Add unit tests

test/unit/lib/api/users.specs.js

@@ -450,6 +450,47 @@ test.describe('users api', () => {
         })
       })
 
+      test.it('should resolve if target user has plugin role and only adminPermissions are being updated', () => {
+        commandsMocks.stubs.user.getById.resolves({
+          role: 'plugin'
+        })
+
+        return operations.updateUser.auth(fooUser, fooParams, {
+          adminPermissions: true
+        }).then(() => {
+          return test.expect(true).to.be.true()
+        })
+      })
+
+      test.it('should reject if target user has plugin role and any other key plus adminPermissions is being updated', () => {
+        commandsMocks.stubs.user.getById.resolves({
+          role: 'plugin'
+        })
+
+        return operations.updateUser.auth(fooUser, fooParams, {
+          adminPermissions: true,
+          name: 'foo'
+        }).then(() => {
+          return test.assert.fail()
+        }, err => {
+          return test.expect(err).to.be.an.instanceof(Error)
+        })
+      })
+
+      test.it('should reject if target user has plugin role and any other key than adminPermissions is being updated', () => {
+        commandsMocks.stubs.user.getById.resolves({
+          role: 'plugin'
+        })
+
+        return operations.updateUser.auth(fooUser, fooParams, {
+          name: 'foo'
+        }).then(() => {
+          return test.assert.fail()
+        }, err => {
+          return test.expect(err).to.be.an.instanceof(Error)
+        })
+      })
+
       test.it('should reject if user is not admin and wants to update role', () => {
         commandsMocks.stubs.user.getById.resolves({
           role: 'operator'

test/unit/lib/commands/securityToken.specs.js

@@ -41,6 +41,10 @@ test.describe('securityToken commands', () => {
       const fooUserData = {
         _id: fooUserId
       }
+      const fooCreatorId = 'foo-creator-id'
+      const fooCreatorData = {
+        _id: fooCreatorId
+      }
       test.it('should create and save a SecurityToken model with the received user data', () => {
         return commands.add(fooUserData, 'jwt')
           .then(() => {
@@ -49,7 +53,24 @@ test.describe('securityToken commands', () => {
               test.expect(modelsMocks.stubs.SecurityToken).to.have.been.calledWith({
                 _user: fooUserId,
                 token: 'foo-token',
-                type: 'jwt'
+                type: 'jwt',
+                createdBy: undefined
+              }),
+              test.expect(modelsMocks.stubs.securityToken.save).to.have.been.called()
+            ])
+          })
+      })
+
+      test.it('should add the user creator id to the securityToken', () => {
+        return commands.add(fooUserData, 'apiKey', fooCreatorData)
+          .then(() => {
+            return Promise.all([
+              test.expect(randTokenStub).to.have.been.called(),
+              test.expect(modelsMocks.stubs.SecurityToken).to.have.been.calledWith({
+                _user: fooUserId,
+                token: 'foo-token',
+                type: 'apiKey',
+                createdBy: fooCreatorId
               }),
               test.expect(modelsMocks.stubs.securityToken.save).to.have.been.called()
             ])

test/unit/lib/security/utils.specs.js

@@ -58,6 +58,30 @@ test.describe('security utils', () => {
           ])
         })
     })
+
+    test.it('should override role to admin if user has adminPermissions property set to true', () => {
+      const fooToken = 'fooToken'
+      commandsMocks.stubs.securityToken.getUser.resolves({
+        _id: 'fooId',
+        name: 'fooName',
+        email: 'fooEmail',
+        role: 'fooRole',
+        password: 'fooPassword',
+        adminPermissions: true
+      })
+      return getUserBySecurityToken(fooToken)
+        .then(result => {
+          return Promise.all([
+            test.expect(commandsMocks.stubs.securityToken.getUser).to.have.been.calledWith(fooToken),
+            test.expect(result).to.deep.equal({
+              _id: 'fooId',
+              name: 'fooName',
+              email: 'fooEmail',
+              role: 'admin'
+            })
+          ])
+        })
+    })
   })
 
   test.describe('AdminOrOwner instance', () => {