refactor: extraire la vérification JWT/payload en policy partagée

src/api/parole/controllers/__tests__/parole.test.js

@@ -2,7 +2,7 @@ import {describe, it, expect, vi} from 'vitest'
 
 const {default: createController} = await import('../parole.js')
 
-function buildStrapi({jwtUserId, dbUser, artiste}) {
+function buildStrapi({dbUser, artiste}) {
   const paroleDocuments = {
     findMany: vi.fn(async () => []),
     create: vi.fn(async ({data}) => ({id: 42, ...data}))
@@ -21,15 +21,6 @@ function buildStrapi({jwtUserId, dbUser, artiste}) {
       validateParoles: vi.fn(),
       translateLyrics: vi.fn()
     })),
-    plugins: {
-      'users-permissions': {
-        services: {
-          jwt: {
-            getToken: vi.fn(async () => ({id: jwtUserId}))
-          }
-        }
-      }
-    },
     documents: vi.fn(uid => {
       if (uid === 'plugin::users-permissions.user') return userDocuments
       if (uid === 'api::artiste.artiste') return artisteDocuments
@@ -47,7 +38,6 @@ function buildCtx(data) {
       body: {data},
       header: {authorization: 'Bearer faketoken'}
     },
-    unauthorized: vi.fn(),
     badRequest: vi.fn(),
     notFound: vi.fn()
   }
@@ -67,25 +57,13 @@ function buildData(overrides = {}) {
 }
 
 describe('parole.create', () => {
-  it('refuse et ne crée rien quand le user du JWT ne correspond pas au user du payload', async () => {
-    const {strapi, paroleDocuments} = buildStrapi({jwtUserId: 999, dbUser, artiste})
+  it('crée la parole quand le user et l\'artiste existent', async () => {
+    const {strapi, paroleDocuments} = buildStrapi({dbUser, artiste})
     const controller = createController({strapi})
     const ctx = buildCtx(buildData())
 
     await controller.create(ctx)
 
-    expect(ctx.unauthorized).toHaveBeenCalled()
-    expect(paroleDocuments.create).not.toHaveBeenCalled()
-  })
-
-  it('crée la parole quand le user du JWT correspond au user du payload', async () => {
-    const {strapi, paroleDocuments} = buildStrapi({jwtUserId: 1, dbUser, artiste})
-    const controller = createController({strapi})
-    const ctx = buildCtx(buildData())
-
-    await controller.create(ctx)
-
-    expect(ctx.unauthorized).not.toHaveBeenCalled()
     expect(paroleDocuments.create).toHaveBeenCalled()
   })
 })

src/api/parole/controllers/parole.js

@@ -71,20 +71,6 @@ module.exports = createCoreController('api::parole.parole', ({strapi}) => ({
     const {data} = body
     strapi.service('api::parole.parole').validateParoles(data.titre, data.transcription)
 
-    if (ctx.request && ctx.request.header && ctx.request.header.authorization) {
-      try {
-        const {id} = await strapi.plugins[
-          'users-permissions'
-        ].services.jwt.getToken(ctx)
-
-        if (id !== data.user.id) {
-          return ctx.unauthorized('Opération non autorisée')
-        }
-      } catch (err) {
-        return ctx.unauthorized('Opération non autorisée')
-      }
-    }
-
     const user = await strapi.documents('plugin::users-permissions.user').findOne({
       documentId: body.data.user.documentId
     })

src/api/parole/routes/parole.js

@@ -2,4 +2,10 @@
 
 const { createCoreRouter } = require('@strapi/strapi').factories;
 
-module.exports = createCoreRouter('api::parole.parole')
+module.exports = createCoreRouter('api::parole.parole', {
+  config: {
+    create: {
+      policies: ['global::is-payload-owner']
+    }
+  }
+})