测试Meteor服务器方法与经过身份验证的用户一起调用客户端代码

Question

In a Meteor app, I need to test some client code that has statements such as

Meteor.call('foo', param1, param2, (error, result) => { .... });

And, in these methods, I have security checks to make sure that the method can only be called by authenticated users. However, all these tests fail during tests because no user is authenticated.

In each server methods, I check users like this

if (!Roles.userIsInRole(this.userId, [ ...roles ], group)) {
  throw new Meteor.Error('restricted', 'Access denied');
}

I have read that we should directly export the server methods and test them directly, and I actually do this for server methods testing, but it is not possible, here, since I need to test client code that depend on Meteor.call .

I also would certainly not want to have if (Meteor.isTest || Meteor.isAppTest) { ... } all over the place....

I thought perhaps wrapping my exported methods like this :

export default function methodsWrapper(methods) {

  Object.keys(methods).forEach(method => {
    const fn = methods[method];

    methods[method] = (...args) => {
      const user = Factory.create('user', { roles: { 'default': [ 'admin' ] } });

      return fn.call({ userId: user._id }, ...args);
    };

  });

};

But it only works when calling the methods directly.

I'm not sure how I can test my client code with correct security validations. How can I test my client code with authenticated users?

Answer 1

Part I: Making the function an exported function

You just need to add the exported method also to meteor methods.

imports/api/foo.js

export const foo = function(param1, param2){
    if (!Roles.userIsInRole(this.userId, [ ...roles ], group)) {
        throw new Meteor.Error('restricted', 'Access denied');
    }
    //....and other code
};

This method can then be imported in your server script:

imports/startup/methods.js

import {foo} from '../api/foo.js'

Meteor.methods({
    'foo' : foo
});

So it is available to be called via Mateor.call('foo'...). Note that the callback has not to be defined in foo's function header, since it is wrapped automatically by meteor.

imports/api/foo.tests.js

import {foo} from './foo.js'
if (Meteor.isServer) {
    // ... your test setup    
    const result = foo(...) // call foo directly in your test.
}

This is only on the server, now here is the thing for testing on the client: you will not come around calling it via Meteor.call and test the callback result. So on your client you still would test like:

imports/api/foo.tests.js

if (Meteor.isClient) {
    // ... your test setup    
    Meteor.call('foo', ..., function(err, res) {
        // assert no err and res...
    });
}

Additional info:

I would advice you to use mdg:validated-method which allows the same functionality above PLUS gives you more sophisticated control over method execution, document schema validation and flexibility. It is also documented well enough to allow you to implement your above described requirement.

See: https://github.com/meteor/validated-method

Part II: Running you integration test with user auth

You have two options here to test your user authentication. They have both advantages and disadvantages and there debates about what is the better approach. No mater which one of both you will test, you need to write a server method, that adds an existing user to given set of roles.

Approach 1 - Mocking Meteor.user() and Meter.userid()

This is basically described/discussed in the following resources:

A complete gist example

An example of using either mdg:validated-method or plain methods

Using sinon spy and below also an answer from myself by mocking it manually but this may not apply for your case because it is client-only. Using sinon requires the following package: https://github.com/practicalmeteor/meteor-sinon

Approach 2 - Copying the "real" application behavior

In this case you completely test without mocking anything. You create real users and use their data in other tests as well.

In any case you need a server method, that creates a new user by given name and roles. Note that it should only be in a file with .test.js as name. Otherwise it can be considered a risk for security.

/imports/api/accounts/accounts.tests.js

Meteor.methods({
    createtestUser(name,password, roles, group);
    const userId = Accounts.createUser({username:name, password:password});
    Roles.addUserToRoles(userId, roles, group);
    return userId;
});

Note: I often heard that this is bad testing, which I disagree. Especially integration testing should mime the real behavior as good as possible und should use less mocking/spying as unit tests do.