✨ finish https://redwoodjs.com/docs/tutorial/chapter7/rbac#roles-on-t…

…he-api-side

api/src/graphql/comments.sdl.ts

@@ -27,6 +27,6 @@ export const schema = gql`
 
   type Mutation {
     createComment(input: CreateCommentInput!): Comment! @skipAuth
-    deleteComment(id: Int!): Comment! @requireAuth
+    deleteComment(id: Int!): Comment! @requireAuth(roles: "moderator")
   }
 `

api/src/services/comments/comments.test.ts

@@ -1,20 +1,15 @@
-import { db } from 'src/lib/db'
+import { AuthenticationError, ForbiddenError } from '@redwoodjs/graphql-server'
 
-import { comments, createComment } from './comments'
-import type { StandardScenario, PostOnlyScenario } from './comments.scenarios'
+import { db } from 'src/lib/db'
 
-// Generated boilerplate tests do not account for all circumstances
-// and can fail without adjustments, e.g. Float and DateTime types.
-//           Please refer to the RedwoodJS Testing Docs:
-//       https://redwoodjs.com/docs/testing#testing-services
-// https://redwoodjs.com/docs/testing#jest-expect-type-considerations
+import { comments, createComment, deleteComment } from './comments'
+import type { PostOnlyScenario, StandardScenario } from './comments.scenarios'
 
 describe('comments', () => {
   scenario(
     'returns all comments for a single post from the database',
-    async (scenario: StandardScenario) => {
+    async (scenario) => {
       const result = await comments({ postId: scenario.comment.jane.postId })
-
       const post = await db.post.findUnique({
         where: { id: scenario.comment.jane.postId },
         include: { comments: true },
@@ -43,4 +38,49 @@ describe('comments', () => {
       expect(comment.createdAt).not.toEqual(null)
     }
   )
+
+  scenario(
+    'allows a moderator to delete a comment',
+    async (scenario: StandardScenario) => {
+      mockCurrentUser({
+        roles: 'moderator',
+        id: 1,
+        email: '[email protected]',
+      })
+
+      const comment = await deleteComment({
+        id: scenario.comment.jane.id,
+      })
+      expect(comment.id).toEqual(scenario.comment.jane.id)
+
+      const result = await comments({ postId: scenario.comment.jane.id })
+      expect(result.length).toEqual(0)
+    }
+  )
+
+  scenario(
+    'does not allow a non-moderator to delete a comment',
+    async (scenario: StandardScenario) => {
+      mockCurrentUser({ roles: 'user', id: 1, email: '[email protected]' })
+
+      expect(() =>
+        deleteComment({
+          id: scenario.comment.jane.id,
+        })
+      ).toThrow(ForbiddenError)
+    }
+  )
+
+  scenario(
+    'does not allow a logged out user to delete a comment',
+    async (scenario: StandardScenario) => {
+      mockCurrentUser(null)
+
+      expect(() =>
+        deleteComment({
+          id: scenario.comment.jane.id,
+        })
+      ).toThrow(AuthenticationError)
+    }
+  )
 })