Repository: freeCodeCamp/freeCodeCamp
File: api/src/routes/protected/user.test.ts (TypeScript)

Code before:
        const { examEnvironmentAuthorizationToken } = response.body;

        const decodedToken = jwt.decode(examEnvironmentAuthorizationToken);

        expect(decodedToken).not.toHaveProperty(
          'examEnvironmentAuthorizationToken',
          token.id
        );

        expect(response.status).toBe(201);

        const tokens =
          await fastifyTestInstance.prisma.examEnvironmentAuthorizationToken.findMany(
            {
              where: { userId: defaultUserId }
            }
          );
        expect(tokens).toHaveLength(1);
      });

      xtest('TODO: POST does not generate a new token in non-production environments', async () => {
        // TODO: How to change environment variable mid-test?
        const response = await superPost('/user/exam-environment/token');

        expect(response.status).toBe(403);
      });
    });
  });

  describe('Unauthenticated user', () => {
    let setCookies: string[];
    // Get the CSRF cookies from an unprotected route
    beforeAll(async () => {
      const res = await superRequest('/status/ping', { method: 'GET' });
      setCookies = res.get('Set-Cookie');
    });

    const endpoints: { path: string; method: 'GET' | 'POST' | 'DELETE' }[] = [
      { path: '/account/delete', method: 'POST' },
      { path: '/account/reset-progress', method: 'POST' },
      { path: '/user/get-session-user', method: 'GET' },
      { path: '/user/user-token', method: 'DELETE' },
      { path: '/user/user-token', method: 'POST' },
      { path: '/user/ms-username', method: 'DELETE' },
      { path: '/user/report-user', method: 'POST' },
      { path: '/user/ms-username', method: 'POST' },
      { path: '/user/submit-survey', method: 'POST' }
    ];

    endpoints.forEach(({ path, method }) => {
      test(`${method} ${path} returns 401 status code with error message`, async () => {

Review comment (suggestion):
And then in here, we set the env to non-production.

```suggestion
      test('POST does not generate a new token in non-production environments', async () => {
        // Override deployment environment for this test
        mockDeploymentEnv = 'development';

        const response = await superPost('/user/exam-environment/token');

        expect(response.status).toBe(403);

        // Reset back to production for other tests
        mockDeploymentEnv = 'production';
      });
```

Code after:
      test('POST only allows for one token per user id', async () => {
        const token =
          await fastifyTestInstance.prisma.examEnvironmentAuthorizationToken.create(
            {
              data: {
                userId: defaultUserId,
                expireAt: new Date()
              }
            }
          );

        const response = await superPost('/user/exam-environment/token');

        const { examEnvironmentAuthorizationToken } = response.body;

        const decodedToken = jwt.decode(examEnvironmentAuthorizationToken);

        expect(decodedToken).not.toHaveProperty(
          'examEnvironmentAuthorizationToken',
          token.id
        );

        expect(response.status).toBe(201);

        const tokens =
          await fastifyTestInstance.prisma.examEnvironmentAuthorizationToken.findMany(
            {
              where: { userId: defaultUserId }
            }
          );
        expect(tokens).toHaveLength(1);
      });

      test('POST does not generate a new token in non-production environments for non-staff', async () => {
        // Override deployment environment for this test
        mockDeploymentEnv = 'development';
        const response = await superPost('/user/exam-environment/token');
        expect(response.status).toBe(403);
      });

      test('POST does generate a new token in non-production environments for staff', async () => {
        // Override deployment environment for this test
        mockDeploymentEnv = 'staging';
        await fastifyTestInstance.prisma.user.update({
          where: {
            id: defaultUserId
          },
          data: { email: 'camperbot@freecodecamp.org' }
        });

        const response = await superPost('/user/exam-environment/token');