api.pawol.nu/src/api/artiste/controllers/__tests__/artiste.test.js

import {describe, it, expect, vi} from 'vitest';

const {default: createController} = await import('../artiste.js');

function buildStrapi({dbUser, existingArtiste = null}) {
  const dbQuery = {
    findOne: vi.fn(async () => existingArtiste)
  };
  const artisteDocuments = {
    create: vi.fn(async ({data}) => ({id: 42, ...data}))
  };
  const userDocuments = {
    findOne: vi.fn(async () => dbUser)
  };

  const strapi = {
    contentType: vi.fn(() => ({uid: 'api::artiste.artiste', kind: 'collectionType'})),
    db: {
      query: vi.fn(() => dbQuery)
    },
    documents: vi.fn(uid => {
      if (uid === 'plugin::users-permissions.user') return userDocuments;
      if (uid === 'api::artiste.artiste') return artisteDocuments;
      throw new Error(`unexpected uid: ${uid}`);
    })
  };

  return {strapi, artisteDocuments};
}

function buildCtx(data) {
  return {
    request: {
      body: {data},
      header: {authorization: 'Bearer faketoken'}
    },
    badRequest: vi.fn(),
    notFound: vi.fn()
  };
}

const dbUser = {id: 1, documentId: 'user-doc-1', username: 'foo', email: 'foo@bar.com'};

function buildData(overrides = {}) {
  return {
    alias: 'Test Artist',
    user: {...dbUser},
    ...overrides
  };
}

describe('artiste.create', () => {
  it('crée l\'artiste quand le user existe et que l\'alias est nouveau', async () => {
    const {strapi, artisteDocuments} = buildStrapi({dbUser});
    const controller = createController({strapi});
    const ctx = buildCtx(buildData());

    await controller.create(ctx);

    expect(artisteDocuments.create).toHaveBeenCalled();
  });

  it('refuse sans planter quand data.user est absent', async () => {
    const {strapi} = buildStrapi({dbUser});
    const controller = createController({strapi});
    const ctx = buildCtx(buildData({user: undefined}));

    await controller.create(ctx);

    expect(ctx.badRequest).toHaveBeenCalled();
    expect(strapi.documents).not.toHaveBeenCalled();
  });

  it('ignore les champs non autorisés du payload (mass assignment)', async () => {
    const {strapi, artisteDocuments} = buildStrapi({dbUser});
    const controller = createController({strapi});
    const ctx = buildCtx(buildData({
      isExclusiveArtist: true,
      userAdmin: {id: 999}
    }));

    await controller.create(ctx);

    expect(artisteDocuments.create).toHaveBeenCalledWith({
      data: {
        alias: 'Test Artist',
        user: dbUser.id
      }
    });
  });
});