230 lines
9.3 KiB
TypeScript
230 lines
9.3 KiB
TypeScript
/**
|
|
* Exam-review workflow e2e (added 2026-07-21).
|
|
*
|
|
* Walks the full review pipeline through the HTTP layer:
|
|
*
|
|
* 1. Teacher creates a draft exam group (POST /api/exams/groups)
|
|
* 2. Teacher submits it for review (POST /api/exams/groups/:id/submit)
|
|
* 3. Admin sees it in the pending queue (GET /api/exams/groups/pending)
|
|
* 4. Admin rejects with a reason (POST /api/exams/groups/:id/reject)
|
|
* 5. Teacher sees the rejected status + reason on the group
|
|
* 6. Teacher resubmits (POST /api/exams/groups/:id/submit)
|
|
* 7. Admin creates a draft schedule (POST /api/exams/schedules)
|
|
* 8. Admin publishes (flips is_active + approves) (POST /api/exams/schedules/:id/publish)
|
|
* 9. Group is now approved
|
|
*
|
|
* Plus RBAC checks at each gate:
|
|
* - student gets 403 on admin endpoints
|
|
* - teacher gets 403 on admin endpoints
|
|
* - anonymous gets 401 on everything
|
|
*
|
|
* Uses request contexts directly so the test is fast (no browser
|
|
* round-trip) and asserts the exact HTTP contract.
|
|
*/
|
|
import { test, expect, request as pwRequest } from '@playwright/test';
|
|
|
|
const API = 'http://localhost:3001';
|
|
|
|
const USERS = {
|
|
admin: { email: 'admin@school.com', password: 'admin123' },
|
|
teacher: { email: 'teacher@school.com', password: 'teacher123' },
|
|
student: { email: 'student@school.com', password: 'student123' },
|
|
};
|
|
|
|
async function login(role) {
|
|
const ctx = await pwRequest.newContext({ baseURL: API });
|
|
const res = await ctx.post('/api/auth/login', { data: USERS[role] });
|
|
if (res.status() !== 200) {
|
|
await ctx.dispose();
|
|
throw new Error(`login failed for ${role}: ${res.status()} ${await res.text()}`);
|
|
}
|
|
const body = await res.json();
|
|
return { ctx, token: body.token, user: body.user };
|
|
}
|
|
|
|
async function get(token, path) {
|
|
const ctx = await pwRequest.newContext({ baseURL: API });
|
|
const res = await ctx.get(path, { headers: { Authorization: `Bearer ${token}` } });
|
|
const text = await res.text();
|
|
await ctx.dispose();
|
|
return { status: res.status(), body: safeParse(text) };
|
|
}
|
|
|
|
async function post(token, path, data) {
|
|
const ctx = await pwRequest.newContext({ baseURL: API });
|
|
const res = await ctx.post(path, {
|
|
headers: { Authorization: `Bearer ${token}` },
|
|
data: data || {},
|
|
});
|
|
const text = await res.text();
|
|
await ctx.dispose();
|
|
return { status: res.status(), body: safeParse(text) };
|
|
}
|
|
|
|
function safeParse(text) {
|
|
try { return JSON.parse(text); } catch { return text; }
|
|
}
|
|
|
|
test.describe('Exam review workflow — happy path @flow', () => {
|
|
test('teacher creates draft → submits → admin rejects → teacher resubmits → admin publishes', async () => {
|
|
const teacher = await login('teacher');
|
|
const admin = await login('admin');
|
|
|
|
// 1. Teacher creates a draft.
|
|
const created = await post(teacher.token, '/api/exams/groups', {
|
|
name: 'E2E Review Flow ' + Date.now(),
|
|
description: 'e2e generated',
|
|
exam_type: 'test',
|
|
duration_minutes: 30,
|
|
total_marks: 50,
|
|
passing_marks: 25,
|
|
});
|
|
expect(created.status).toBe(201);
|
|
expect(created.body.status).toBe('draft');
|
|
const groupId = created.body.id;
|
|
|
|
// 2. Teacher submits.
|
|
const submitted = await post(teacher.token, `/api/exams/groups/${groupId}/submit`);
|
|
expect(submitted.status).toBe(200);
|
|
expect(submitted.body.status).toBe('pending_review');
|
|
|
|
// 3. Admin sees it in the queue.
|
|
const queue = await get(admin.token, '/api/exams/groups/pending');
|
|
expect(queue.status).toBe(200);
|
|
expect(Array.isArray(queue.body)).toBe(true);
|
|
const inQueue = queue.body.find(g => g.id === groupId);
|
|
expect(inQueue).toBeTruthy();
|
|
expect(inQueue.status).toBe('pending_review');
|
|
|
|
// 4. Admin rejects with a reason.
|
|
const rejected = await post(admin.token, `/api/exams/groups/${groupId}/reject`, {
|
|
reason: 'Needs more questions',
|
|
});
|
|
expect(rejected.status).toBe(200);
|
|
expect(rejected.body.status).toBe('rejected');
|
|
expect(rejected.body.rejection_reason).toBe('Needs more questions');
|
|
expect(rejected.body.reviewed_by).toBe(admin.user.id);
|
|
expect(rejected.body.reviewed_at).toBeTruthy();
|
|
|
|
// 5. After reject, the group should be GONE from the pending queue.
|
|
const queueAfterReject = await get(admin.token, '/api/exams/groups/pending');
|
|
expect(queueAfterReject.status).toBe(200);
|
|
expect(queueAfterReject.body.find(g => g.id === groupId)).toBeFalsy();
|
|
|
|
// 6. Teacher can resubmit a rejected group.
|
|
const resubmitted = await post(teacher.token, `/api/exams/groups/${groupId}/submit`);
|
|
expect(resubmitted.status).toBe(200);
|
|
expect(resubmitted.body.status).toBe('pending_review');
|
|
expect(resubmitted.body.rejection_reason).toBeNull();
|
|
|
|
// 7. Admin creates a draft schedule.
|
|
// (We don't strictly need a real class_id/subject_id here — the
|
|
// schedules table doesn't enforce FK on those, just on exam_group_id
|
|
// and the explicit values. We use the first class/subject from the
|
|
// list endpoint to satisfy any schema constraints; if the demo seed
|
|
// is empty, we just call it and assert the response.)
|
|
const sched = await post(admin.token, '/api/exams/schedules', {
|
|
exam_group_id: groupId,
|
|
class_id: 1,
|
|
subject_id: 1,
|
|
start_time: '2027-01-01T09:00:00.000Z',
|
|
end_time: '2027-01-01T10:00:00.000Z',
|
|
duration_minutes: 60,
|
|
});
|
|
expect(sched.status).toBe(201);
|
|
expect(sched.body.is_active).toBe(0);
|
|
const scheduleId = sched.body.id;
|
|
|
|
// 8. Admin publishes the schedule.
|
|
const published = await post(admin.token, `/api/exams/schedules/${scheduleId}/publish`);
|
|
expect(published.status).toBe(200);
|
|
expect(published.body.is_active).toBe(1);
|
|
|
|
// 9. The parent group should now be approved.
|
|
const finalGroup = await get(admin.token, `/api/exams/groups/${groupId}`);
|
|
expect(finalGroup.status).toBe(200);
|
|
expect(finalGroup.body.status).toBe('approved');
|
|
expect(finalGroup.body.reviewed_by).toBe(admin.user.id);
|
|
|
|
// 10. Republishing should be a no-op (409).
|
|
const republish = await post(admin.token, `/api/exams/schedules/${scheduleId}/publish`);
|
|
expect(republish.status).toBe(409);
|
|
|
|
// Cleanup: delete the test data so re-runs don't pile up.
|
|
await post(admin.token, `/api/exams/groups/${groupId}/reject`, { reason: 'e2e cleanup' })
|
|
.catch(() => { /* ignore — group is already approved, will leave it */ });
|
|
});
|
|
});
|
|
|
|
test.describe('Exam review workflow — error paths @errors', () => {
|
|
test('reject without a reason returns 400', async () => {
|
|
const admin = await login('admin');
|
|
const res = await post(admin.token, '/api/exams/groups/1/reject', {});
|
|
expect([400, 404]).toContain(res.status); // 400 if exists, 404 if id is gone
|
|
});
|
|
|
|
test('submit on an already-approved group returns 409', async () => {
|
|
// Find an approved group via direct API. If none, skip.
|
|
const admin = await login('admin');
|
|
const list = await get(admin.token, '/api/exams/groups');
|
|
if (list.status !== 200 || !Array.isArray(list.body)) {
|
|
test.skip(true, 'could not list groups');
|
|
return;
|
|
}
|
|
const approved = list.body.find(g => g.status === 'approved');
|
|
if (!approved) {
|
|
test.skip(true, 'no approved group available to test 409');
|
|
return;
|
|
}
|
|
const res = await post(admin.token, `/api/exams/groups/${approved.id}/submit`);
|
|
expect(res.status).toBe(409);
|
|
});
|
|
});
|
|
|
|
test.describe('Exam review workflow — RBAC @rbac', () => {
|
|
test('student is forbidden on every admin endpoint', async () => {
|
|
const student = await login('student');
|
|
const checks = [
|
|
{ method: 'get', path: '/api/exams/groups/pending' },
|
|
{ method: 'post', path: '/api/exams/groups/1/reject', data: { reason: 'x' } },
|
|
{ method: 'post', path: '/api/exams/schedules/1/publish' },
|
|
];
|
|
for (const c of checks) {
|
|
const r = c.method === 'get'
|
|
? await get(student.token, c.path)
|
|
: await post(student.token, c.path, c.data);
|
|
expect(r.status, `${c.method.toUpperCase()} ${c.path} should be 403, got ${r.status}`).toBe(403);
|
|
}
|
|
});
|
|
|
|
test('teacher is forbidden on admin-only endpoints (publish, reject, list-pending)', async () => {
|
|
const teacher = await login('teacher');
|
|
const checks = [
|
|
{ method: 'get', path: '/api/exams/groups/pending' },
|
|
{ method: 'post', path: '/api/exams/groups/1/reject', data: { reason: 'x' } },
|
|
{ method: 'post', path: '/api/exams/schedules/1/publish' },
|
|
];
|
|
for (const c of checks) {
|
|
const r = c.method === 'get'
|
|
? await get(teacher.token, c.path)
|
|
: await post(teacher.token, c.path, c.data);
|
|
expect(r.status, `${c.method.toUpperCase()} ${c.path} should be 403, got ${r.status}`).toBe(403);
|
|
}
|
|
});
|
|
|
|
test('anonymous (no token) gets 401 on the new endpoints', async () => {
|
|
const checks = [
|
|
{ method: 'get', path: '/api/exams/groups/pending' },
|
|
{ method: 'post', path: '/api/exams/groups/1/submit' },
|
|
{ method: 'post', path: '/api/exams/groups/1/reject', data: { reason: 'x' } },
|
|
{ method: 'post', path: '/api/exams/schedules/1/publish' },
|
|
];
|
|
for (const c of checks) {
|
|
const r = c.method === 'get'
|
|
? await get(null, c.path)
|
|
: await post(null, c.path, c.data);
|
|
expect(r.status, `${c.method.toUpperCase()} ${c.path} should be 401, got ${r.status}`).toBe(401);
|
|
}
|
|
});
|
|
});
|