It's now time to turn our attention to the user authentication service. We've mentioned tests of this service, saying that we'll get to them later. We had developed some scripts for ad hoc testing, which have been useful all along. But later is now, and it's time to get cracking on some real tests.

There's a question of which tool to use for testing the authentication service. Mocha does a good job of organizing a series of test cases, and we should reuse it here. But the thing we have to test is a REST service. The customer of this service, the Notes application, uses it through the REST API, giving us a perfect rationalization to test at the REST interface. Our ad hoc scripts used the SuperAgent library to simplify making REST API calls. There happens to be a companion library, SuperTest, that is meant for REST API testing. Read its documentation here: https://www.npmjs.com/package/supertest.

We've already made the test-compose/userauth directory. In that directory, create a file named test.js:

'use strict';

const assert = require('chai').assert;
const request = require('supertest')(process.env.URL_USERS_TEST);
const util = require('util');
const url = require('url');
const URL = url.URL;

const authUser = 'them';
const authKey = 'D4ED43C0-8BD6-4FE2-B358-7C0E230D11EF';

describe("Users Test", function() {
    ... Test code follows
});

This sets up Mocha and the SuperTest client. The URL_USERS_TEST environment variable specifies the base URL of the server to run the test against. You'll almost certainly be using http://localhost:3333 given the configuration we've used earlier in the book. SuperTest initializes itself a little differently to SuperAgent. The SuperTest module exposes a function that we call with the  URL_USERS_TEST environment variable, then we use THAT request object throughout the rest of the script to make REST API requests.

This variable was already set in test-compose/docker-compose.yml with the required value. The other thing of importance is a pair of variables to store the authentication user ID and key:

beforeEach(async function() {
  await request.post('/create-user')
       .send({ 
          username: "me", password: "w0rd", provider: "local",
          familyName: "Einarrsdottir", givenName: "Ashildr", 
          middleName: "",
          emails: [], photos: []
        })
        .set('Content-Type', 'application/json')
        .set('Acccept', 'application/json')
        .auth(authUser, authKey);
});
    
afterEach(async function() {
  await request.delete('/destroy/me')
        .set('Content-Type', 'application/json')
        .set('Acccept', 'application/json')
        .auth(authUser, authKey);
}); 

If you remember, the beforeEach function is run immediately before every test case, and afterEach is run afterward. These functions use the REST API to create our test user before running the test, and then afterward to destroy the test user. That way our tests can assume this user will exist:

describe("List user", function() {
   it("list created users", async function() {
     const res = await request.get('/list')
          .set('Content-Type', 'application/json')
          .set('Acccept', 'application/json')
          .auth(authUser, authKey);
    assert.exists(res.body);
    assert.isArray(res.body);
    assert.lengthOf(res.body, 1);
    assert.deepEqual(res.body[0], { 
          username: "me", id: "me", provider: "local",
          familyName: "Einarrsdottir", givenName: "Ashildr", 
          middleName: "",
          emails: [], photos: []
    });
  });
});

Now, we can turn to testing some API methods, such as the /list operation.

We have already guaranteed that there is an account, in the beforeEach method, so /list should give us an array with one entry.

This follows the general pattern for using Mocha to test a REST API method. First, we use SuperTest's request object to call the API method, and await its result. Once we have the result, we use assert methods to validate it is what is expected:

describe("find user", function() {
  it("find created users", async function() {
    const res = await request.get('/find/me')
            .set('Content-Type', 'application/json')
            .set('Acccept', 'application/json')
            .auth(authUser, authKey);
    assert.exists(res.body);
    assert.isObject(res.body);
    assert.deepEqual(res.body, { 
            username: "me", id: "me", provider: "local",
            familyName: "Einarrsdottir", givenName: "Ashildr", 
            middleName: "",
            emails: [], photos: []
    });
});
it("fail to find non-existent users", async function() {
    var res;
    try {
      res = await request.get('/find/nonExistentUser')
            .set('Content-Type', 'application/json')
            .set('Acccept', 'application/json')
            .auth(authUser, authKey);
    } catch(e) {
      return; // Test is okay in this case
    }
    assert.exists(res.body);
    assert.isObject(res.body);
    assert.deepEqual(res.body, {});
  });
});    

We are checking the /find operation in two ways:

• Looking for the account we know exists – failure is indicated if the user account is not found
• Looking for the one we know does not exist – failure is indicated if we receive something other than an error or an empty object

Add this test case:

describe("delete user", function() {
  it("delete nonexistent users", async function() {
    var res;
    try {
      res = await request.delete('/destroy/nonExistentUser')
              .set('Content-Type', 'application/json')
              .set('Acccept', 'application/json')
              .auth(authUser, authKey);
    } catch(e) {
      return; // Test is okay in this case
    }
    assert.exists(res);
    assert.exists(res.error);
    assert.notEqual(res.status, 200);
  });
}); 

Finally, we should check the /destroy operation. We already check this operation in the afterEach method, where we destroy a known user account. We need to also perform the negative test and verify its behavior against an account we know does not exist.

The desired behavior is that either an error is thrown, or the result shows an HTTP status indicating an error. In fact, the current authentication server code gives a 500 status code along with some other information.

In test-compose/docker-compose.yml, we need to inject this script, test.js, into the userauth-test container. We'll add that here:

userauth-test:
  ...
  volumes:
    - ./reports-userauth:/reports
    - ./userauth/sequelize-docker-test-mysql.yaml:/userauth/sequelize-docker-test-mysql.yaml
    - ./userauth/test.js:/userauth/test.js

We have a test script, and have injected that script into the desired container (userauth-test). The next step is to automate running this test. One way is to add this to run.sh (aka run.ps1 on Windows):

docker exec -it -e DEBUG= userauth-test npm install supertest mocha chai
docker exec -it -e DEBUG= userauth-test ./node_modules/.bin/mocha test.js

Now, if you run the run.sh test script you'll see the required packages get installed, and then this test suite execution.