Add tests for authenticated access to para controller routes

src/backend/routers/para.test.ts

@@ -22,6 +22,22 @@ test("getParaById", async (t) => {
   t.is(para?.user_id, user_id);
 });
 
+test("getParaById - paras do not have access", async (t) => {
+  const { trpc } = await getTestServer(t, { authenticateAs: UserType.Para });
+
+  const error = await t.throwsAsync(async () => {
+    await trpc.para.getParaById.query({
+      user_id: "user_id",
+    });
+  });
+
+  t.is(
+    error?.message,
+    "UNAUTHORIZED",
+    "Expected an 'unauthorized' error message"
+  );
+});
+
 test("getParaByEmail", async (t) => {
   const { trpc, db } = await getTestServer(t, {
     authenticateAs: UserType.CaseManager,
@@ -42,6 +58,22 @@ test("getParaByEmail", async (t) => {
   t.is(para?.email, email);
 });
 
+test("getParaByEmail - paras do not have access", async (t) => {
+  const { trpc } = await getTestServer(t, { authenticateAs: UserType.Para });
+
+  const error = await t.throwsAsync(async () => {
+    await trpc.para.getParaByEmail.query({
+      email: "[email protected]",
+    });
+  });
+
+  t.is(
+    error?.message,
+    "UNAUTHORIZED",
+    "Expected an 'unauthorized' error message"
+  );
+});
+
 test("createPara", async (t) => {
   const { trpc, db, nodemailerMock } = await getTestServer(t, {
     authenticateAs: UserType.CaseManager,
@@ -68,6 +100,24 @@ test("createPara", async (t) => {
   );
 });
 
+test("createPara - paras do not have access", async (t) => {
+  const { trpc } = await getTestServer(t, { authenticateAs: UserType.Para });
+
+  const error = await t.throwsAsync(async () => {
+    await trpc.para.createPara.mutate({
+      first_name: "Foo",
+      last_name: "Bar",
+      email: "[email protected]",
+    });
+  });
+
+  t.is(
+    error?.message,
+    "UNAUTHORIZED",
+    "Expected an 'unauthorized' error message"
+  );
+});
+
 test("paras are deduped by email", async (t) => {
   const { trpc, db } = await getTestServer(t, {
     authenticateAs: UserType.CaseManager,
@@ -200,3 +250,25 @@ test("getMyTasks", async (t) => {
   t.is(task[0].instructions, INSTRUCTIONS);
   t.is(task[0].trial_count, TRIAL_COUNT);
 });
+
+test("getMyTasks - paras do have access", async (t) => {
+  const { trpc } = await getTestServer(t, { authenticateAs: UserType.Para });
+
+  await t.notThrowsAsync(async () => {
+    await trpc.para.getMyTasks.query();
+  });
+});
+
+test("getMyTasks - regular users don't have access", async (t) => {
+  const { trpc } = await getTestServer(t, {});
+
+  const error = await t.throwsAsync(async () => {
+    await trpc.para.getMyTasks.query();
+  });
+
+  t.is(
+    error?.message,
+    "UNAUTHORIZED",
+    "Expected an 'unauthorized' error message"
+  );
+});