juice-shop

1
/*
2
 * Copyright (c) 2014-2024 Bjoern Kimminich & the OWASP Juice Shop contributors.
3
 * SPDX-License-Identifier: MIT
4
 */
5

6
import frisby = require('frisby')
7
import { expect } from '@jest/globals'
8
import config from 'config'
9

10
const jsonHeader = { 'content-type': 'application/json' }
11
const REST_URL = 'http://localhost:3000/rest'
12

13
describe('/rest/order-history', () => {
14
  it('GET own previous orders', () => {
15
    return frisby.post(REST_URL + '/user/login', {
16
      headers: jsonHeader,
17
      body: {
18
        email: 'admin@' + config.get<string>('application.domain'),
19
        password: 'admin123'
20
      }
21
    })
22
      .expect('status', 200)
23
      .then(({ json: jsonLogin }) => {
24
        return frisby.get(REST_URL + '/order-history', {
25
          headers: { Authorization: 'Bearer ' + jsonLogin.authentication.token, 'content-type': 'application/json' }
26
        })
27
          .expect('status', 200)
28
          .then(({ json }) => {
29
            expect(json.data[0].totalPrice).toBe(8.96)
30
            expect(json.data[0].delivered).toBe(false)
31
            expect(json.data[0].products[0].quantity).toBe(3)
32
            expect(json.data[0].products[0].name).toBe('Apple Juice (1000ml)')
33
            expect(json.data[0].products[0].price).toBe(1.99)
34
            expect(json.data[0].products[0].total).toBe(5.97)
35
            expect(json.data[0].products[1].quantity).toBe(1)
36
            expect(json.data[0].products[1].name).toBe('Orange Juice (1000ml)')
37
            expect(json.data[0].products[1].price).toBe(2.99)
38
            expect(json.data[0].products[1].total).toBe(2.99)
39
            expect(json.data[1].totalPrice).toBe(26.97)
40
            expect(json.data[1].delivered).toBe(true)
41
            expect(json.data[1].products[0].quantity).toBe(3)
42
            expect(json.data[1].products[0].name).toBe('Eggfruit Juice (500ml)')
43
            expect(json.data[1].products[0].price).toBe(8.99)
44
            expect(json.data[1].products[0].total).toBe(26.97)
45
          })
46
      })
47
  })
48
})
49

50
describe('/rest/order-history/orders', () => {
51
  it('GET all orders is forbidden for customers', () => {
52
    return frisby.post(REST_URL + '/user/login', {
53
      headers: jsonHeader,
54
      body: {
55
        email: 'jim@' + config.get<string>('application.domain'),
56
        password: 'ncc-1701'
57
      }
58
    })
59
      .expect('status', 200)
60
      .then(({ json: jsonLogin }) => {
61
        return frisby.get(REST_URL + '/order-history/orders', {
62
          headers: { Authorization: 'Bearer ' + jsonLogin.authentication.token, 'content-type': 'application/json' }
63
        })
64
          .expect('status', 403)
65
      })
66
  })
67

68
  it('GET all orders is forbidden for admin', () => {
69
    return frisby.post(REST_URL + '/user/login', {
70
      headers: jsonHeader,
71
      body: {
72
        email: 'admin@' + config.get<string>('application.domain'),
73
        password: 'admin123'
74
      }
75
    })
76
      .expect('status', 200)
77
      .then(({ json: jsonLogin }) => {
78
        return frisby.get(REST_URL + '/order-history/orders', {
79
          headers: { Authorization: 'Bearer ' + jsonLogin.authentication.token, 'content-type': 'application/json' }
80
        })
81
          .expect('status', 403)
82
      })
83
  })
84

85
  it('GET all orders for accountant', () => {
86
    return frisby.post(REST_URL + '/user/login', {
87
      headers: jsonHeader,
88
      body: {
89
        email: 'accountant@' + config.get<string>('application.domain'),
90
        password: 'i am an awesome accountant'
91
      }
92
    })
93
      .expect('status', 200)
94
      .then(({ json: jsonLogin }) => {
95
        return frisby.get(REST_URL + '/order-history/orders', {
96
          headers: { Authorization: 'Bearer ' + jsonLogin.authentication.token, 'content-type': 'application/json' }
97
        })
98
          .expect('status', 200)
99
      })
100
  })
101
})
102

103
describe('/rest/order-history/:id/delivery-status', () => {
104
  it('PUT delivery status is forbidden for admin', () => {
105
    return frisby.post(REST_URL + '/user/login', {
106
      headers: jsonHeader,
107
      body: {
108
        email: 'admin@' + config.get<string>('application.domain'),
109
        password: 'admin123'
110
      }
111
    })
112
      .expect('status', 200)
113
      .then(({ json: jsonLogin }) => {
114
        return frisby.put(REST_URL + '/order-history/1/delivery-status', {
115
          headers: { Authorization: 'Bearer ' + jsonLogin.authentication.token, 'content-type': 'application/json' },
116
          body: {
117
            delivered: false
118
          }
119
        })
120
          .expect('status', 403)
121
      })
122
  })
123

124
  it('PUT delivery status is forbidden for customer', () => {
125
    return frisby.post(REST_URL + '/user/login', {
126
      headers: jsonHeader,
127
      body: {
128
        email: 'jim@' + config.get<string>('application.domain'),
129
        password: 'ncc-1701'
130
      }
131
    })
132
      .expect('status', 200)
133
      .then(({ json: jsonLogin }) => {
134
        return frisby.put(REST_URL + '/order-history/1/delivery-status', {
135
          headers: { Authorization: 'Bearer ' + jsonLogin.authentication.token, 'content-type': 'application/json' },
136
          body: {
137
            delivered: false
138
          }
139
        })
140
          .expect('status', 403)
141
      })
142
  })
143

144
  it('PUT delivery status is allowed for accountant', () => {
145
    return frisby.post(REST_URL + '/user/login', {
146
      headers: jsonHeader,
147
      body: {
148
        email: 'accountant@' + config.get<string>('application.domain'),
149
        password: 'i am an awesome accountant'
150
      }
151
    })
152
      .expect('status', 200)
153
      .then(({ json: jsonLogin }) => {
154
        return frisby.put(REST_URL + '/order-history/1/delivery-status', {
155
          headers: { Authorization: 'Bearer ' + jsonLogin.authentication.token, 'content-type': 'application/json' },
156
          body: {
157
            delivered: false
158
          }
159
        })
160
          .expect('status', 200)
161
      })
162
  })
163
})
164