hyper-note / test / unit / shared-read-access.test.js

import test from 'brittle'
import { denyPrivateSharedRead } from '../../lib/routes/multiwriter.js'

function fakeRes () {
  return { statusCode: 200, _body: null, setHeader () {}, end (b) { this._body = b } }
}

function server ({ meta, authorized }) {
  return {
    noteManager: { getNotebook: async () => meta },
    authManager: { authorizeRequest: async () => ({ authorized, auth: authorized ? { userId: 'u' } : null }) }
  }
}

test('denyPrivateSharedRead - pure shared notebook (no metadata) is allowed', async (t) => {
  const res = fakeRes()
  const denied = await denyPrivateSharedRead({}, res, server({ meta: null }), 'x')
  t.is(denied, false, 'not denied')
  t.is(res.statusCode, 200, 'no response sent')
})

test('denyPrivateSharedRead - public notebook is allowed', async (t) => {
  const res = fakeRes()
  const denied = await denyPrivateSharedRead({}, res, server({ meta: { visibility: 'public' } }), 'x')
  t.is(denied, false, 'not denied')
})

test('denyPrivateSharedRead - private notebook blocks unauthorized', async (t) => {
  const res = fakeRes()
  const denied = await denyPrivateSharedRead({}, res, server({ meta: { visibility: 'private' }, authorized: false }), 'sec')
  t.is(denied, true, 'denied')
  t.is(res.statusCode, 404, 'responds 404')
})

test('denyPrivateSharedRead - private notebook allows authorized reader', async (t) => {
  const res = fakeRes()
  const denied = await denyPrivateSharedRead({}, res, server({ meta: { visibility: 'private' }, authorized: true }), 'sec')
  t.is(denied, false, 'authorized → allowed')
})