juice-shop

1
/*
2
 * Copyright (c) 2014-2024 Bjoern Kimminich & the OWASP Juice Shop contributors.
3
 * SPDX-License-Identifier: MIT
4
 */
5

6
import frisby = require('frisby')
7
const Joi = frisby.Joi
8
const security = require('../../lib/insecurity')
9

10
const API_URL = 'http://localhost:3000/api'
11

12
const authHeader = { Authorization: `Bearer ${security.authorize()}`, 'content-type': 'application/json' }
13

14
describe('/api/Recycles', () => {
15
  it('POST new recycle', () => {
16
    return frisby.post(`${API_URL}/Recycles`, {
17
      headers: authHeader,
18
      body: {
19
        quantity: 200,
20
        AddressId: '1',
21
        isPickup: true,
22
        date: '2017-05-31'
23
      }
24
    })
25
      .expect('status', 201)
26
      .expect('header', 'content-type', /application\/json/)
27
      .expect('jsonTypes', 'data', {
28
        id: Joi.number(),
29
        createdAt: Joi.string(),
30
        updatedAt: Joi.string()
31
      })
32
  })
33

34
  it('Will prevent GET all recycles from this endpoint', () => {
35
    return frisby.get(`${API_URL}/Recycles`)
36
      .expect('status', 200)
37
      .expect('header', 'content-type', /application\/json/)
38
      .expect('jsonTypes', 'data', {
39
        err: 'Sorry, this endpoint is not supported.'
40
      })
41
  })
42

43
  it('Will GET existing recycle from this endpoint', () => {
44
    return frisby.get(`${API_URL}/Recycles/1`)
45
      .expect('status', 200)
46
      .expect('header', 'content-type', /application\/json/)
47
      .expect('jsonTypes', 'data.*', {
48
        id: Joi.number(),
49
        UserId: Joi.number(),
50
        AddressId: Joi.number(),
51
        quantity: Joi.number(),
52
        isPickup: Joi.boolean(),
53
        date: Joi.date(),
54
        createdAt: Joi.string(),
55
        updatedAt: Joi.string()
56
      })
57
  })
58

59
  it('PUT update existing recycle is forbidden', () => {
60
    return frisby.put(`${API_URL}/Recycles/1`, {
61
      headers: authHeader,
62
      body: {
63
        quantity: 100000
64
      }
65
    })
66
      .expect('status', 401)
67
  })
68

69
  it('DELETE existing recycle is forbidden', () => {
70
    return frisby.del(`${API_URL}/Recycles/1`, { headers: authHeader })
71
      .expect('status', 401)
72
  })
73
})
74