+
diff --git a/web/snapshots/brass_web__endpoints__clothing__get_read__tests__inner_produces_template_fine_when_user_is_admin.snap b/web/snapshots/brass_web__endpoints__clothing__get_read__tests__inner_produces_template_fine_when_user_is_admin.snap
new file mode 100644
index 00000000..8b0f8f30
--- /dev/null
+++ b/web/snapshots/brass_web__endpoints__clothing__get_read__tests__inner_produces_template_fine_when_user_is_admin.snap
@@ -0,0 +1,26 @@
+---
+source: web/src/endpoints/clothing/get_read.rs
+expression: body
+snapshot_kind: text
+---
+
diff --git a/web/snapshots/brass_web__endpoints__events__get_edit__inner_produces_template.snap b/web/snapshots/brass_web__endpoints__events__get_edit__inner_produces_template.snap
index 5558d7c3..988f3899 100644
--- a/web/snapshots/brass_web__endpoints__events__get_edit__inner_produces_template.snap
+++ b/web/snapshots/brass_web__endpoints__events__get_edit__inner_produces_template.snap
@@ -165,7 +165,7 @@ snapshot_kind: text
diff --git a/web/src/endpoints/clothing/delete.rs b/web/src/endpoints/clothing/delete.rs
index c1c406b8..842eacb9 100644
--- a/web/src/endpoints/clothing/delete.rs
+++ b/web/src/endpoints/clothing/delete.rs
@@ -25,3 +25,67 @@ pub async fn delete(
Ok(HttpResponse::Ok().finish())
}
+
+#[cfg(test)]
+mod tests {
+ use crate::{
+ models::{Clothing, Role},
+ utils::test_helper::{
+ test_delete, DbTestContext, RequestConfig,
+ StatusCode,
+ },
+ };
+ use brass_macros::db_test;
+
+ #[db_test]
+ async fn deletes_clothing_fine_when_user_is_admin(context: &DbTestContext) {
+ let app = context.app().await;
+
+ Clothing::create(&context.db_pool, "Tuchuniform")
+ .await
+ .unwrap();
+ assert_eq!(2, Clothing::read_all(&context.db_pool).await.unwrap().len());
+
+ let config = RequestConfig::new("/clothing/1").with_role(Role::Admin);
+
+ let response = test_delete(&context.db_pool, app, &config).await;
+ assert_eq!(StatusCode::OK, response.status());
+
+ assert_eq!(1, Clothing::read_all(&context.db_pool).await.unwrap().len());
+ // TODO: reduce numbers by one when db migrations are joined together
+ }
+
+ #[db_test]
+ async fn returns_unauthorized_when_user_is_user(context: &DbTestContext) {
+ let app = context.app().await;
+ let response = test_delete(&context.db_pool, app, &RequestConfig::new("/clothing/1")).await;
+
+ assert_eq!(StatusCode::UNAUTHORIZED, response.status());
+ }
+
+ #[db_test]
+ async fn returns_unauthorized_when_user_is_area_manager(context: &DbTestContext) {
+ let app = context.app().await;
+ let response = test_delete(
+ &context.db_pool,
+ app,
+ &RequestConfig::new("/clothing/1").with_role(Role::AreaManager),
+ )
+ .await;
+
+ assert_eq!(StatusCode::UNAUTHORIZED, response.status());
+ }
+
+ #[db_test]
+ async fn returns_not_found_when_clothing_does_not_exist(context: &DbTestContext) {
+ let app = context.app().await;
+ let response = test_delete(
+ &context.db_pool,
+ app,
+ &RequestConfig::new("/clothing/100").with_role(Role::Admin),
+ )
+ .await;
+
+ assert_eq!(StatusCode::NOT_FOUND, response.status());
+ }
+}
diff --git a/web/src/endpoints/clothing/get_edit.rs b/web/src/endpoints/clothing/get_edit.rs
index 5e141e00..575afd16 100644
--- a/web/src/endpoints/clothing/get_edit.rs
+++ b/web/src/endpoints/clothing/get_edit.rs
@@ -28,3 +28,58 @@ pub async fn get(
Ok(template.to_response()?)
}
+
+#[cfg(test)]
+mod tests {
+ use crate::{
+ models::{Clothing, Role},
+ utils::test_helper::{
+ assert_snapshot, read_body, test_get, DbTestContext, RequestConfig, StatusCode,
+ },
+ };
+ use brass_macros::db_test;
+
+ #[db_test]
+ async fn user_cant_view_edit_entity(context: &DbTestContext) {
+ Clothing::create(&context.db_pool, "Tuchuniform")
+ .await
+ .unwrap();
+
+ let app = context.app().await;
+
+ let config = RequestConfig::new("/clothing/edit/1");
+
+ let response = test_get(&context.db_pool, &app, &config).await;
+ assert_eq!(StatusCode::UNAUTHORIZED, response.status());
+ }
+
+ #[db_test]
+ async fn area_manager_cant_view_edit_entity(context: &DbTestContext) {
+ Clothing::create(&context.db_pool, "Tuchuniform")
+ .await
+ .unwrap();
+
+ let app = context.app().await;
+
+ let config = RequestConfig::new("/clothing/edit/1").with_role(Role::AreaManager);
+
+ let response = test_get(&context.db_pool, &app, &config).await;
+ assert_eq!(StatusCode::UNAUTHORIZED, response.status());
+ }
+
+ #[db_test]
+ async fn produces_template_fine_when_user_is_admin(context: &DbTestContext) {
+ let app = context.app().await;
+ Clothing::create(&context.db_pool, "Schutzkleidung Form 1")
+ .await
+ .unwrap();
+
+ let config = RequestConfig::new("/clothing/edit/1").with_role(Role::Admin);
+
+ let response = test_get(&context.db_pool, &app, &config).await;
+ assert_eq!(StatusCode::OK, response.status());
+
+ let body = read_body(response).await;
+ assert_snapshot!(body);
+ }
+}
diff --git a/web/src/endpoints/clothing/get_read.rs b/web/src/endpoints/clothing/get_read.rs
index def1e169..fe4a0565 100644
--- a/web/src/endpoints/clothing/get_read.rs
+++ b/web/src/endpoints/clothing/get_read.rs
@@ -25,3 +25,58 @@ pub async fn get(
Ok(template.to_response()?)
}
+
+#[cfg(test)]
+mod tests {
+ use crate::{
+ models::{Clothing, Role},
+ utils::test_helper::{
+ assert_snapshot, read_body, test_get, DbTestContext, RequestConfig, StatusCode,
+ },
+ };
+ use brass_macros::db_test;
+
+ #[db_test]
+ async fn user_cant_view_single_entity(context: &DbTestContext) {
+ Clothing::create(&context.db_pool, "Tuchuniform")
+ .await
+ .unwrap();
+
+ let app = context.app().await;
+
+ let config = RequestConfig::new("/clothing/1");
+
+ let response = test_get(&context.db_pool, &app, &config).await;
+ assert_eq!(StatusCode::UNAUTHORIZED, response.status());
+ }
+
+ #[db_test]
+ async fn area_manager_cant_view_single_entity(context: &DbTestContext) {
+ Clothing::create(&context.db_pool, "Tuchuniform")
+ .await
+ .unwrap();
+
+ let app = context.app().await;
+
+ let config = RequestConfig::new("/clothing/1").with_role(Role::AreaManager);
+
+ let response = test_get(&context.db_pool, &app, &config).await;
+ assert_eq!(StatusCode::UNAUTHORIZED, response.status());
+ }
+
+ #[db_test]
+ async fn produces_template_fine_when_user_is_admin(context: &DbTestContext) {
+ let app = context.app().await;
+ Clothing::create(&context.db_pool, "Schutzkleidung Form 1")
+ .await
+ .unwrap();
+
+ let config = RequestConfig::new("/clothing/1").with_role(Role::Admin);
+
+ let response = test_get(&context.db_pool, &app, &config).await;
+ assert_eq!(StatusCode::OK, response.status());
+
+ let body = read_body(response).await;
+ assert_snapshot!(body);
+ }
+}