test(api): Update users.contract.ts and add more custom-widgets tests

api/test/e2e/users/custom-widgets/custom-widget-crud.spec.ts

@@ -127,24 +127,6 @@ describe('Custom Widgets API', () => {
   });
 
   describe('Read API', () => {
-    it("Shouldn't allow anonymous users to read custom widgets", async () => {
-      // Given
-      await entityMocks.createCustomWidget({
-        name: 'custom-widget',
-        user: { id: testUser.id },
-        widget: { indicator: baseWidget.indicator },
-      });
-
-      // When
-      const res = await testManager
-        .request()
-        .get(`/users/${VALID_UUID}/widgets`);
-
-      // Then
-      expect(res.status).toBe(401);
-      expect(res.body.errors).toBeDefined();
-    });
-
     it('Should allow authenticated users to read their custom widgets', async () => {
       // Given
       await entityMocks.createCustomWidget({
@@ -284,6 +266,73 @@ describe('Custom Widgets API', () => {
       expect(res.status).toBe(403);
       expect(res.body.errors).toBeDefined();
     });
+
+    it("Shouldn't allow authenticated users to read other user's custom widgets by id", async () => {
+      // Given
+      // Other user's custom widgets
+      const { user: otherUser } = await testManager.setUpTestUser({
+        email: '[email protected]',
+      });
+      const createdCustomWidget = await entityMocks.createCustomWidget({
+        name: 'other-user-custom-widget1',
+        user: { id: otherUser.id },
+        widget: { indicator: baseWidget.indicator },
+      });
+
+      // When
+      const res = await testManager
+        .request()
+        .get(`/users/${otherUser.id}/widgets/${createdCustomWidget.id}`)
+        .set('Authorization', `Bearer ${authToken}`);
+
+      // Then
+      expect(res.status).toBe(403);
+      expect(res.body.errors).toBeDefined();
+    });
+
+    it("Shouldn't allow anonymous users to read other user's custom widgets", async () => {
+      // Given
+      // Other user's custom widgets
+      const { user: otherUser } = await testManager.setUpTestUser({
+        email: '[email protected]',
+      });
+      await entityMocks.createCustomWidget({
+        name: 'other-user-custom-widget1',
+        user: { id: otherUser.id },
+        widget: { indicator: baseWidget.indicator },
+      });
+
+      // When
+      const res = await testManager
+        .request()
+        .get(`/users/${otherUser.id}/widgets`);
+
+      // Then
+      expect(res.status).toBe(401);
+      expect(res.body.errors).toBeDefined();
+    });
+
+    it("Shouldn't allow anonymous users to read other user's custom widgets by id", async () => {
+      // Given
+      // Other user's custom widgets
+      const { user: otherUser } = await testManager.setUpTestUser({
+        email: '[email protected]',
+      });
+      const createdCustomWidget = await entityMocks.createCustomWidget({
+        name: 'other-user-custom-widget1',
+        user: { id: otherUser.id },
+        widget: { indicator: baseWidget.indicator },
+      });
+
+      // When
+      const res = await testManager
+        .request()
+        .get(`/users/${otherUser.id}/widgets/${createdCustomWidget.id}`);
+
+      // Then
+      expect(res.status).toBe(401);
+      expect(res.body.errors).toBeDefined();
+    });
   });
 
   describe('Update API', () => {

shared/contracts/users.contract.ts

@@ -126,7 +126,8 @@ export const usersContract = contract.router({
     query: generateEntityQuerySchema(CustomWidget),
     responses: {
       200: contract.type<ApiPaginationResponse<CustomWidget>>(),
-      400: contract.type<JSONAPIError>(),
+      401: contract.type<JSONAPIError>(),
+      403: contract.type<JSONAPIError>(),
       404: contract.type<JSONAPIError>(),
       500: contract.type<JSONAPIError>(),
     },
@@ -138,6 +139,8 @@ export const usersContract = contract.router({
     responses: {
       200: contract.type<ApiResponse<CustomWidget>>(),
       400: contract.type<JSONAPIError>(),
+      401: contract.type<JSONAPIError>(),
+      403: contract.type<JSONAPIError>(),
       404: contract.type<JSONAPIError>(),
       500: contract.type<JSONAPIError>(),
     },