如何正确测试具有身份验证的RESTful API

Question

I would like to write automated tests for my Node.js API, and I've begun doing so using Mocha and Chai, using chai-http to manage the requests.

I've got a route to www.example.com/users, and have successfully written automated tests to register a user and log a user in, so I thought I was on the way, but now almost all of the other routes require the user to be authenticated! Since I'm mocking the database (using mockgoose with mongoose) during the test, I've already taken care of that dependency. But, this brings up the question, how do I get a user authenticated but still not expose my test to multiple, potentially changing pieces of code??

The flow through the program is relatively simple: upon requesting a secure resource, there is middleware that authenticates the user and then attaches a user object onto the request. That user object then makes it possible for routes to access the user's information and make calls to the database.

So, I suppose an ideal solution would attach a user object to the request object, once the call has been made to the API.

As I'm relatively new to testing, I'd welcome any feedback that would give me insight into better testing procedures.

Answer 1

I've since accomplished this task by utilizing the beforeEach hook offered by Mocha. In it, I call a function called seedDB , which mocks the database and returns an object with all of the information I need. The seedDB function actually posts to the API in order to do things like register a user and log them in, then makes both the user object and token accessible for use by my tests through the object. It's worked out very nicely so far because, when I change things within the API/validation routes, the tests automatically respond to the changes.