feat: add integration and unit tests for authentication middleware and session management

SilvioFelix32 · SilvioFelix32 · commit 982788c767eb · 2026-07-09T11:48:29.000-03:00
diff --git a/backend/tests/integration/middleware/authGuards.test.ts b/backend/tests/integration/middleware/authGuards.test.ts
@@ -0,0 +1,52 @@
+import request from "supertest";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("iron-session", () => ({
+  getIronSession: vi.fn(),
+}));
+
+import { getIronSession } from "iron-session";
+import { createJobsApiApp } from "../../../src/app";
+
+const protectedRoutes = [
+  { method: "get" as const, path: "/saved-jobs" },
+  { method: "get" as const, path: "/users/profile" },
+  { method: "get" as const, path: "/jobs/search?keywords=dev" },
+  { method: "get" as const, path: "/keywords" },
+];
+
+describe("Integration - Auth Guards (requireAuth)", () => {
+  let app: ReturnType<typeof createJobsApiApp>;
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.mocked(getIronSession).mockResolvedValue({
+      userId: undefined,
+      save: vi.fn(),
+      destroy: vi.fn(),
+    } as any);
+    app = createJobsApiApp();
+  });
+
+  it.each(protectedRoutes)(
+    "bloqueia $method $path sem sessão autenticada",
+    async ({ method, path }) => {
+      const res = await request(app)[method](path).expect(401);
+
+      expect(res.body).toEqual({ message: "Não autenticado." });
+    },
+  );
+
+  it("permite /auth/login sem exigir autenticação prévia", async () => {
+    const res = await request(app)
+      .post("/auth/login")
+      .send({ email: "invalido", password: "x" });
+
+    expect(res.status).not.toBe(401);
+    expect(res.body).not.toEqual({ message: "Não autenticado." });
+  });
+
+  it("permite /health sem autenticação", async () => {
+    await request(app).get("/health").expect(200);
+  });
+});
diff --git a/backend/tests/integration/routes/auth.routes.test.ts b/backend/tests/integration/routes/auth.routes.test.ts
@@ -558,5 +558,64 @@ describe("Integration - Auth Routes", () => {
 
       expect(res.body).toHaveProperty("error", "Não autenticado");
     });
+
+    it("invalida sessão e retorna 401 quando usuário foi removido", async () => {
+      const session = {
+        userId: "user-deleted",
+        save: vi.fn(),
+        destroy: vi.fn().mockResolvedValue(undefined),
+      };
+      vi.mocked(getIronSession).mockResolvedValue(session as any);
+      mockCredentialsService.findById.mockResolvedValueOnce(null);
+
+      const res = await request(app).get(`${BASE}/me`).expect(401);
+
+      expect(res.body).toHaveProperty("error", "Não autenticado");
+      expect(session.destroy).toHaveBeenCalled();
+    });
+  });
+
+  // ── Fluxo de sessão (login → validação → logout) ─────────────────────────
+  // Não há endpoint de refresh de token; a sessão é validada via GET /auth/me.
+
+  describe("fluxo de sessão", () => {
+    it("login seguido de /me retorna o mesmo usuário autenticado", async () => {
+      vi.mocked(getIronSession).mockResolvedValue(
+        fixtureCredentialsSession as any,
+      );
+
+      await request(app).post(`${BASE}/login`).send(loginPayload).expect(200);
+
+      vi.mocked(getIronSession).mockResolvedValue({
+        userId: fixtureUser.id,
+        save: vi.fn(),
+        destroy: vi.fn(),
+      } as any);
+
+      const meRes = await request(app).get(`${BASE}/me`).expect(200);
+
+      expect(meRes.body.user).toHaveProperty("id", fixtureUser.id);
+      expect(fixtureCredentialsSession.userId).toBe(fixtureUser.id);
+    });
+
+    it("logout invalida sessão e /me retorna 401 em seguida", async () => {
+      const session = {
+        userId: fixtureUser.id,
+        role: fixtureUser.role,
+        save: vi.fn().mockResolvedValue(undefined),
+        destroy: vi.fn().mockResolvedValue(undefined),
+      };
+      vi.mocked(getIronSession).mockResolvedValue(session as any);
+
+      await request(app).post(`${BASE}/logout`).expect(200);
+      expect(session.destroy).toHaveBeenCalled();
+
+      session.userId = undefined;
+      vi.mocked(getIronSession).mockResolvedValue(session as any);
+
+      const meRes = await request(app).get(`${BASE}/me`).expect(401);
+
+      expect(meRes.body).toHaveProperty("error", "Não autenticado");
+    });
   });
 });
diff --git a/backend/tests/integration/routes/savedJobs.routes.test.ts b/backend/tests/integration/routes/savedJobs.routes.test.ts
@@ -117,7 +117,9 @@ describe("Integration - SavedJobs Routes", () => {
         userId: undefined,
       } as any);
 
-      await request(app).get(BASE).expect(401);
+      const res = await request(app).get(BASE).expect(401);
+
+      expect(res.body).toEqual({ message: "Não autenticado." });
     });
 
     it("retorna 500 quando getAll lança erro", async () => {
@@ -151,6 +153,18 @@ describe("Integration - SavedJobs Routes", () => {
       await request(app).get(`${BASE}/inexistente`).expect(404);
     });
 
+    it("retorna 404 quando vaga pertence a outro usuário (ownership)", async () => {
+      mockSavedJobsService.getById.mockResolvedValueOnce(undefined);
+
+      const res = await request(app).get(`${BASE}/job-outro-user`).expect(404);
+
+      expect(res.body).toHaveProperty("error", "Vaga não encontrada");
+      expect(mockSavedJobsService.getById).toHaveBeenCalledWith(
+        "user_abc",
+        "job-outro-user",
+      );
+    });
+
     it("retorna 401 quando sessão não tem userId", async () => {
       vi.mocked(getIronSession).mockResolvedValueOnce({
         userId: undefined,
@@ -228,6 +242,78 @@ describe("Integration - SavedJobs Routes", () => {
     });
   });
 
+  // ── PATCH /:id — transições de status (eventos de candidatura) ─────────────
+
+  describe("PATCH /:id — transições de status", () => {
+    it.each([
+      "applied",
+      "interviewing",
+      "rejected",
+      "accepted",
+    ] as const)("atualiza status para %s", async (status) => {
+      mockSavedJobsService.update.mockResolvedValueOnce({
+        ...fixtureJob,
+        status,
+      });
+
+      const res = await request(app)
+        .patch(`${BASE}/job-1`)
+        .send({ status })
+        .expect(200);
+
+      expect(res.body.status).toBe(status);
+      expect(mockSavedJobsService.update).toHaveBeenCalledWith(
+        "user_abc",
+        "job-1",
+        expect.objectContaining({ status }),
+      );
+    });
+
+    it("persiste appliedAt ao registrar candidatura enviada", async () => {
+      const appliedAt = "2024-06-15T10:00:00.000Z";
+      mockSavedJobsService.update.mockResolvedValueOnce({
+        ...fixtureJob,
+        status: "applied",
+        appliedAt,
+      });
+
+      const res = await request(app)
+        .patch(`${BASE}/job-1`)
+        .send({ status: "applied", appliedAt })
+        .expect(200);
+
+      expect(res.body.status).toBe("applied");
+      expect(mockSavedJobsService.update).toHaveBeenCalledWith(
+        "user_abc",
+        "job-1",
+        expect.objectContaining({
+          status: "applied",
+          appliedAt: expect.any(Date),
+        }),
+      );
+    });
+
+    it("simula pipeline completo saved → applied → interviewing → accepted", async () => {
+      const pipeline = ["applied", "interviewing", "accepted"] as const;
+
+      for (const status of pipeline) {
+        mockSavedJobsService.update.mockResolvedValueOnce({
+          ...fixtureJob,
+          status,
+        });
+
+        const res = await request(app)
+          .patch(`${BASE}/job-1`)
+          .send({ status })
+          .expect(200);
+
+        expect(res.body.status).toBe(status);
+      }
+
+      expect(mockSavedJobsService.update).toHaveBeenCalledTimes(pipeline.length);
+    });
+  });
+
   // ── PATCH /:id ────────────────────────────────────────────────────────────
 
   describe("PATCH /:id", () => {
@@ -324,5 +410,14 @@ describe("Integration - SavedJobs Routes", () => {
 
       await request(app).delete(`${BASE}/job-1`).expect(500);
     });
+
+    it("retorna 204 mesmo quando vaga não pertence ao usuário (ownership silencioso)", async () => {
+      await request(app).delete(`${BASE}/job-outro-user`).expect(204);
+
+      expect(mockSavedJobsService.delete).toHaveBeenCalledWith(
+        "user_abc",
+        "job-outro-user",
+      );
+    });
   });
 });
diff --git a/backend/tests/unit/middleware/requireAuth.test.ts b/backend/tests/unit/middleware/requireAuth.test.ts
@@ -0,0 +1,46 @@
+import type { NextFunction, Request, Response } from "express";
+import { describe, expect, it, vi } from "vitest";
+import { requireAuth } from "../../../src/middleware/requireAuth";
+
+function makeMocks(session: Request["session"] | undefined) {
+  const req = { session } as Request;
+  const json = vi.fn();
+  const status = vi.fn(() => ({ json }));
+  const res = { status, json } as unknown as Response;
+  const next = vi.fn() as NextFunction;
+
+  return { req, res, next, json, status };
+}
+
+describe("requireAuth", () => {
+  it("retorna 401 quando sessão não tem userId", () => {
+    const { req, res, next, status, json } = makeMocks({} as Request["session"]);
+
+    requireAuth(req, res, next);
+
+    expect(status).toHaveBeenCalledWith(401);
+    expect(json).toHaveBeenCalledWith({ message: "Não autenticado." });
+    expect(next).not.toHaveBeenCalled();
+  });
+
+  it("retorna 401 quando sessão é undefined", () => {
+    const { req, res, next, status, json } = makeMocks(undefined);
+
+    requireAuth(req, res, next);
+
+    expect(status).toHaveBeenCalledWith(401);
+    expect(json).toHaveBeenCalledWith({ message: "Não autenticado." });
+    expect(next).not.toHaveBeenCalled();
+  });
+
+  it("chama next quando userId está presente na sessão", () => {
+    const { req, res, next, status } = makeMocks({
+      userId: "user-1",
+    } as Request["session"]);
+
+    requireAuth(req, res, next);
+
+    expect(next).toHaveBeenCalledOnce();
+    expect(status).not.toHaveBeenCalled();
+  });
+});
diff --git a/backend/tests/unit/middleware/withSession.test.ts b/backend/tests/unit/middleware/withSession.test.ts
@@ -0,0 +1,47 @@
+import type { NextFunction, Request, Response } from "express";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mockGetIronSession = vi.hoisted(() => vi.fn());
+
+vi.mock("iron-session", () => ({
+  getIronSession: mockGetIronSession,
+}));
+
+import { withSession } from "../../../src/middleware/withSession";
+
+describe("withSession", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("injeta req.session e chama next", async () => {
+    const session = {
+      userId: "user-1",
+      save: vi.fn(),
+      destroy: vi.fn(),
+    };
+    mockGetIronSession.mockResolvedValue(session);
+
+    const req = {} as Request;
+    const res = {} as Response;
+    const next = vi.fn() as NextFunction;
+
+    await withSession(req, res, next);
+
+    expect(mockGetIronSession).toHaveBeenCalledOnce();
+    expect(req.session).toBe(session);
+    expect(next).toHaveBeenCalledOnce();
+  });
+
+  it("propaga erro quando getIronSession falha", async () => {
+    const error = new Error("session failure");
+    mockGetIronSession.mockRejectedValue(error);
+
+    const req = {} as Request;
+    const res = {} as Response;
+    const next = vi.fn() as NextFunction;
+
+    await expect(withSession(req, res, next)).rejects.toThrow("session failure");
+    expect(next).not.toHaveBeenCalled();
+  });
+});
diff --git a/backend/tests/unit/modules/savedJobs/savedJobs.service.test.ts b/backend/tests/unit/modules/savedJobs/savedJobs.service.test.ts
