NestJS · Senior · Question 68 of 75
Why should controller tests not be the only tests for authorization rules?
- ✓Correct answer: Rules enforced in guards, pipes and services interact; only HTTP-level tests show that the right status codes come back for real requests
- 2Authorization is not testable
- 3Controllers don't run in tests
Explanation
Write a few e2e tests per protected resource: no token, wrong user, right user.