Testing User Route API

[manojtsx]

Here's the list of routes with tasks:

1. GET / - Fetches a list of users

• Get the list of all the users
• Displays "You aren't authorized to view this data" message if the user logged in is viewer or author
• Be sure that while obtaining user detail, you are not getting password too
• If there are no user documents in db, it shows "No users found"

3. GET /role - Fetches users by their role

• Get the list of all the users according to role query
• Displays "You aren't authorized to view this data" message if the user logged in is viewer or author
• Be sure that while obtaining user detail, you are not getting password too
• If you don't pass the query parameter, it shows "Role parameter is required"
• If there are not user for the query role, then it shows "No users found for the specified role"

5. PUT /upload-profile-picture/:id - Uploads a profile picture for the authenticated user

• Check if a file is selected. Show "No file selected!" (400) if no file is provided.
• Retrieve the user by their ID from the request parameters. Show "User not found" (404) if the user is not found.
• Verify if the logged-in user is authorized to upload the profile picture. Show "You are not authorized to delete this user" (403) if unauthorized.
• If the user has an existing profile picture, delete the old picture from the server.
• Update the user’s profile picture path with the new file path.
• Show "Profile picture uploaded successfully" (200) if the update is successful.
• Show a general error message if an exception occurs (500).

7. PUT /change-password/:id - Changes the password of the authenticated user

• {If user is admin, then can change password for every user
• If user id editor, then can change password for viewer and author, but not for admin
• If user is author and viewer, then can change password for their own user document }or else show "You are not authorized to change password for this user." 403
• If user id passed is not a valid user, then it shows "User not found" 404
• If user provides wrong old-password, then it shows "Please type your old password correctly" 401
• If the password is changed successfully, it shows "Password changed successfully" 200

9. GET /:id - Fetches a specific user by their ID

• If there are not users, then it shows "No users found" 404
• Or else shows the user according to the id param

11. PUT /:id - Updates a specific user by their ID

• If the username already exists for other user during editing user, it shows "User already exists" 400
• If the user whose user id is passed for editing is not found, then it shows "User not found for editing" 404
• If user is an admin, editor but user to be changed is not admin, is a viewer and author and the user they are trying to edit is themselves, then they can edit the user, Or else show "You are not authorized to edit this user." 403
• If everything works shows "User updated successfully" 200

13. DELETE /:id - Deletes a specific user by their ID

• If the user whose user id is passed for deleting is not found, then it shows "User not found for deletion" 404
• If user is an admin, editor but user to be changed is not admin, is a viewer and author and the user they are trying to edit is themselves, then they can edit the user, Or else show "You are not authorized to delete this user." 403
• If everything works shows "User deleted successfully" 200

15. PUT /change-email/:id - Changes the email of the authenticated user

• {If user is admin, then can change email for every user
• If user id editor, then can change email for viewer and author, but not for admin
• If user is author and viewer, then can change email for their own user document} or else show "You are not authorized to change email for this user." 403
• If user id passed is not a valid user, then it shows "User not found" 404
• If the email is changed successfully, it shows "Email changed successfully" 200
• If the user type old email while changing, it shows "Your new email is your old email" 409

13. PUT /approve-author/:id - Approves a user as an author

• If user whose user id is passed is not found, it shows "User does not exists" 404
• If user is not admin or editor, then they cannot approve user as author, it shows "You are not authorized to approve this user as author." 403
• if user role is viewer and status is pending while approve request is true, then the user gets approved, it shows "Viewer approved as Author Successfully" 200
• if user role is viewer and status is pending while approve request is false, then the user is not approved, thus shows "Viewer request rejected." 200

15. PUT /change-to-editor/:id - Changes a user's role to editor

• Retrieve the user by their ID. Show "User does not exist" (404) if the user is not found.
• Verify if the logged-in user has the role of admin. Show "You are not authorized to change this user's role" (403) if the user is not an admin.
• Check if the user's current role is already "editor". Show "Selected user is already an editor" (409) if true.
• Change the user’s role to "editor" and set their status to "approved". Show "User role changed to editor" with the updated user details (200).
• Show a general error message if an exception occurs (500).

17. PUT /promote-admin/:id - Promotes a user to an admin

• Retrieve the user by their ID. Show "User does not exist" (404) if the user is not found.
• Verify if the logged-in user has the role of admin. Show "You are not authorized to change this user's role" (403) if the user is not an admin.
• Check if the user’s current role is already "admin". Show "Selected user is already admin" (409) if true.
• Change the user’s role to "admin" and set their status to "approved". Show "User role changed to admin" with the updated user details (200).
• Show a general error message if an exception occurs (500).

Note: Don't forget to check the changes in database after calling API each time.