Files
dinggadingga-backend/test/app.e2e-spec.ts
quentin_duwa 8c8a2ccf15 feat(security): harden the API, trust Hiboutik for deletions, lock syncs (#3)
- Sync deletions: a 2xx Hiboutik answer is the truth, even an empty list; a failed call (HTTP error or non-list body) deletes nothing (HiboutikClient.getList).
- Validate the environment at startup (HIBOUTIK_BASE_URL must be HTTPS), global ValidationPipe, Helmet, CORS opt-in, HTTP timeouts, rate limiting (60 req/min/IP, 5 on POST /sync), AllExceptionsFilter.
- Postgres advisory lock so only one synchronization runs at a time across instances; syncAll is private, syncs start through startSync.
- Fix the Jest moduleNameMapper; document the validation and security rules in CLAUDE.md.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-11-08 09:36:50 +00:00

43 lines
1.5 KiB
TypeScript

import { Test, TestingModule } from '@nestjs/testing';
import { INestApplication } from '@nestjs/common';
import request from 'supertest';
import { App } from 'supertest/types';
import { AppModule } from './../src/app.module';
import { HiboutikService } from './../src/services/hiboutik/hiboutik.service';
import { PrismaService } from './../prisma/prisma.service';
// Boots the real AppModule wiring, without database nor Hiboutik calls
describe('AppController (e2e)', () => {
let app: INestApplication<App>;
const hiboutikService = { startSync: jest.fn() };
beforeEach(async () => {
hiboutikService.startSync.mockReset();
const moduleFixture: TestingModule = await Test.createTestingModule({
imports: [AppModule],
})
.overrideProvider(PrismaService)
.useValue({})
.overrideProvider(HiboutikService)
.useValue(hiboutikService)
.compile();
app = moduleFixture.createNestApplication();
await app.init();
});
it('POST /sync starts a synchronization (202)', () => {
hiboutikService.startSync.mockResolvedValue(true);
return request(app.getHttpServer()).post('/sync').expect(202).expect({ message: 'Hiboutik synchronization started' });
});
it('POST /sync answers 409 when a synchronization is already running', () => {
hiboutikService.startSync.mockResolvedValue(false);
return request(app.getHttpServer()).post('/sync').expect(409);
});
afterEach(async () => {
await app.close();
});
});