added tests for GET /privilege/{userId}

tests/main_test.go

@@ -17,6 +17,7 @@ var validToken = os.Getenv("VALID_JWT_TOKEN")
 var expiredToken = os.Getenv("EXPIRED_JWT_TOKEN")
 var validTokenForDelete = os.Getenv("VALID_JWT_TOKEN_FOR_DELETE")
 var validAdminToken = os.Getenv("VALID_ADMIN_JWT_TOKEN")
+var existingUserIDToken = os.Getenv("EXISTING_USER_ID_JWT_TOKEN")
 
 var existingUserID = os.Getenv("EXISTING_USER_ID")
 var testUserID = os.Getenv("TEST_USER_ID")
@@ -522,3 +523,179 @@ func TestGetAccounts_Performance(t *testing.T) {
 }
 
 // todo 4.3.7 4.3.8 4.4
+
+func TestGetPrivilege_Success(t *testing.T) {
+	body := map[string]string{"userId": existingUserID}
+	data, err := json.Marshal(body)
+	assert.NoError(t, err)
+
+	req, err := http.NewRequest("GET", baseURL+"/privilege/"+existingUserID, bytes.NewBuffer(data))
+	assert.NoError(t, err)
+	req.Header.Set("Authorization", "Bearer "+existingUserIDToken)
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := http.DefaultClient.Do(req)
+	assert.NoError(t, err)
+	defer resp.Body.Close()
+
+	assert.Equal(t, http.StatusOK, resp.StatusCode)
+	assert.Equal(t, "application/json", resp.Header.Get("Content-Type"))
+
+	var privileges []model.ShortPrivilege
+	err = json.NewDecoder(resp.Body).Decode(&privileges)
+	assert.NoError(t, err)
+
+	for _, p := range privileges {
+		assert.NotEmpty(t, p.ID)
+		assert.NotEmpty(t, p.PrivilegeID)
+		assert.NotEmpty(t, p.PrivilegeName)
+	}
+}
+
+func TestGetPrivilege_Auth(t *testing.T) {
+	t.Run("NoToken", func(t *testing.T) {
+		req, err := http.NewRequest("GET", baseURL+"/privilege/"+existingUserID, nil)
+		assert.NoError(t, err)
+		resp, err := http.DefaultClient.Do(req)
+		assert.NoError(t, err)
+		assert.Equal(t, http.StatusUnauthorized, resp.StatusCode)
+	})
+
+	t.Run("InvalidToken", func(t *testing.T) {
+		req, err := http.NewRequest("GET", baseURL+"/privilege/"+existingUserID, nil)
+		assert.NoError(t, err)
+		req.Header.Set("Authorization", "Bearer invalid_token")
+		resp, err := http.DefaultClient.Do(req)
+		assert.NoError(t, err)
+		assert.Equal(t, http.StatusUnauthorized, resp.StatusCode)
+	})
+
+	t.Run("ExpiredToken", func(t *testing.T) {
+		req, err := http.NewRequest("GET", baseURL+"/privilege/"+existingUserID, nil)
+		assert.NoError(t, err)
+		req.Header.Set("Authorization", "Bearer "+expiredToken)
+		resp, err := http.DefaultClient.Do(req)
+		assert.NoError(t, err)
+		assert.Equal(t, http.StatusUnauthorized, resp.StatusCode)
+	})
+}
+
+func TestGetPrivilege_InputValidation(t *testing.T) {
+	t.Run("MissingUserID", func(t *testing.T) {
+		req, err := http.NewRequest("GET", baseURL+"/privilege/", nil)
+		assert.NoError(t, err)
+		req.Header.Set("Authorization", "Bearer "+validToken)
+		resp, err := http.DefaultClient.Do(req)
+		assert.NoError(t, err)
+		assert.Equal(t, http.StatusNotFound, resp.StatusCode)
+	})
+
+	t.Run("InvalidUserID", func(t *testing.T) {
+		body := map[string]int{"userId": 111}
+		data, err := json.Marshal(body)
+		assert.NoError(t, err)
+		req, err := http.NewRequest("GET", baseURL+"/privilege/!!!", bytes.NewBuffer(data))
+		assert.NoError(t, err)
+		req.Header.Set("Authorization", "Bearer "+validToken)
+		req.Header.Set("Content-Type", "application/json")
+		resp, err := http.DefaultClient.Do(req)
+		assert.NoError(t, err)
+		assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
+	})
+
+	t.Run("NonExistentUserID", func(t *testing.T) {
+		nonExistentID := "non_existent_user_123"
+		body := map[string]string{"userId": nonExistentID}
+		data, err := json.Marshal(body)
+		assert.NoError(t, err)
+
+		req, err := http.NewRequest("GET", baseURL+"/privilege/"+nonExistentID, bytes.NewBuffer(data))
+		assert.NoError(t, err)
+		req.Header.Set("Authorization", "Bearer "+validToken)
+		req.Header.Set("Content-Type", "application/json")
+
+		resp, err := http.DefaultClient.Do(req)
+		assert.NoError(t, err)
+		defer resp.Body.Close()
+
+		assert.Equal(t, http.StatusOK, resp.StatusCode)
+
+		var privileges []model.ShortPrivilege
+		err = json.NewDecoder(resp.Body).Decode(&privileges)
+		assert.NoError(t, err)
+		assert.Empty(t, privileges)
+	})
+}
+
+// todo 5.3.4
+
+func TestGetPrivilege_Security(t *testing.T) {
+	t.Run("SQLInjection", func(t *testing.T) {
+		injection := "1' OR '1'='1"
+		body := map[string]string{"userId": injection}
+		data, err := json.Marshal(body)
+		assert.NoError(t, err)
+		req, err := http.NewRequest("GET", baseURL+"/privilege/"+injection, bytes.NewBuffer(data))
+		assert.NoError(t, err)
+		req.Header.Set("Authorization", "Bearer "+validToken)
+		req.Header.Set("Content-Type", "application/json")
+		resp, err := http.DefaultClient.Do(req)
+		assert.NoError(t, err)
+		assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
+	})
+
+	t.Run("XSS", func(t *testing.T) {
+		body := map[string]string{"userId": xssInput}
+		data, err := json.Marshal(body)
+		assert.NoError(t, err)
+		req, err := http.NewRequest("GET", baseURL+"/privilege/"+xssInput, bytes.NewBuffer(data))
+		assert.NoError(t, err)
+		req.Header.Set("Authorization", "Bearer "+validToken)
+		req.Header.Set("Content-Type", "application/json")
+		resp, err := http.DefaultClient.Do(req)
+		assert.NoError(t, err)
+		assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
+	})
+}
+
+func TestGetPrivilege_Performance(t *testing.T) {
+	t.Run("ResponseTime", func(t *testing.T) {
+		body := map[string]string{"userId": existingUserID}
+		data, err := json.Marshal(body)
+		assert.NoError(t, err)
+		start := time.Now()
+		req, err := http.NewRequest("GET", baseURL+"/privilege/"+existingUserID, bytes.NewBuffer(data))
+		assert.NoError(t, err)
+		req.Header.Set("Authorization", "Bearer "+existingUserIDToken)
+		req.Header.Set("Content-Type", "application/json")
+		resp, err := http.DefaultClient.Do(req)
+		assert.NoError(t, err)
+		defer resp.Body.Close()
+		assert.Less(t, time.Since(start).Milliseconds(), int64(300))
+	})
+
+	t.Run("LoadTest", func(t *testing.T) {
+		var wg sync.WaitGroup
+		for i := 0; i < 100; i++ {
+			wg.Add(1)
+			go func() {
+				defer wg.Done()
+				body := map[string]string{"userId": existingUserID}
+				data, err := json.Marshal(body)
+				assert.NoError(t, err)
+				req, err := http.NewRequest("GET", baseURL+"/privilege/"+existingUserID, bytes.NewBuffer(data))
+				assert.NoError(t, err)
+				req.Header.Set("Authorization", "Bearer "+existingUserIDToken)
+				req.Header.Set("Content-Type", "application/json")
+				resp, err := http.DefaultClient.Do(req)
+				assert.NoError(t, err)
+				if resp != nil {
+					defer resp.Body.Close()
+				}
+			}()
+		}
+		wg.Wait()
+	})
+}
+
+// todo 5.3.7 5.3.8 5.4