86 lines
2.7 KiB
JavaScript
86 lines
2.7 KiB
JavaScript
import { afterAll, beforeAll, describe, expect, test } from 'vitest';
|
|
import {
|
|
assertFails,
|
|
assertSucceeds,
|
|
initializeTestEnvironment,
|
|
} from '@firebase/rules-unit-testing';
|
|
import { doc, getDoc, setDoc, updateDoc } from 'firebase/firestore';
|
|
import fs from 'node:fs';
|
|
import path from 'node:path';
|
|
|
|
const projectId = 'motorsignal-emulator';
|
|
let testEnv;
|
|
|
|
beforeAll(async () => {
|
|
testEnv = await initializeTestEnvironment({
|
|
projectId,
|
|
firestore: {
|
|
rules: fs.readFileSync(path.resolve(process.cwd(), '../../firestore.rules'), 'utf8'),
|
|
},
|
|
});
|
|
});
|
|
|
|
afterAll(async () => {
|
|
await testEnv?.cleanup();
|
|
});
|
|
|
|
describe('MotorCloud ride ownership rules', () => {
|
|
test('a signed-in owner can create and read their own ride', async () => {
|
|
const alice = testEnv.authenticatedContext('alice').firestore();
|
|
const ride = doc(alice, 'users/alice/rides/ride_test_alice');
|
|
|
|
await assertSucceeds(setDoc(ride, {
|
|
id: 'ride_test_alice',
|
|
ownerId: 'alice',
|
|
startTime: '2026-09-01T00:00:00.000Z',
|
|
}));
|
|
await assertSucceeds(getDoc(ride));
|
|
});
|
|
|
|
test('User A cannot read or update User B ride data', async () => {
|
|
const alice = testEnv.authenticatedContext('alice').firestore();
|
|
const bob = testEnv.authenticatedContext('bob').firestore();
|
|
const bobRideForSetup = doc(bob, 'users/bob/rides/ride_bob');
|
|
const bobRideForAlice = doc(alice, 'users/bob/rides/ride_bob');
|
|
|
|
await assertSucceeds(setDoc(bobRideForSetup, {
|
|
id: 'ride_bob',
|
|
ownerId: 'bob',
|
|
startTime: '2026-09-01T00:00:00.000Z',
|
|
}));
|
|
|
|
await assertFails(getDoc(bobRideForAlice));
|
|
await assertFails(updateDoc(bobRideForAlice, { distanceMiles: 999 }));
|
|
});
|
|
|
|
test('a caller cannot create a ride with another ownerId', async () => {
|
|
const alice = testEnv.authenticatedContext('alice').firestore();
|
|
const forged = doc(alice, 'users/alice/rides/ride_forged');
|
|
|
|
await assertFails(setDoc(forged, {
|
|
id: 'ride_forged',
|
|
ownerId: 'bob',
|
|
startTime: '2026-09-01T00:00:00.000Z',
|
|
}));
|
|
});
|
|
|
|
test('a caller cannot change an existing ride ownerId', async () => {
|
|
const alice = testEnv.authenticatedContext('alice').firestore();
|
|
const ride = doc(alice, 'users/alice/rides/ride_owner_lock');
|
|
|
|
await assertSucceeds(setDoc(ride, {
|
|
id: 'ride_owner_lock',
|
|
ownerId: 'alice',
|
|
startTime: '2026-09-01T00:00:00.000Z',
|
|
}));
|
|
await assertFails(updateDoc(ride, { ownerId: 'bob' }));
|
|
});
|
|
|
|
test('signed-out callers cannot access user-owned rides', async () => {
|
|
const unauthenticated = testEnv.unauthenticatedContext().firestore();
|
|
const ride = doc(unauthenticated, 'users/alice/rides/ride_test_alice');
|
|
|
|
await assertFails(getDoc(ride));
|
|
});
|
|
});
|