Repository: freeCodeCamp/freeCodeCamp
File: api/src/routes/protected/user.test.ts (TypeScript)

Code before:

        expect(response.status).toBe(200);
      });

      test('POST only allows for one token per user id', async () => {
        const id = customNanoid();
        await fastifyTestInstance.prisma.examEnvironmentAuthorizationToken.create(
          {
            data: {
              userId: defaultUserId,
              id,
              createdDate: new Date()
            }
          }
        );

        const response = await superPost('/user/exam-environment/token');

        const { examEnvironmentAuthorizationToken } = response.body.data;

        const decodedToken = jwt.decode(examEnvironmentAuthorizationToken);

        expect(decodedToken).not.toStrictEqual({
          examEnvironmentAuthorizationToken: id,
          iat: expect.any(Number)
        });

        expect(response.status).toBe(200);

        const tokens =
          await fastifyTestInstance.prisma.examEnvironmentAuthorizationToken.findMany(
            {
              where: { userId: defaultUserId }
            }
          );
        expect(tokens).toHaveLength(1);
      });
    });
  });

  describe('Unauthenticated user', () => {
    let setCookies: string[];
    // Get the CSRF cookies from an unprotected route
    beforeAll(async () => {
      const res = await superRequest('/status/ping', { method: 'GET' });
      setCookies = res.get('Set-Cookie');
    });

    const endpoints: { path: string; method: 'GET' | 'POST' | 'DELETE' }[] = [
      { path: '/account/delete', method: 'POST' },
      { path: '/account/reset-progress', method: 'POST' },

Review comment (security):
```suggestion
        expect(decodedToken).not.toHaveProperty(
          'examEnvironmentAuthorizationToken',
          id
        );
```
Nit: this seems better aligned with what we're interested in (that the token has updated).

Code after:

        expect(response.status).toBe(200);
      });

      test('POST only allows for one token per user id', async () => {
        const id = customNanoid();
        await fastifyTestInstance.prisma.examEnvironmentAuthorizationToken.create(
          {
            data: {
              userId: defaultUserId,
              id,
              createdDate: new Date()
            }
          }
        );

        const response = await superPost('/user/exam-environment/token');

        const { examEnvironmentAuthorizationToken } = response.body.data;

        const decodedToken = jwt.decode(examEnvironmentAuthorizationToken);

        expect(decodedToken).not.toHaveProperty(
          'examEnvironmentAuthorizationToken',
          id
        );

        expect(response.status).toBe(200);

        const tokens =
          await fastifyTestInstance.prisma.examEnvironmentAuthorizationToken.findMany(
            {
              where: { userId: defaultUserId }
            }
          );
        expect(tokens).toHaveLength(1);
      });
    });
  });

  describe('Unauthenticated user', () => {
    let setCookies: string[];
    // Get the CSRF cookies from an unprotected route
    beforeAll(async () => {
      const res = await superRequest('/status/ping', { method: 'GET' });
      setCookies = res.get('Set-Cookie');
    });

    const endpoints: { path: string; method: 'GET' | 'POST' | 'DELETE' }[] = [
      { path: '/account/delete', method: 'POST' },
      { path: '/account/reset-progress', method: 'POST' },