test: custom user status API tests with authentication and permission by jessicaschelly · Pull Request #39330 · RocketChat/Rocket.Chat

jessicaschelly · 2026-03-04T16:32:09Z

Proposed changes

Adds new test cases to improve coverage for the custom-user-status API endpoints.

New Test Cases

Create endpoint (custom-user-status.create):

Added test for invalid statusType validation

Update endpoint (custom-user-status.update):

Added test for duplicate name conflict when updating
Added test for invalid statusType validation

Delete endpoint (custom-user-status.delete):

Added test for non-existent status ID

Issue(s)

QA-113

Steps to test or reproduce

Further comments

Summary by CodeRabbit

Release Notes

This pull request contains no user-facing changes. It extends internal test coverage for custom user status functionality, including authentication, authorization, and validation test scenarios.

dionisio-bot · 2026-03-04T16:32:14Z

Looks like this PR is ready to merge! 🎉
If you have any trouble, please check the PR guidelines

changeset-bot · 2026-03-04T16:32:15Z

⚠️ No Changeset found

Latest commit: 699cc19

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

coderabbitai · 2026-03-04T16:32:20Z

Walkthrough

The custom-user-status end-to-end test suite was expanded to include comprehensive testing for create, update, and delete operations with authentication, authorization, validation, and lifecycle scenarios. Global setup/teardown logic was added for managing unauthorized user accounts and permissions.

Changes

Cohort / File(s)	Summary
Custom User Status E2E Tests `apps/meteor/tests/end-to-end/api/custom-user-status.ts`	Extended test coverage with unauthorized user workflows, permission testing, and new test suites for create/update/delete operations including authentication errors, duplicate validation, invalid parameters, and non-existent ID checks. Added global setup/teardown and per-test helper utilities.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Suggested labels

type: chore, area: authentication

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main change: adding end-to-end tests for custom user status API with focus on authentication and permission coverage.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

cubic-dev-ai

No issues found across 1 file

coderabbitai

🧹 Nitpick comments (2)

apps/meteor/tests/end-to-end/api/custom-user-status.ts (2)

23-30: Consider consolidating duplicate before hooks.

While Mocha allows multiple before hooks, consolidating them improves readability and maintains a single setup flow. The static analyzer flagged this as a duplicate hook.

♻️ Proposed consolidation

-	before((done) => {
-		getCredentials(done);
-	});
-
-	before(async () => {
-		unauthorizedUser = await createUser();
-		unauthorizedUserCredentials = await login(unauthorizedUser.username, password);
-	});
+	before(async function () {
+		await new Promise<void>((resolve) => getCredentials(resolve));
+		unauthorizedUser = await createUser();
+		unauthorizedUserCredentials = await login(unauthorizedUser.username, password);
+	});

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@apps/meteor/tests/end-to-end/api/custom-user-status.ts` around lines 23 - 30,
Consolidate the two before hooks into a single before hook that first runs
getCredentials and then creates/logs in the unauthorized user; update the before
to be an async function that awaits getCredentials (wrap its callback form in a
Promise if needed) and then awaits createUser() and login() to set
unauthorizedUser and unauthorizedUserCredentials. Target the getCredentials call
and the unauthorizedUser/unauthorizedUserCredentials assignments so the setup
runs in one sequential flow.

231-236: Redundant permission restoration in after hook.

The updatePermission('manage-user-status', ['admin']) call on line 235 is redundant since afterEach at line 228 already restores permissions after each test. The after hook runs after the last afterEach, so permissions will already be restored.

♻️ Proposed simplification

 	after(async () => {
 		if (customUserStatusId) {
 			await deleteCustomUserStatus(customUserStatusId);
 		}
-		await updatePermission('manage-user-status', ['admin']);
 	});

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@apps/meteor/tests/end-to-end/api/custom-user-status.ts` around lines 231 -
236, Remove the redundant permission restoration call from the after hook: the
afterEach already calls updatePermission('manage-user-status', ['admin']) for
every test, so in the after() block (which currently contains
deleteCustomUserStatus(customUserStatusId) and
updatePermission('manage-user-status', ['admin'])), keep the
deleteCustomUserStatus(customUserStatusId) cleanup but delete the
updatePermission('manage-user-status', ['admin']) line to avoid duplicate
restoration.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@apps/meteor/tests/end-to-end/api/custom-user-status.ts`:
- Around line 23-30: Consolidate the two before hooks into a single before hook
that first runs getCredentials and then creates/logs in the unauthorized user;
update the before to be an async function that awaits getCredentials (wrap its
callback form in a Promise if needed) and then awaits createUser() and login()
to set unauthorizedUser and unauthorizedUserCredentials. Target the
getCredentials call and the unauthorizedUser/unauthorizedUserCredentials
assignments so the setup runs in one sequential flow.
- Around line 231-236: Remove the redundant permission restoration call from the
after hook: the afterEach already calls updatePermission('manage-user-status',
['admin']) for every test, so in the after() block (which currently contains
deleteCustomUserStatus(customUserStatusId) and
updatePermission('manage-user-status', ['admin'])), keep the
deleteCustomUserStatus(customUserStatusId) cleanup but delete the
updatePermission('manage-user-status', ['admin']) line to avoid duplicate
restoration.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: a6f5aadb-b22f-451a-914c-529c3fff907a

📥 Commits

Reviewing files that changed from the base of the PR and between c68ac53 and 699cc19.

📒 Files selected for processing (1)

apps/meteor/tests/end-to-end/api/custom-user-status.ts

📜 Review details

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)

GitHub Check: cubic · AI code reviewer
GitHub Check: 📦 Build Packages
GitHub Check: CodeQL-Build

🧰 Additional context used

📓 Path-based instructions (1)

**/*.{ts,tsx,js}

📄 CodeRabbit inference engine (.cursor/rules/playwright.mdc)

**/*.{ts,tsx,js}: Write concise, technical TypeScript/JavaScript with accurate typing in Playwright tests
Avoid code comments in the implementation

Files:

apps/meteor/tests/end-to-end/api/custom-user-status.ts

🧠 Learnings (14)