You've used a super test to test the sign up route which creates data and the lag in route which needs
existing data to be in place.
In this lesson you're going to learn how to test an endpoint that requires authentication in order to
work such as the end point for getting your user profile or the endpoint for deleting and closing your
account.
So to get this done we need an authentication token that super test in our test cases can actually access
much like our test cases.
Access to the user's credentials down below.
So what we're going to do is start by modifying the data up here.
We want to make sure that when we save this user to the database they have an authentication token that
can be used by our test cases.
Note to get this done we'll need to do two very important things.
First stop will need to generate our own object I.D. for this user will need to know what the I.D. is
ahead of time so we can actually create the correct token and then two will have to create the token.
So up above let's go ahead and load in the additional stuff we're gonna need.
And don't worry in a couple of videos we'll talk about how we can better structure things so it's not
all in a single file.
For now though we'll go ahead and load in first JWT so I can generate that Jason web token so I'll load
that NPM library in.
Which is already installed and next up we're going to load in Mongoose so we can actually generate our
very own object I.D. right here requiring that library.
Perfect.
No down below.
Let's start by creating the I.D..
I'm gonna create a new variable called User 1 I.D. and we're gonna use Mongoose to generate a new I.D.
And we do that using the following code.
The new operator with the following that is Mongoose dot capital T types dot object I.D..
Just like that.
Now the reason I'm creating this as a standalone variable outside of this object is because I need to
use it in two places.
I'll be using it once right here as the I.D. for the user.
So user 1 I.D. and I'll be using it again when I actually add tokens to the user we create.
So right here I'll add a comma after password and we'll set up a tokens array so we can give this user
and authentication token which we can use.
That's the whole purpose of doing this right here.
We're gonna set up that token property and we're going to create a new Jason web token and using JWT
dot sign exactly like we would've done from anywhere else in our app.
Now to create a valid one all we do is provide the I.D. like we've been doing before.
User 1 I.D. And we also provide these secret process dot EMV dot right here JWT underscore secret now
that we have this in place when our test user gets created we will have an I.D. and a token associated
with that user that we can take advantage of.
Now if I save things in their current state I would expect everything to be working as expected.
Right here my test cases are running and I have nine passing tests.
That means down below we can actually go ahead and use this token to create a new test case that interacts
with one of our endpoints that requires authentication down below.
Let's go ahead and start with the end point for fetching the user's profile.
Well let's get started with our first test case we can pick a name for this one.
Something like should get profile for user and we'll set it up as an async function.
And the first and pretty much only thing we're going to do inside of here like our other test cases
is use super test.
So I will call request I'll pass in the Express app and this time to get the profile.
It is a get h TTP request instead of post so I will use get from there.
We're gonna go ahead and provide the path that is forward slash users forward slash me.
Now we can go ahead and send that off by calling send.
We can leave this as empty.
There is no need to provide a request body.
And last up we'll expect something I'll expect that I get a two hundred back when things go well.
Now the problem here is that at no point do we set up the authentication header.
So if we did try to run this we would not get a two hundred back.
We can see down below this one new test is failing what we need to do is tell Super Test we want to
set the authorization header now to do this I'm going to restructure the code a little bit when we work
with an API that has a lot of chaining.
There are a lot of different ways people seem to structure it.
In general it's a good idea to keep the different method calls on their own line.
So this allows you to stay a bit organized.
So something like this is clear and easy to pass mentally.
So we'll use an approach like this.
You could also leave the first method call on the original line.
You'll see some people use something like this as well.
It's not important which one you use.
It's important though that you do go ahead and stay consistent.
Now yes we have some inconsistencies we'll address those in a little bit.
For now I'll go ahead and leave each method call on its own line.
Perfect so to set the header we use these set method and we want to use it before we send the request
off.
So I'll use it right here.
That is dot set and we provide to it to arguments.
The first is the name of the header we're trying to set in our case as we know that is authorization.
And the second is the value we're trying to set.
Now this is going to include our token.
So I'll go ahead and stick with a template string here and we start off with bearer space followed by
that token right here inside of the template string I'll use the syntax for injecting a value and the
value is stored on user 1.
It is user 1 dot tokens.
That's an array.
We'll grab the first one and we'll access the token property.
So this right here is exactly what we had set up up above.
It is the value that comes back from JWT a dot sign.
Now this is going to work if what if the server confirms that this token is valid.
It's not expired and it's actually stored in the tokens array for that user.
If I save the user test suite it's going to rerun everything and hopefully we are back to a completely
passing test suite and we are 10 of 10 passing tests.
So what you set to set up headers and the only time we're gonna use that in this class is when we're
trying to set our authorisation header.
Now down below let's go ahead and create a test case for ensuring that things fail when you're not authenticated
and you're trying to fetch the profile.
Then there'll be a challenge for you to test a different endpoint on your own.
So right here test should not get profile or on authenticated user.
And then we'll set it up as an async function and down below we'll actually go through that process.
So very similar to what we had above.
I'll use a wait calling request passing in the Express app on the next line dot get forward slash users
forward slash me.
Then we're gonna go ahead and send that one off without any token.
And we are going to expect a 4 0 1.
That is the status code we get back when our off middleware can't validate the authentication being
provided.
So right here none is provided.
I would definitely expect a for one and I'm going to save things for the final time and make sure we
now see 11 passing tests and that is exactly what we're getting.
So now it's challenge time you'll be writing to test cases for the endpoint that allows users to close
their account.
Let's go ahead and talk about what I'd like you to do right here.
You're going to be setting up two tests for deleting accounts.
One is gonna make sure it works when you're authenticated and the other will make sure it fails when
you're not authenticated.
So the first one could be called something like should delete account for user.
In this case you do want to set up the authentication header and you want to make sure you get that
correct.
Success status code.
Back now to actually make the request instead of using post or get you'll use the delete method provided
that's the same method we set up.
We delete account and point with the TTP delete method.
Next up you'll create the second test should not delete account for an authenticated user.
In this case you will not provide the off header but you will expect the correct status code.
Given the fact that they're not authenticated and finally you'll test your work you should have 13 passing
tests when all is said and done.
Now if you need to jog your memory about exactly what status codes you're going to get back or how that
endpoint works.
Feel free to pull up that code that's not violating the challenge rules.
You're allowed to use anything we've done in the course so far in order to solve these.
Take some time to get it done when you're done come back and click play
how that go.
Let's get to it up above.
I'm going to add the first of those two test cases we'll just go one at a time right here test the following
name or something similar should delete account for user.
We want to make sure that works.
Now in a couple of videos we'll get into more advanced assertions where we could do something like see
if there's actually no account in the database.
For now though just going off of the response is status code will get us started.
So a sync right here we are going to use super test.
So I will use a wait I'll call request passing in the app and we'll set up things using delete with
the following path that is forward slash users forward slash me to delete your own account.
Now in this case I do want to provide authentication.
So right here dot set setting up that header authorization
with the following value.
Once again bearer space followed by the token that is user 1 and Dot tokens grabbing the first item
in that array was not the one with the index of nine index of 0.
Then accessing the token property on it.
Now with that in place we should be able to continue on actually sending this off and asserting something
about the response.
So right here dot send it to send it off.
No request body necessary.
And then Don expect to expect something about these status code that would be a 200 if it's deleted.
Now we can go ahead and save things and we can test out this one test case before adding multiple it's
passing.
So now we can continue on to the other one right here.
Another test test should not delete account bore on authenticated user
Excellent.
We'll set it up as an async function and we'll go ahead and use Super Test await a call to request passing
in the app.
Once again still using delete and still using forward slash users forward slash me.
After that though no header we're just gonna send things off without any sort of authentication and
I will expect in that case to get a 4 0 1 back.
Now we just need to test our work for that second and test case so I'll remove the challenge comments
I can save the file and we'll see what we get down below.
I would be expecting I believe 13 or 14.
There it is 13.
Passing tests.
So now we know how to use super tests.
Excuse me Super Test singular with our endpoints that require authentication.
This is going to allow us to test everything else we have in our application.
We could test the ability to create tasks edit them or delete them though in the next video.
What I want to do is not necessarily test new endpoints but explore how we can add more assertions to
endpoints like this one for example asserting that we get an authentication token back.
We'll start to talk about how we can do that in the next lesson.
I'm excited to get to it and I'll see you then.