edr-platform/apps/edr-freight-api/src/modules/auth/login-audience.middleware.spec.ts

import { ForbiddenException } from '@nestjs/common';

import { LoginAudienceMiddleware } from './login-audience.middleware';

/**
 * Touches only the DataSource, so build off the prototype rather than
 * standing up a full Nest module — same pattern as
 * warehouses/receive-export-paid.spec.ts.
 */
function makeMiddleware(userType: string | undefined) {
  const query = jest.fn().mockResolvedValue(userType ? [{ userType }] : []);
  const middleware = Object.create(
    LoginAudienceMiddleware.prototype,
  ) as LoginAudienceMiddleware;
  (middleware as unknown as { dataSource: unknown }).dataSource = { query };
  return middleware;
}

function makeReq(clientApp: string | undefined, email = 'someone@example.com') {
  return {
    header: (name: string) =>
      name.toLowerCase() === 'x-client-app' ? clientApp : undefined,
    body: { email },
  } as any;
}

describe('LoginAudienceMiddleware', () => {
  it('rejects when the client app header is missing', async () => {
    const middleware = makeMiddleware('employee');
    const next = jest.fn();

    await expect(
      middleware.use(makeReq(undefined), {} as any, next),
    ).rejects.toBeInstanceOf(ForbiddenException);
    expect(next).not.toHaveBeenCalled();
  });

  it('rejects an unrecognized client app header', async () => {
    const middleware = makeMiddleware('employee');
    const next = jest.fn();

    await expect(
      middleware.use(makeReq('mobile'), {} as any, next),
    ).rejects.toBeInstanceOf(ForbiddenException);
  });

  it('rejects an employee account signing in through the portal client', async () => {
    const middleware = makeMiddleware('employee');
    const next = jest.fn();

    await expect(
      middleware.use(makeReq('portal'), {} as any, next),
    ).rejects.toBeInstanceOf(ForbiddenException);
    expect(next).not.toHaveBeenCalled();
  });

  it('rejects a customer account signing in through the backoffice client', async () => {
    const middleware = makeMiddleware('individual');
    const next = jest.fn();

    await expect(
      middleware.use(makeReq('backoffice'), {} as any, next),
    ).rejects.toBeInstanceOf(ForbiddenException);
  });

  it('allows an employee account through the backoffice client', async () => {
    const middleware = makeMiddleware('employee');
    const next = jest.fn();

    await middleware.use(makeReq('backoffice'), {} as any, next);

    expect(next).toHaveBeenCalledTimes(1);
  });

  it('allows a customer account through the portal client', async () => {
    const middleware = makeMiddleware('individual');
    const next = jest.fn();

    await middleware.use(makeReq('portal'), {} as any, next);

    expect(next).toHaveBeenCalledTimes(1);
  });

  it('lets an unknown identifier fall through to the login handler', async () => {
    const middleware = makeMiddleware(undefined);
    const next = jest.fn();

    await middleware.use(makeReq('portal'), {} as any, next);

    expect(next).toHaveBeenCalledTimes(1);
  });
});