popertots/Crussell
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: correct middleware chain in scheduling NonAdmin tests

Browse Source 
- RequireAdmin needs RequireAuth to populate context first
- Add mw.RequireAuth wrapper to all NonAdmin test middleware chains
- Tests now properly validate auth before checking admin role
- Tests passing: 30/33 (up from 24/27)
- Remaining failures are handler bugs, not test setup issues
This commit is contained in:
popertots
2026-02-22 00:34:53 +00:00
parent ed5598a59f
commit 355e8a26c1
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/handlers/scheduling/scheduling_test.go
+5 -5
View File
@@ -209,8 +209,8 @@ func TestScheduling_UpdateDefaultHours_NonAdmin(t *testing.T) {
{Weekday: 6, StartTime: "00:00", EndTime: "00:00", IsOpen: false}, {Weekday: 6, StartTime: "00:00", EndTime: "00:00", IsOpen: false},
} }
// Wrap handler with RequireAdmin middleware // Wrap handler with RequireAuth + RequireAdmin middleware (auth first to populate context)
w := makeAuthRequest(mw.RequireAdmin(http.HandlerFunc(UpdateDefaultHours)), "PUT", "/api/scheduling/default-hours", userToken, newHours) w := makeAuthRequest(mw.RequireAuth(mw.RequireAdmin(http.HandlerFunc(UpdateDefaultHours))), "PUT", "/api/scheduling/default-hours", userToken, newHours)
if w.Code != http.StatusForbidden { if w.Code != http.StatusForbidden {
t.Errorf("expected status 403, got %d. body: %s", w.Code, w.Body.String()) t.Errorf("expected status 403, got %d. body: %s", w.Code, w.Body.String())
@@ -318,7 +318,7 @@ func TestScheduling_CreateExceptionalGroup_NonAdmin(t *testing.T) {
WeekStarts: []string{"2026-06-01"}, WeekStarts: []string{"2026-06-01"},
} }
w := makeAuthRequest(mw.RequireAdmin(http.HandlerFunc(CreateExceptionalGroup)), "POST", "/api/scheduling/exceptional-groups", userToken, newGroup) w := makeAuthRequest(mw.RequireAuth(mw.RequireAdmin(http.HandlerFunc(CreateExceptionalGroup))), "POST", "/api/scheduling/exceptional-groups", userToken, newGroup)
if w.Code != http.StatusForbidden { if w.Code != http.StatusForbidden {
t.Errorf("expected status 403, got %d. body: %s", w.Code, w.Body.String()) t.Errorf("expected status 403, got %d. body: %s", w.Code, w.Body.String())
@@ -378,7 +378,7 @@ func TestScheduling_DeleteExceptionalGroup_NonAdmin(t *testing.T) {
userToken := jwt.GenerateUserToken("user-123") userToken := jwt.GenerateUserToken("user-123")
handler := mw.RequireAdmin(http.HandlerFunc(DeleteExceptionalGroup)) handler := mw.RequireAuth(mw.RequireAdmin(http.HandlerFunc(DeleteExceptionalGroup)))
req := httptest.NewRequest("DELETE", "/api/scheduling/exceptional-groups?id=1", nil) req := httptest.NewRequest("DELETE", "/api/scheduling/exceptional-groups?id=1", nil)
req.Header.Set("Authorization", "Bearer "+userToken) req.Header.Set("Authorization", "Bearer "+userToken)
w := httptest.NewRecorder() w := httptest.NewRecorder()
@@ -507,7 +507,7 @@ func TestScheduling_UpdateExceptionalApplications_NonAdmin(t *testing.T) {
defer cleanup() defer cleanup()
userToken := jwt.GenerateUserToken("user-123") userToken := jwt.GenerateUserToken("user-123")
handler := mw.RequireAdmin(http.HandlerFunc(UpdateExceptionalApplications)) handler := mw.RequireAuth(mw.RequireAdmin(http.HandlerFunc(UpdateExceptionalApplications)))
reqBody := map[string]interface{}{ reqBody := map[string]interface{}{
"groupId": 1, "groupId": 1,