refactor: extraire la vérification JWT/payload en policy partagée

src/api/artiste/controllers/__tests__/artiste.test.js

@@ -2,7 +2,7 @@ import {describe, it, expect, vi} from 'vitest'
 
 const {default: createController} = await import('../artiste.js')
 
-function buildStrapi({jwtUserId, dbUser, existingArtiste = null}) {
+function buildStrapi({dbUser, existingArtiste = null}) {
   const dbQuery = {
     findOne: vi.fn(async () => existingArtiste)
   }
@@ -15,15 +15,6 @@ function buildStrapi({jwtUserId, dbUser, existingArtiste = null}) {
 
   const strapi = {
     contentType: vi.fn(() => ({uid: 'api::artiste.artiste', kind: 'collectionType'})),
-    plugins: {
-      'users-permissions': {
-        services: {
-          jwt: {
-            getToken: vi.fn(async () => ({id: jwtUserId}))
-          }
-        }
-      }
-    },
     db: {
       query: vi.fn(() => dbQuery)
     },
@@ -43,7 +34,6 @@ function buildCtx(data) {
       body: {data},
       header: {authorization: 'Bearer faketoken'}
     },
-    unauthorized: vi.fn(),
     badRequest: vi.fn(),
     notFound: vi.fn()
   }
@@ -60,25 +50,13 @@ function buildData(overrides = {}) {
 }
 
 describe('artiste.create', () => {
-  it('refuse et ne crée rien quand le user du JWT ne correspond pas au user du payload, sans planter', async () => {
-    const {strapi, artisteDocuments} = buildStrapi({jwtUserId: 999, dbUser})
+  it('crée l\'artiste quand le user existe et que l\'alias est nouveau', async () => {
+    const {strapi, artisteDocuments} = buildStrapi({dbUser})
     const controller = createController({strapi})
     const ctx = buildCtx(buildData())
 
     await controller.create(ctx)
 
-    expect(ctx.unauthorized).toHaveBeenCalled()
-    expect(artisteDocuments.create).not.toHaveBeenCalled()
-  })
-
-  it('crée l\'artiste quand le user du JWT correspond au user du payload', async () => {
-    const {strapi, artisteDocuments} = buildStrapi({jwtUserId: 1, dbUser})
-    const controller = createController({strapi})
-    const ctx = buildCtx(buildData())
-
-    await controller.create(ctx)
-
-    expect(ctx.unauthorized).not.toHaveBeenCalled()
     expect(artisteDocuments.create).toHaveBeenCalled()
   })
 })