToken, { name: 'TagA' }); const { status, body } = await request(app) @@ -304,14 +274,6 @@ describe('/tags', () => { expect(body).toEqual(errorDto.missingPermission('tag.read')); }); - it('should require a valid uuid', async () => { - const { status, body } = await request(app) - .get(`/tags/${uuidDto.invalid}`) - .set('Authorization', `Bearer ${admin.accessToken}`); - expect(status).toBe(400); - expect(body).toEqual(errorDto.validationError([{ path: ['id'], message: 'Invalid UUID' }])); - }); - it('should get tag details', async () => { const tag = await create(user.accessToken, { name: 'TagA' }); const { status, body } = await request(app) @@ -349,13 +311,6 @@ describe('/tags', () => { }); describe('PUT /tags/:id', () => { - it('should require authentication', async () => { - const tag = await create(user.accessToken, { name: 'TagA' }); - const { status, body } = await request(app).put(`/tags/${tag.id}`).send({ color: '#000000' }); - expect(status).toBe(401); - expect(body).toEqual(errorDto.unauthorized); - }); - it('should require authorization', async () => { const tag = await create(admin.accessToken, { name: 'tagA' }); const { status, body } = await request(app) @@ -399,12 +354,6 @@ describe('/tags', () => { }); describe('DELETE /tags/:id', () => { - it('should require authentication', async () => { - const { status, body } = await request(app).delete(`/tags/${uuidDto.notFound}`); - expect(status).toBe(401); - expect(body).toEqual(errorDto.unauthorized); - }); - it('should require authorization', async () => { const tag = await create(user.accessToken, { name: 'TagA' }); const { status, body } = await request(app) @@ -422,14 +371,6 @@ describe('/tags', () => { expect(body).toEqual(errorDto.missingPermission('tag.delete')); }); - it('should require a valid uuid', async () => { - const { status, body } = await request(app) - .delete(`/tags/${uuidDto.invalid}`) - .set('Authorization', `Bearer ${admin.accessToken}`); - expect(status).toBe(400); - expect(body).toEqual(errorDto.validationError([{ path: ['id'], message: 'Invalid UUID' }])); - }); - it('should delete a tag', async () => { const tag = await create(user.accessToken, { name: 'TagA' }); const { status } = await request(app) @@ -463,15 +404,6 @@ describe('/tags', () => { }); describe('PUT /tags/:id/assets', () => { - it('should require authentication', async () => { - const tagA = await create(user.accessToken, { name: 'TagA' }); - const { status, body } = await request(app) - .put(`/tags/${tagA.id}/assets`) - .send({ ids: [userAsset.id] }); - expect(status).toBe(401); - expect(body).toEqual(errorDto.unauthorized); - }); - it('should require authorization', async () => { const tag = await create(user.accessToken, { name: 'TagA' }); const { status, body } = await request(app) @@ -531,16 +463,6 @@ describe('/tags', () => { }); describe('DELETE /tags/:id/assets', () => { - it('should require authentication', async () => { - const tagA = await create(admin.accessToken, { name: 'TagA' }); - const { status, body } = await request(app) - .delete(`/tags/${tagA}/assets`) - .send({ ids: [userAsset.id] }); - - expect(status).toBe(401); - expect(body).toEqual(errorDto.unauthorized); - }); - it('should require authorization', async () => { const tagA = await create(user.accessToken, { name: 'TagA' }); await tagAssets( diff --git a/e2e/src/specs/server/api/user-admin.e2e-spec.ts b/e2e/src/specs/server/api/user-admin.e2e-spec.ts index f442d4249d..160c929591 100644 --- a/e2e/src/specs/server/api/user-admin.e2e-spec.ts +++ b/e2e/src/specs/server/api/user-admin.e2e-spec.ts @@ -46,12 +46,6 @@ describe('/admin/users', () => { }); describe('GET /admin/users', () => { - it('should require authentication', async () => { - const { status, body } = await request(app).get(`/admin/users`); - expect(status).toBe(401); - expect(body).toEqual(errorDto.unauthorized); - }); - it('should require authorization', async () => { const { status, body } = await request(app) .get(`/admin/users`) @@ -94,12 +88,6 @@ describe('/admin/users', () => { }); describe('POST /admin/users', () => { - it('should require authentication', async () => { - const { status, body } = await request(app).post(`/admin/users`).send(createUserDto.user1); - expect(status).toBe(401); - expect(body).toEqual(errorDto.unauthorized); - }); - it('should require authorization', async () => { const { status, body } = await request(app) .post(`/admin/users`) @@ -109,23 +97,6 @@ describe('/admin/users', () => { expect(body).toEqual(errorDto.forbidden); }); - for (const [key, message] of [ - ['password', 'Invalid input: expected string, received null'], - ['email', 'Invalid input: expected email, received object'], - ['name', 'Invalid input: expected string, received null'], - ['shouldChangePassword', 'Invalid input: expected boolean, received null'], - ['notify', 'Invalid input: expected boolean, received null'], - ] as const) { - it(`should not allow null ${key}`, async () => { - const { status, body } = await request(app) - .post(`/admin/users`) - .set('Authorization', `Bearer ${admin.accessToken}`) - .send({ ...createUserDto.user1, [key]: null }); - expect(status).toBe(400); - expect(body).toEqual(errorDto.validationError([{ path: [key], message }])); - }); - } - it('should accept `isAdmin`', async () => { const { status, body } = await request(app) .post(`/admin/users`) @@ -146,12 +117,6 @@ describe('/admin/users', () => { }); describe('PUT /admin/users/:id', () => { - it('should require authentication', async () => { - const { status, body } = await request(app).put(`/admin/users/${uuidDto.notFound}`); - expect(status).toBe(401); - expect(body).toEqual(errorDto.unauthorized); - }); - it('should require authorization', async () => { const { status, body } = await request(app) .put(`/admin/users/${uuidDto.notFound}`) @@ -160,22 +125,6 @@ describe('/admin/users', () => { expect(body).toEqual(errorDto.forbidden); }); - for (const [key, message] of [ - ['password', 'Invalid input: expected string, received null'], - ['email', 'Invalid input: expected email, received object'], - ['name', 'Invalid input: expected string, received null'], - ['shouldChangePassword', 'Invalid input: expected boolean, received null'], - ] as const) { - it(`should not allow null ${key}`, async () => { - const { status, body } = await request(app) - .put(`/admin/users/${uuidDto.notFound}`) - .set('Authorization', `Bearer ${admin.accessToken}`) - .send({ [key]: null }); - expect(status).toBe(400); - expect(body).toEqual(errorDto.validationError([{ path: [key], message }])); - }); - } - it('should allow a non-admin to become an admin', async () => { const user = await utils.userSetup(admin.accessToken, createUserDto.create('admin2')); const { status, body } = await request(app) @@ -245,12 +194,6 @@ describe('/admin/users', () => { }); describe('PUT /admin/users/:id/preferences', () => { - it('should require authentication', async () => { - const { status, body } = await request(app).put(`/admin/users/${userToDelete.userId}/preferences`); - expect(status).toBe(401); - expect(body).toEqual(errorDto.unauthorized); - }); - it('should update memories enabled', async () => { const before = await getUserPreferencesAdmin({ id: admin.userId }, { headers: asBearerAuth(admin.accessToken) }); expect(before).toMatchObject({ memories: { enabled: true } }); @@ -282,12 +225,6 @@ describe('/admin/users', () => { }); describe('DELETE /admin/users/:id', () => { - it('should require authentication', async () => { - const { status, body } = await request(app).delete(`/admin/users/${userToDelete.userId}`); - expect(status).toBe(401); - expect(body).toEqual(errorDto.unauthorized); - }); - it('should require authorization', async () => { const { status, body } = await request(app) .delete(`/admin/users/${userToDelete.userId}`) @@ -360,12 +297,6 @@ describe('/admin/users', () => { }); describe('GET /admin/users/:id/calendar-heatmap', () => { - it('should require authentication', async () => { - const { status, body } = await request(app).get(`/admin/users/${nonAdmin.userId}/calendar-heatmap`); - expect(status).toBe(401); - expect(body).toEqual(errorDto.unauthorized); - }); - it('should require admin permissions', async () => { const { status, body } = await request(app) .get(`/admin/users/${nonAdmin.userId}/calendar-heatmap`) @@ -385,12 +316,6 @@ describe('/admin/users', () => { }); describe('POST /admin/users/:id/restore', () => { - it('should require authentication', async () => { - const { status, body } = await request(app).post(`/admin/users/${userToDelete.userId}/restore`); - expect(status).toBe(401); - expect(body).toEqual(errorDto.unauthorized); - }); - it('should require authorization', async () => { const { status, body } = await request(app) .post(`/admin/users/${userToDelete.userId}/restore`) diff --git a/e2e/src/specs/server/api/user.e2e-spec.ts b/e2e/src/specs/server/api/user.e2e-spec.ts index 2dc789a91b..2f270ca7ca 100644 --- a/e2e/src/specs/server/api/user.e2e-spec.ts +++ b/e2e/src/specs/server/api/user.e2e-spec.ts @@ -171,20 +171,6 @@ describe('/users', () => { expect(after).toMatchObject({ memories: { enabled: false } }); }); - it('should require an integer for download archive size', async () => { - const { status, body } = await request(app) - .put(`/users/me/preferences`) - .send({ download: { archiveSize: 1_234_567.89 } }) - .set('Authorization', `Bearer ${admin.accessToken}`); - - expect(status).toBe(400); - expect(body).toEqual( - errorDto.validationError([ - { path: ['download', 'archiveSize'], message: 'Invalid input: expected int, received number' }, - ]), - ); - }); - it('should update download archive size', async () => { const before = await getMyPreferences({ headers: asBearerAuth(admin.accessToken) }); expect(before).toMatchObject({ download: { archiveSize: 4 * 2 ** 30 } }); @@ -201,20 +187,6 @@ describe('/users', () => { expect(after).toMatchObject({ download: { archiveSize: 1_234_567 } }); }); - it('should require a boolean for download include embedded videos', async () => { - const { status, body } = await request(app) - .put(`/users/me/preferences`) - .send({ download: { includeEmbeddedVideos: 1_234_567.89 } }) - .set('Authorization', `Bearer ${admin.accessToken}`); - - expect(status).toBe(400); - expect(body).toEqual( - errorDto.validationError([ - { path: ['download', 'includeEmbeddedVideos'], message: 'Invalid input: expected boolean, received number' }, - ]), - ); - }); - it('should update download include embedded videos', async () => { const before = await getMyPreferences({ headers: asBearerAuth(admin.accessToken) }); expect(before).toMatchObject({ download: { includeEmbeddedVideos: false } }); @@ -318,11 +290,6 @@ describe('/users', () => { }); describe('DELETE /users/me/license', () => { - it('should require authentication', async () => { - const { status } = await request(app).put(`/users/me/license`); - expect(status).toEqual(401); - }); - it('should delete the user license', async () => { const { status } = await request(app) .delete(`/users/me/license`) diff --git a/server/src/controllers/activity.controller.spec.ts b/server/src/controllers/activity.controller.spec.ts index 0b677b83fa..899c7257d6 100644 --- a/server/src/controllers/activity.controller.spec.ts +++ b/server/src/controllers/activity.controller.spec.ts @@ -19,11 +19,6 @@ describe(ActivityController.name, () => { }); describe('GET /activities', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get('/activities'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should require an albumId', async () => { const { status, body } = await request(ctx.getHttpServer()).get('/activities'); expect(status).toEqual(400); @@ -50,11 +45,6 @@ describe(ActivityController.name, () => { }); describe('POST /activities', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).post('/activities'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should require an albumId', async () => { const { status, body } = await request(ctx.getHttpServer()) .post('/activities') @@ -77,11 +67,6 @@ describe(ActivityController.name, () => { }); describe('DELETE /activities/:id', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).delete(`/activities/${factory.uuid()}`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should require a valid uuid', async () => { const { status, body } = await request(ctx.getHttpServer()).delete(`/activities/123`); expect(status).toBe(400); diff --git a/server/src/controllers/album.controller.spec.ts b/server/src/controllers/album.controller.spec.ts index 2ab7b08ceb..239a602100 100644 --- a/server/src/controllers/album.controller.spec.ts +++ b/server/src/controllers/album.controller.spec.ts @@ -19,11 +19,6 @@ describe(AlbumController.name, () => { }); describe('GET /albums', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).post('/albums'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should reject an invalid shared param', async () => { const { status, body } = await request(ctx.getHttpServer()).get('/albums?isShared=invalid'); expect(status).toEqual(400); @@ -40,60 +35,4 @@ describe(AlbumController.name, () => { expect(body).toEqual(factory.responses.validationError([{ path: ['assetId'], message: 'Invalid UUID' }])); }); }); - - describe('GET /albums/:id', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get(`/albums/${factory.uuid()}`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); - - describe('GET /albums/statistics', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get('/albums/statistics'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); - - describe('POST /albums', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).post('/albums').send({ albumName: 'New album' }); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); - - describe('PUT /albums/:id/assets', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).put(`/albums/${factory.uuid()}/assets`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); - - describe('PUT /albums/assets', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).put(`/albums/assets`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); - - describe('PATCH /albums/:id', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).patch(`/albums/${factory.uuid()}`).send({ albumName: 'New album name' }); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); - - describe('DELETE /albums/:id/assets', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).delete(`/albums/${factory.uuid()}/assets`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); - - describe('PUT :id/users', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).put(`/albums/${factory.uuid()}/users`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); }); diff --git a/server/src/controllers/api-key.controller.spec.ts b/server/src/controllers/api-key.controller.spec.ts index 91a7c43a2d..08963362b6 100644 --- a/server/src/controllers/api-key.controller.spec.ts +++ b/server/src/controllers/api-key.controller.spec.ts @@ -19,33 +19,7 @@ describe(ApiKeyController.name, () => { ctx.reset(); }); - describe('POST /api-keys', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).post('/api-keys').send({ name: 'API Key' }); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); - - describe('GET /api-keys', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get('/api-keys'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); - - describe('GET /api-keys/me', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get(`/api-keys/me`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); - describe('GET /api-keys/:id', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get(`/api-keys/${factory.uuid()}`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should require a valid uuid', async () => { const { status, body } = await request(ctx.getHttpServer()).get(`/api-keys/123`); expect(status).toBe(400); @@ -54,11 +28,6 @@ describe(ApiKeyController.name, () => { }); describe('PUT /api-keys/:id', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).put(`/api-keys/${factory.uuid()}`).send({ name: 'new name' }); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should require a valid uuid', async () => { const { status, body } = await request(ctx.getHttpServer()) .put(`/api-keys/123`) @@ -76,11 +45,6 @@ describe(ApiKeyController.name, () => { }); describe('DELETE /api-keys/:id', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).delete(`/api-keys/${factory.uuid()}`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should require a valid uuid', async () => { const { status, body } = await request(ctx.getHttpServer()).delete(`/api-keys/123`); expect(status).toBe(400); diff --git a/server/src/controllers/asset-media.controller.spec.ts b/server/src/controllers/asset-media.controller.spec.ts index 668d88acbf..43d9a97780 100644 --- a/server/src/controllers/asset-media.controller.spec.ts +++ b/server/src/controllers/asset-media.controller.spec.ts @@ -44,11 +44,6 @@ describe(AssetMediaController.name, () => { }); describe('POST /assets', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).post(`/assets`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should accept metadata', async () => { const mobileMetadata = { key: AssetMetadataKey.MobileApp, value: { iCloudId: '123' } }; const { status } = await request(ctx.getHttpServer()) @@ -171,20 +166,9 @@ describe(AssetMediaController.name, () => { }); // TODO figure out how to deal with `sendFile` - describe.skip('GET /assets/:id/original', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get(`/assets/${factory.uuid()}/original`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); // TODO figure out how to deal with `sendFile` describe('GET /assets/:id/thumbnail', () => { - it.skip('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get(`/assets/${factory.uuid()}/thumbnail`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should redirect if size=original is requested', async () => { const { status } = await request(ctx.getHttpServer()).get(`/assets/${factory.uuid()}/thumbnail?size=original`); expect(status).toBe(302); diff --git a/server/src/controllers/asset.controller.spec.ts b/server/src/controllers/asset.controller.spec.ts index 8ee6995b1f..92710d6ffc 100644 --- a/server/src/controllers/asset.controller.spec.ts +++ b/server/src/controllers/asset.controller.spec.ts @@ -20,11 +20,6 @@ describe(AssetController.name, () => { }); describe('PUT /assets', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).put(`/assets`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should require a valid uuid', async () => { const { status, body } = await request(ctx.getHttpServer()) .put(`/assets`) @@ -59,13 +54,6 @@ describe(AssetController.name, () => { }); describe('DELETE /assets', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()) - .delete(`/assets`) - .send({ ids: [factory.uuid()] }); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should require a valid uuid', async () => { const { status, body } = await request(ctx.getHttpServer()) .delete(`/assets`) @@ -77,11 +65,6 @@ describe(AssetController.name, () => { }); describe('GET /assets/:id', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get(`/assets/${factory.uuid()}`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should require a valid id', async () => { const { status, body } = await request(ctx.getHttpServer()).get(`/assets/123`); expect(status).toBe(400); @@ -90,11 +73,6 @@ describe(AssetController.name, () => { }); describe('PUT /assets/copy', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get(`/assets/copy`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should require target and source id', async () => { const { status, body } = await request(ctx.getHttpServer()).put('/assets/copy').send({}); expect(status).toBe(400); @@ -115,11 +93,6 @@ describe(AssetController.name, () => { }); describe('PUT /assets/metadata', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).put(`/assets/metadata`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should require a valid assetId', async () => { const { status, body } = await request(ctx.getHttpServer()) .put('/assets/metadata') @@ -151,11 +124,6 @@ describe(AssetController.name, () => { }); describe('DELETE /assets/metadata', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).delete(`/assets/metadata`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should require a valid assetId', async () => { const { status, body } = await request(ctx.getHttpServer()) .delete('/assets/metadata') @@ -187,11 +155,6 @@ describe(AssetController.name, () => { }); describe('PUT /assets/:id', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get(`/assets/123`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should require a valid id', async () => { const { status, body } = await request(ctx.getHttpServer()).put(`/assets/123`); expect(status).toBe(400); @@ -267,26 +230,7 @@ describe(AssetController.name, () => { }); }); - describe('GET /assets/statistics', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get(`/assets/statistics`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); - - describe('GET /assets/:id/metadata', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get(`/assets/${factory.uuid()}/metadata`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); - describe('PUT /assets/:id/metadata', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).put(`/assets/${factory.uuid()}/metadata`).send({ items: [] }); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should require a valid id', async () => { const { status, body } = await request(ctx.getHttpServer()).put(`/assets/123/metadata`).send({ items: [] }); expect(status).toBe(400); @@ -353,11 +297,6 @@ describe(AssetController.name, () => { }); describe('GET /assets/:id/metadata/:key', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get(`/assets/${factory.uuid()}/metadata/mobile-app`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should require a valid id', async () => { const { status, body } = await request(ctx.getHttpServer()).get(`/assets/123/metadata/mobile-app`); expect(status).toBe(400); @@ -366,11 +305,6 @@ describe(AssetController.name, () => { }); describe('PUT /assets/:id/edits', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).put(`/assets/${factory.uuid()}/edits`).send({ edits: [] }); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should accept valid edits and pass to service correctly', async () => { const edits = [ { @@ -456,11 +390,6 @@ describe(AssetController.name, () => { }); describe('DELETE /assets/:id/metadata/:key', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).delete(`/assets/${factory.uuid()}/metadata/mobile-app`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should require a valid id', async () => { const { status, body } = await request(ctx.getHttpServer()).delete(`/assets/123/metadata/mobile-app`); expect(status).toBe(400); diff --git a/server/src/controllers/auth.controller.spec.ts b/server/src/controllers/auth.controller.spec.ts index 3bf1d59f8b..832547776d 100644 --- a/server/src/controllers/auth.controller.spec.ts +++ b/server/src/controllers/auth.controller.spec.ts @@ -199,28 +199,7 @@ describe(AuthController.name, () => { }); }); - describe('POST /auth/logout', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).post('/auth/logout'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); - - describe('POST /auth/change-password', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()) - .post('/auth/change-password') - .send({ password: 'password', newPassword: 'Password1234', invalidateSessions: false }); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); - describe('POST /auth/pin-code', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).post('/auth/pin-code').send({ pinCode: '123456' }); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should reject 5 digits', async () => { const { status, body } = await request(ctx.getHttpServer()).post('/auth/pin-code').send({ pinCode: '12345' }); expect(status).toEqual(400); @@ -251,25 +230,4 @@ describe(AuthController.name, () => { ); }); }); - - describe('PUT /auth/pin-code', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).put('/auth/pin-code').send({ pinCode: '123456', newPinCode: '654321' }); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); - - describe('DELETE /auth/pin-code', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).delete('/auth/pin-code').send({ pinCode: '123456' }); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); - - describe('GET /auth/status', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get('/auth/status'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); }); diff --git a/server/src/controllers/database-backup.controller.spec.ts b/server/src/controllers/database-backup.controller.spec.ts index 43fa779e8d..57a7ecc310 100644 --- a/server/src/controllers/database-backup.controller.spec.ts +++ b/server/src/controllers/database-backup.controller.spec.ts @@ -25,13 +25,6 @@ describe(DatabaseBackupController.name, () => { ctx.reset(); }); - describe('GET /admin/database-backups', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get('/admin/database-backups').send(); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); - describe('POST /admin/database-backups/start-restore', () => { it('should not be an authenticated route', async () => { maintenanceService.startRestoreFlow.mockResolvedValue({ jwt: 'jwt' }); diff --git a/server/src/controllers/download.controller.spec.ts b/server/src/controllers/download.controller.spec.ts deleted file mode 100644 index f42afe8c50..0000000000 --- a/server/src/controllers/download.controller.spec.ts +++ /dev/null @@ -1,48 +0,0 @@ -import { Readable } from 'node:stream'; -import { DownloadController } from 'src/controllers/download.controller'; -import { DownloadService } from 'src/services/download.service'; -import request from 'supertest'; -import { factory } from 'test/small.factory'; -import { ControllerContext, controllerSetup, mockBaseService } from 'test/utils'; - -describe(DownloadController.name, () => { - let ctx: ControllerContext; - const service = mockBaseService(DownloadService); - - beforeAll(async () => { - ctx = await controllerSetup(DownloadController, [{ provide: DownloadService, useValue: service }]); - return () => ctx.close(); - }); - - beforeEach(() => { - service.resetAllMocks(); - ctx.reset(); - }); - - describe('POST /download/info', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()) - .post('/download/info') - .send({ assetIds: [factory.uuid()] }); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); - - describe('POST /download/archive', () => { - it('should be an authenticated route', async () => { - const stream = new Readable({ - read() { - // eslint-disable-next-line unicorn/no-this-outside-of-class - this.push('test'); - // eslint-disable-next-line unicorn/no-this-outside-of-class - this.push(null); - }, - }); - service.downloadArchive.mockResolvedValue({ stream }); - await request(ctx.getHttpServer()) - .post('/download/archive') - .send({ assetIds: [factory.uuid()] }); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); -}); diff --git a/server/src/controllers/duplicate.controller.spec.ts b/server/src/controllers/duplicate.controller.spec.ts index 7bbafb4665..c8ca0e5793 100644 --- a/server/src/controllers/duplicate.controller.spec.ts +++ b/server/src/controllers/duplicate.controller.spec.ts @@ -18,26 +18,7 @@ describe(DuplicateController.name, () => { ctx.reset(); }); - describe('GET /duplicates', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get('/duplicates'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); - - describe('DELETE /duplicates', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).delete('/duplicates'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); - describe('DELETE /duplicates/:id', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).delete(`/duplicates/${factory.uuid()}`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should require a valid uuid', async () => { const { status, body } = await request(ctx.getHttpServer()).delete(`/duplicates/123`); expect(status).toBe(400); diff --git a/server/src/controllers/maintenance.controller.spec.ts b/server/src/controllers/maintenance.controller.spec.ts index 630bb7c8b8..59b00b8aec 100644 --- a/server/src/controllers/maintenance.controller.spec.ts +++ b/server/src/controllers/maintenance.controller.spec.ts @@ -20,11 +20,6 @@ describe(MaintenanceController.name, () => { }); describe('POST /admin/maintenance', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).post('/admin/maintenance').send(); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should require a backup file when action is restore', async () => { const { status, body } = await request(ctx.getHttpServer()).post('/admin/maintenance').send({ action: MaintenanceAction.RestoreDatabase, diff --git a/server/src/controllers/memory.controller.spec.ts b/server/src/controllers/memory.controller.spec.ts index a3839793eb..b717ee966c 100644 --- a/server/src/controllers/memory.controller.spec.ts +++ b/server/src/controllers/memory.controller.spec.ts @@ -20,11 +20,6 @@ describe(MemoryController.name, () => { }); describe('GET /memories', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get('/memories'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should not require any parameters', async () => { await request(ctx.getHttpServer()).get('/memories').query({}); expect(service.search).toHaveBeenCalled(); @@ -32,11 +27,6 @@ describe(MemoryController.name, () => { }); describe('POST /memories', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).post('/memories'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should validate data when type is on this day', async () => { const { status, body } = await request(ctx.getHttpServer()) .post('/memories') @@ -69,19 +59,7 @@ describe(MemoryController.name, () => { }); }); - describe('GET /memories/statistics', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get('/memories/statistics'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); - describe('GET /memories/:id', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get(`/memories/${factory.uuid()}`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should require a valid id', async () => { const { status, body } = await request(ctx.getHttpServer()).get(`/memories/invalid`); expect(status).toBe(400); @@ -90,11 +68,6 @@ describe(MemoryController.name, () => { }); describe('PUT /memories/:id', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).put(`/memories/${factory.uuid()}`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should require a valid id', async () => { const { status, body } = await request(ctx.getHttpServer()).put(`/memories/invalid`); expect(status).toBe(400); @@ -114,19 +87,7 @@ describe(MemoryController.name, () => { }); }); - describe('DELETE /memories/:id', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).delete(`/memories/${factory.uuid()}`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); - describe('PUT /memories/:id/assets', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).put(`/memories/${factory.uuid()}/assets`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should require a valid id', async () => { const { status, body } = await request(ctx.getHttpServer()).put(`/memories/invalid/assets`).send({ ids: [] }); expect(status).toBe(400); @@ -143,11 +104,6 @@ describe(MemoryController.name, () => { }); describe('DELETE /memories/:id/assets', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).delete(`/memories/${factory.uuid()}/assets`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should require a valid id', async () => { const { status, body } = await request(ctx.getHttpServer()).delete(`/memories/invalid/assets`); expect(status).toBe(400); diff --git a/server/src/controllers/notification-admin.controller.spec.ts b/server/src/controllers/notification-admin.controller.spec.ts index b93726eb32..e440f5bcf6 100644 --- a/server/src/controllers/notification-admin.controller.spec.ts +++ b/server/src/controllers/notification-admin.controller.spec.ts @@ -21,11 +21,6 @@ describe(NotificationAdminController.name, () => { }); describe('POST /admin/notifications', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).post('/admin/notifications'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should accept a null readAt', async () => { await request(ctx.getHttpServer()) .post(`/admin/notifications`) diff --git a/server/src/controllers/notification.controller.spec.ts b/server/src/controllers/notification.controller.spec.ts index 1759e13404..f65537cbba 100644 --- a/server/src/controllers/notification.controller.spec.ts +++ b/server/src/controllers/notification.controller.spec.ts @@ -20,11 +20,6 @@ describe(NotificationController.name, () => { }); describe('GET /notifications', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get('/notifications'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it(`should reject an invalid notification level`, async () => { const { status, body } = await request(ctx.getHttpServer()) .get(`/notifications`) @@ -40,11 +35,6 @@ describe(NotificationController.name, () => { }); describe('PUT /notifications', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).put('/notifications'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - describe('ids', () => { it('should require a list', async () => { const { status, body } = await request(ctx.getHttpServer()).put(`/notifications`).send({ ids: true }); @@ -75,11 +65,6 @@ describe(NotificationController.name, () => { }); describe('GET /notifications/:id', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get(`/notifications/${factory.uuid()}`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should require a valid uuid', async () => { const { status, body } = await request(ctx.getHttpServer()).get(`/notifications/123`); expect(status).toBe(400); @@ -88,11 +73,6 @@ describe(NotificationController.name, () => { }); describe('PUT /notifications/:id', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).put(`/notifications/${factory.uuid()}`).send({ readAt: factory.date() }); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should accept a null readAt', async () => { const id = factory.uuid(); await request(ctx.getHttpServer()).put(`/notifications/${id}`).send({ readAt: null }); diff --git a/server/src/controllers/partner.controller.spec.ts b/server/src/controllers/partner.controller.spec.ts index d6541411b8..38cb717bea 100644 --- a/server/src/controllers/partner.controller.spec.ts +++ b/server/src/controllers/partner.controller.spec.ts @@ -3,7 +3,6 @@ import { LoggingRepository } from 'src/repositories/logging.repository'; import { PartnerService } from 'src/services/partner.service'; import request from 'supertest'; import { errorDto } from 'test/medium/responses'; -import { factory } from 'test/small.factory'; import { automock, ControllerContext, controllerSetup, mockBaseService } from 'test/utils'; describe(PartnerController.name, () => { @@ -24,11 +23,6 @@ describe(PartnerController.name, () => { }); describe('GET /partners', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get('/partners'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it(`should require a direction`, async () => { const { status, body } = await request(ctx.getHttpServer()).get(`/partners`).set('Authorization', `Bearer token`); expect(status).toBe(400); @@ -54,11 +48,6 @@ describe(PartnerController.name, () => { }); describe('POST /partners', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).post('/partners'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it(`should require sharedWithId to be a uuid`, async () => { const { status, body } = await request(ctx.getHttpServer()) .post(`/partners`) @@ -70,11 +59,6 @@ describe(PartnerController.name, () => { }); describe('PUT /partners/:id', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).put(`/partners/${factory.uuid()}`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it(`should require id to be a uuid`, async () => { const { status, body } = await request(ctx.getHttpServer()) .put(`/partners/invalid`) @@ -86,11 +70,6 @@ describe(PartnerController.name, () => { }); describe('DELETE /partners/:id', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).delete(`/partners/${factory.uuid()}`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it(`should require id to be a uuid`, async () => { const { status, body } = await request(ctx.getHttpServer()) .delete(`/partners/invalid`) diff --git a/server/src/controllers/person.controller.spec.ts b/server/src/controllers/person.controller.spec.ts index 64fe4f3554..0d3d3eea4a 100644 --- a/server/src/controllers/person.controller.spec.ts +++ b/server/src/controllers/person.controller.spec.ts @@ -24,11 +24,6 @@ describe(PersonController.name, () => { }); describe('GET /people', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get('/people'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it(`should require closestPersonId to be a uuid`, async () => { const { status, body } = await request(ctx.getHttpServer()) .get(`/people`) @@ -48,19 +43,7 @@ describe(PersonController.name, () => { }); }); - describe('POST /people', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).post('/people'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); - describe('DELETE /people', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).delete('/people'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should require uuids in the body', async () => { const { status, body } = await request(ctx.getHttpServer()) .delete('/people') @@ -78,19 +61,7 @@ describe(PersonController.name, () => { }); }); - describe('GET /people/:id', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get(`/people/${factory.uuid()}`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); - describe('PUT /people/:id', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get(`/people/${factory.uuid()}`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should require a valid uuid', async () => { const { status, body } = await request(ctx.getHttpServer()).put(`/people/123`); expect(status).toBe(400); @@ -177,11 +148,6 @@ describe(PersonController.name, () => { }); describe('DELETE /people/:id', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).delete(`/people/${factory.uuid()}`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should require a valid uuid', async () => { const { status, body } = await request(ctx.getHttpServer()).delete(`/people/invalid`); expect(status).toBe(400); @@ -194,18 +160,4 @@ describe(PersonController.name, () => { expect(service.delete).toHaveBeenCalled(); }); }); - - describe('POST /people/:id/merge', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).post(`/people/${factory.uuid()}/merge`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); - - describe('GET /people/:id/statistics', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get(`/people/${factory.uuid()}/statistics`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); }); diff --git a/server/src/controllers/plugin.controller.spec.ts b/server/src/controllers/plugin.controller.spec.ts index 881a7dd953..bc42a4f75b 100644 --- a/server/src/controllers/plugin.controller.spec.ts +++ b/server/src/controllers/plugin.controller.spec.ts @@ -3,7 +3,6 @@ import { LoggingRepository } from 'src/repositories/logging.repository'; import { PluginService } from 'src/services/plugin.service'; import request from 'supertest'; import { errorDto } from 'test/medium/responses'; -import { factory } from 'test/small.factory'; import { automock, ControllerContext, controllerSetup, mockBaseService } from 'test/utils'; describe(PluginController.name, () => { @@ -24,11 +23,6 @@ describe(PluginController.name, () => { }); describe('GET /plugins', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get('/plugins'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it(`should require id to be a uuid`, async () => { const { status, body } = await request(ctx.getHttpServer()) .get(`/plugins`) @@ -40,11 +34,6 @@ describe(PluginController.name, () => { }); describe('GET /plugins/:id', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get(`/plugins/${factory.uuid()}`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it(`should require id to be a uuid`, async () => { const { status, body } = await request(ctx.getHttpServer()) .get(`/plugins/invalid`) diff --git a/server/src/controllers/search.controller.spec.ts b/server/src/controllers/search.controller.spec.ts index a1fed4c7ae..f1ac01ed41 100644 --- a/server/src/controllers/search.controller.spec.ts +++ b/server/src/controllers/search.controller.spec.ts @@ -19,11 +19,6 @@ describe(SearchController.name, () => { }); describe('POST /search/metadata', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).post('/search/metadata'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should reject page as a string', async () => { const { status, body } = await request(ctx.getHttpServer()).post('/search/metadata').send({ page: 'abc' }); expect(status).toBe(400); @@ -121,11 +116,6 @@ describe(SearchController.name, () => { }); describe('POST /search/random', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).post('/search/random'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should reject if withStacked is not a boolean', async () => { const { status, body } = await request(ctx.getHttpServer()) .post('/search/random') @@ -151,26 +141,7 @@ describe(SearchController.name, () => { }); }); - describe('POST /search/smart', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).post('/search/smart'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); - - describe('GET /search/explore', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get('/search/explore'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); - describe('POST /search/person', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get('/search/person'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should require a name', async () => { const { status, body } = await request(ctx.getHttpServer()).get('/search/person').send({}); expect(status).toBe(400); @@ -181,11 +152,6 @@ describe(SearchController.name, () => { }); describe('GET /search/places', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get('/search/places'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should require a name', async () => { const { status, body } = await request(ctx.getHttpServer()).get('/search/places').send({}); expect(status).toBe(400); @@ -195,19 +161,7 @@ describe(SearchController.name, () => { }); }); - describe('GET /search/cities', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get('/search/cities'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); - describe('GET /search/suggestions', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get('/search/suggestions'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should require a type', async () => { const { status, body } = await request(ctx.getHttpServer()).get('/search/suggestions').send({}); expect(status).toBe(400); diff --git a/server/src/controllers/server.controller.spec.ts b/server/src/controllers/server.controller.spec.ts deleted file mode 100644 index 6b00490d28..0000000000 --- a/server/src/controllers/server.controller.spec.ts +++ /dev/null @@ -1,35 +0,0 @@ -import { ServerController } from 'src/controllers/server.controller'; -import { ServerService } from 'src/services/server.service'; -import { SystemMetadataService } from 'src/services/system-metadata.service'; -import { VersionService } from 'src/services/version.service'; -import request from 'supertest'; -import { ControllerContext, controllerSetup, mockBaseService } from 'test/utils'; - -describe(ServerController.name, () => { - let ctx: ControllerContext; - const serverService = mockBaseService(ServerService); - const systemMetadataService = mockBaseService(SystemMetadataService); - const versionService = mockBaseService(VersionService); - - beforeAll(async () => { - ctx = await controllerSetup(ServerController, [ - { provide: ServerService, useValue: serverService }, - { provide: SystemMetadataService, useValue: systemMetadataService }, - { provide: VersionService, useValue: versionService }, - ]); - return () => ctx.close(); - }); - - beforeEach(() => { - serverService.resetAllMocks(); - versionService.resetAllMocks(); - ctx.reset(); - }); - - describe('GET /server/license', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get('/server/license'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); -}); diff --git a/server/src/controllers/shared-link.controller.spec.ts b/server/src/controllers/shared-link.controller.spec.ts index d8b89d0029..dc069ad267 100644 --- a/server/src/controllers/shared-link.controller.spec.ts +++ b/server/src/controllers/shared-link.controller.spec.ts @@ -2,6 +2,7 @@ import { SharedLinkController } from 'src/controllers/shared-link.controller'; import { Permission, SharedLinkType } from 'src/enum'; import { SharedLinkService } from 'src/services/shared-link.service'; import request from 'supertest'; +import { errorDto } from 'test/medium/responses'; import { factory } from 'test/small.factory'; import { ControllerContext, controllerSetup, mockBaseService } from 'test/utils'; @@ -19,10 +20,24 @@ describe(SharedLinkController.name, () => { ctx.reset(); }); + describe('GET /shared-links/me', () => { + it('should be a shared link route', async () => { + await request(ctx.getHttpServer()).get('/shared-links/me'); + expect(ctx.authenticate).toHaveBeenCalledWith( + expect.objectContaining({ metadata: expect.objectContaining({ sharedLinkRoute: true }) }), + ); + }); + }); + describe('POST /shared-links', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).post('/shared-links'); - expect(ctx.authenticate).toHaveBeenCalled(); + it('should require a type and the correspondent asset/album id', async () => { + const { status, body } = await request(ctx.getHttpServer()) + .post('/shared-links') + .set('Authorization', `Bearer token`); + expect(status).toBe(400); + expect(body).toEqual( + errorDto.validationError([{ path: [], message: 'Invalid input: expected object, received undefined' }]), + ); }); it('should allow an null expiresAt', async () => { diff --git a/server/src/controllers/stack.controller.spec.ts b/server/src/controllers/stack.controller.spec.ts new file mode 100644 index 0000000000..bc9c87da14 --- /dev/null +++ b/server/src/controllers/stack.controller.spec.ts @@ -0,0 +1,46 @@ +import { StackController } from 'src/controllers/stack.controller'; +import { StackService } from 'src/services/stack.service'; +import request from 'supertest'; +import { errorDto } from 'test/medium/responses'; +import { factory } from 'test/small.factory'; +import { ControllerContext, controllerSetup, mockBaseService } from 'test/utils'; + +describe(StackController.name, () => { + let ctx: ControllerContext; + const service = mockBaseService(StackService); + + beforeAll(async () => { + ctx = await controllerSetup(StackController, [{ provide: StackService, useValue: service }]); + return () => ctx.close(); + }); + + beforeEach(() => { + service.resetAllMocks(); + ctx.reset(); + }); + + describe('POST /stacks', () => { + it('should require at least two assets', async () => { + const { status, body } = await request(ctx.getHttpServer()) + .post('/stacks') + .send({ assetIds: [factory.uuid()] }); + expect(status).toBe(400); + expect(body).toEqual( + errorDto.validationError([{ path: ['assetIds'], message: 'Too small: expected array to have >=2 items' }]), + ); + }); + + it('should require a valid id', async () => { + const { status, body } = await request(ctx.getHttpServer()) + .post('/stacks') + .send({ assetIds: ['invalid', 'invalid'] }); + expect(status).toBe(400); + expect(body).toEqual( + errorDto.validationError([ + { path: ['assetIds', 0], message: 'Invalid UUID' }, + { path: ['assetIds', 1], message: 'Invalid UUID' }, + ]), + ); + }); + }); +}); diff --git a/server/src/controllers/sync.controller.spec.ts b/server/src/controllers/sync.controller.spec.ts index cae7650d9a..1f2c0f137a 100644 --- a/server/src/controllers/sync.controller.spec.ts +++ b/server/src/controllers/sync.controller.spec.ts @@ -25,11 +25,6 @@ describe(SyncController.name, () => { }); describe('POST /sync/stream', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).post('/sync/stream'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should require sync request type enums', async () => { const { status, body } = await request(ctx.getHttpServer()) .post('/sync/stream') @@ -44,19 +39,7 @@ describe(SyncController.name, () => { }); }); - describe('GET /sync/ack', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get('/sync/ack'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); - describe('POST /sync/ack', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).post('/sync/ack'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should not allow more than 1,000 entries', async () => { const acks = Array.from({ length: 1001 }, (_, i) => `ack-${i}`); const { status, body } = await request(ctx.getHttpServer()).post('/sync/ack').send({ acks }); @@ -69,11 +52,6 @@ describe(SyncController.name, () => { }); describe('DELETE /sync/ack', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).delete('/sync/ack'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should require sync response type enums', async () => { const { status, body } = await request(ctx.getHttpServer()) .delete('/sync/ack') diff --git a/server/src/controllers/system-config.controller.spec.ts b/server/src/controllers/system-config.controller.spec.ts index 439b5ddec1..7d40f12583 100644 --- a/server/src/controllers/system-config.controller.spec.ts +++ b/server/src/controllers/system-config.controller.spec.ts @@ -40,26 +40,7 @@ describe(SystemConfigController.name, () => { ctx.reset(); }); - describe('GET /system-config', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get('/system-config'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); - - describe('GET /system-config/defaults', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get('/system-config/defaults'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); - describe('PUT /system-config', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).put('/system-config'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - describe('nightlyTasks', () => { it('should validate nightly jobs start time', async () => { const config = validConfig(); diff --git a/server/src/controllers/tag.controller.spec.ts b/server/src/controllers/tag.controller.spec.ts index c2a2de95bd..a89ce14dda 100644 --- a/server/src/controllers/tag.controller.spec.ts +++ b/server/src/controllers/tag.controller.spec.ts @@ -2,7 +2,6 @@ import { TagController } from 'src/controllers/tag.controller'; import { TagService } from 'src/services/tag.service'; import request from 'supertest'; import { errorDto } from 'test/medium/responses'; -import { factory } from 'test/small.factory'; import { ControllerContext, controllerSetup, mockBaseService } from 'test/utils'; describe(TagController.name, () => { @@ -19,38 +18,14 @@ describe(TagController.name, () => { ctx.reset(); }); - describe('GET /tags', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get('/tags'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); - describe('POST /tags', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).post('/tags'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should a null parentId', async () => { await request(ctx.getHttpServer()).post(`/tags`).send({ name: 'tag', parentId: null }); expect(service.create).toHaveBeenCalledWith(undefined, expect.objectContaining({ parentId: null })); }); }); - describe('PUT /tags', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).put('/tags'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); - describe('GET /tags/:id', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get(`/tags/${factory.uuid()}`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should require a valid uuid', async () => { const { status, body } = await request(ctx.getHttpServer()).get(`/tags/123`); expect(status).toBe(400); @@ -58,10 +33,11 @@ describe(TagController.name, () => { }); }); - describe('PUT /tags/:id', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).put(`/tags/${factory.uuid()}`); - expect(ctx.authenticate).toHaveBeenCalled(); + describe('DELETE /tags/:id', () => { + it('should require a valid uuid', async () => { + const { status, body } = await request(ctx.getHttpServer()).delete(`/tags/123`); + expect(status).toBe(400); + expect(body).toEqual(errorDto.validationError([{ path: ['id'], message: 'Invalid UUID' }])); }); }); }); diff --git a/server/src/controllers/timeline.controller.spec.ts b/server/src/controllers/timeline.controller.spec.ts index ff18c020c1..288945ee97 100644 --- a/server/src/controllers/timeline.controller.spec.ts +++ b/server/src/controllers/timeline.controller.spec.ts @@ -19,11 +19,6 @@ describe(TimelineController.name, () => { }); describe('GET /timeline/buckets', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get('/timeline/buckets'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should parse bbox query string into an object', async () => { const { status } = await request(ctx.getHttpServer()) .get('/timeline/buckets') @@ -58,11 +53,6 @@ describe(TimelineController.name, () => { }); describe('GET /timeline/bucket', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get('/timeline/bucket?timeBucket=1900-01-01'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - // TODO enable date string validation while still accepting 5 digit years it.fails('should fail if time bucket is invalid', async () => { const { status, body } = await request(ctx.getHttpServer()).get('/timeline/bucket').query({ timeBucket: 'foo' }); diff --git a/server/src/controllers/user-admin.controller.spec.ts b/server/src/controllers/user-admin.controller.spec.ts index b5840a33e1..3fa423f9b3 100644 --- a/server/src/controllers/user-admin.controller.spec.ts +++ b/server/src/controllers/user-admin.controller.spec.ts @@ -24,26 +24,7 @@ describe(UserAdminController.name, () => { ctx.reset(); }); - describe('GET /admin/users', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get('/admin/users'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); - - describe('PUT /admin/users/:id', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).put(`/admin/users/${factory.uuid()}`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); - describe('POST /admin/users', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).post('/admin/users'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it('should allow a null pinCode', async () => { await request(ctx.getHttpServer()).post(`/admin/users`).send({ name: 'Test user', @@ -64,25 +45,22 @@ describe(UserAdminController.name, () => { expect(service.create).toHaveBeenCalledWith(expect.objectContaining({ avatarColor: null })); }); - it(`should `, async () => { - const dto: UserAdminCreateDto = { - email: 'user@immich.app', - password: 'test', - name: 'Test User', - quotaSizeInBytes: 1.2, - }; - - const { status, body } = await request(ctx.getHttpServer()) - .post(`/admin/users`) - .set('Authorization', `Bearer token`) - .send(dto); - expect(status).toBe(400); - expect(body).toEqual( - errorDto.validationError([ - { path: ['quotaSizeInBytes'], message: 'Invalid input: expected int, received number' }, - ]), - ); - }); + for (const [key, message] of [ + ['password', 'Invalid input: expected string, received null'], + ['email', 'Invalid input: expected email, received object'], + ['name', 'Invalid input: expected string, received null'], + ['shouldChangePassword', 'Invalid input: expected boolean, received null'], + ['notify', 'Invalid input: expected boolean, received null'], + ] as const) { + it(`should not allow null ${key}`, async () => { + const { status, body } = await request(ctx.getHttpServer()) + .post(`/admin/users`) + .set('Authorization', `Bearer token`) + .send({ email: 'user@immich.app', password: 'test', name: 'Test User', [key]: null }); + expect(status).toBe(400); + expect(body).toEqual(errorDto.validationError([{ path: [key], message }])); + }); + } it(`should not allow decimal quota`, async () => { const dto: UserAdminCreateDto = { @@ -105,19 +83,7 @@ describe(UserAdminController.name, () => { }); }); - describe('GET /admin/users/:id', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get(`/admin/users/${factory.uuid()}`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); - describe('PUT /admin/users/:id', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).put(`/admin/users/${factory.uuid()}`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it(`should not allow decimal quota`, async () => { const { status, body } = await request(ctx.getHttpServer()) .put(`/admin/users/${factory.uuid()}`) @@ -142,5 +108,21 @@ describe(UserAdminController.name, () => { await request(ctx.getHttpServer()).put(`/admin/users/${id}`).send({ avatarColor: null }); expect(service.update).toHaveBeenCalledWith(undefined, id, expect.objectContaining({ avatarColor: null })); }); + + for (const [key, message] of [ + ['password', 'Invalid input: expected string, received null'], + ['email', 'Invalid input: expected email, received object'], + ['name', 'Invalid input: expected string, received null'], + ['shouldChangePassword', 'Invalid input: expected boolean, received null'], + ] as const) { + it(`should not allow null ${key}`, async () => { + const { status, body } = await request(ctx.getHttpServer()) + .put(`/admin/users/${factory.uuid()}`) + .set('Authorization', `Bearer token`) + .send({ [key]: null }); + expect(status).toBe(400); + expect(body).toEqual(errorDto.validationError([{ path: [key], message }])); + }); + } }); }); diff --git a/server/src/controllers/user.controller.spec.ts b/server/src/controllers/user.controller.spec.ts index f512e2de39..d15eda31dc 100644 --- a/server/src/controllers/user.controller.spec.ts +++ b/server/src/controllers/user.controller.spec.ts @@ -3,7 +3,6 @@ import { LoggingRepository } from 'src/repositories/logging.repository'; import { UserService } from 'src/services/user.service'; import request from 'supertest'; import { errorDto } from 'test/medium/responses'; -import { factory } from 'test/small.factory'; import { automock, ControllerContext, controllerSetup, mockBaseService } from 'test/utils'; describe(UserController.name, () => { @@ -23,26 +22,7 @@ describe(UserController.name, () => { ctx.reset(); }); - describe('GET /users', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get('/users'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); - - describe('GET /users/me', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get('/users/me'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); - describe('PUT /users/me', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).put('/users/me'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - for (const [key, message] of [ ['email', 'Invalid input: expected email, received object'], ['name', 'Invalid input: expected string, received null'], @@ -66,24 +46,31 @@ describe(UserController.name, () => { }); }); - describe('GET /users/:id', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get(`/users/${factory.uuid()}`); - expect(ctx.authenticate).toHaveBeenCalled(); + describe('PUT /users/me/preferences', () => { + it('should require an integer for download archive size', async () => { + const { status, body } = await request(ctx.getHttpServer()) + .put(`/users/me/preferences`) + .set('Authorization', `Bearer token`) + .send({ download: { archiveSize: 1_234_567.89 } }); + expect(status).toBe(400); + expect(body).toEqual( + errorDto.validationError([ + { path: ['download', 'archiveSize'], message: 'Invalid input: expected int, received number' }, + ]), + ); }); - }); - describe('PUT /users/me/license', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).put('/users/me/license'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - }); - - describe('DELETE /users/me/license', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).delete('/users/me/license'); - expect(ctx.authenticate).toHaveBeenCalled(); + it('should require a boolean for download include embedded videos', async () => { + const { status, body } = await request(ctx.getHttpServer()) + .put(`/users/me/preferences`) + .set('Authorization', `Bearer token`) + .send({ download: { includeEmbeddedVideos: 1_234_567.89 } }); + expect(status).toBe(400); + expect(body).toEqual( + errorDto.validationError([ + { path: ['download', 'includeEmbeddedVideos'], message: 'Invalid input: expected boolean, received number' }, + ]), + ); }); }); }); diff --git a/server/src/controllers/workflow.controller.spec.ts b/server/src/controllers/workflow.controller.spec.ts index ad0dc4982d..0b91667671 100644 --- a/server/src/controllers/workflow.controller.spec.ts +++ b/server/src/controllers/workflow.controller.spec.ts @@ -4,7 +4,6 @@ import { LoggingRepository } from 'src/repositories/logging.repository'; import { WorkflowService } from 'src/services/workflow.service'; import request from 'supertest'; import { errorDto } from 'test/medium/responses'; -import { factory } from 'test/small.factory'; import { automock, ControllerContext, controllerSetup, mockBaseService } from 'test/utils'; describe(WorkflowController.name, () => { @@ -25,11 +24,6 @@ describe(WorkflowController.name, () => { }); describe('POST /workflows', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).post('/workflows').send({}); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it(`should require a valid trigger`, async () => { const { status, body } = await request(ctx.getHttpServer()) .post(`/workflows`) @@ -65,11 +59,6 @@ describe(WorkflowController.name, () => { }); describe('GET /workflows', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get('/workflows'); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it(`should require id to be a uuid`, async () => { const { status, body } = await request(ctx.getHttpServer()) .get(`/workflows`) @@ -81,11 +70,6 @@ describe(WorkflowController.name, () => { }); describe('GET /workflows/:id', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).get(`/workflows/${factory.uuid()}`); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it(`should require id to be a uuid`, async () => { const { status, body } = await request(ctx.getHttpServer()) .get(`/workflows/invalid`) @@ -96,11 +80,6 @@ describe(WorkflowController.name, () => { }); describe('PATCH /workflows/:id', () => { - it('should be an authenticated route', async () => { - await request(ctx.getHttpServer()).patch(`/workflows/${factory.uuid()}`).send({}); - expect(ctx.authenticate).toHaveBeenCalled(); - }); - it(`should require id to be a uuid`, async () => { const { status, body } = await request(ctx.getHttpServer()) .patch(`/workflows/invalid`)