feat(tests): Enhance avatar upload tests to validate non-image rejection and successful image storage

Author: MinecraftFuns

backend/tests/uploads.test.js

@@ -4,6 +4,7 @@ const fs = require('fs');
 const path = require('path');
 const request = require('supertest');
 const { app, prisma } = require('..');
+const { clearDatabase, createUserWithRole } = require('./helpers/db');
 
 const uploadsDir = path.join(__dirname, '..', 'uploads');
 
@@ -13,6 +14,16 @@ beforeAll(() => {
     }
 });
 
+beforeEach(async () => {
+    await clearDatabase();
+    if (!fs.existsSync(uploadsDir)) {
+        fs.mkdirSync(uploadsDir, { recursive: true });
+    }
+    for (const file of fs.readdirSync(uploadsDir)) {
+        fs.unlinkSync(path.join(uploadsDir, file));
+    }
+});
+
 afterAll(async () => {
     await prisma.$disconnect();
 });
@@ -41,3 +52,45 @@ test('serves unknown extension as attachment octet-stream', async () => {
     expect(res.headers['content-type']).toBe('application/octet-stream');
     expect(res.headers['content-disposition']).toContain('attachment');
 });
+
+const login = async (utorid, password) => {
+    const res = await request(app)
+        .post('/auth/tokens')
+        .send({ utorid, password });
+    return res.body.token;
+};
+
+test('rejects non-image avatar upload', async () => {
+    const { user, password } = await createUserWithRole('regular');
+    const token = await login(user.utorid, password);
+
+    const res = await request(app)
+        .patch('/users/me')
+        .set('Authorization', `Bearer ${token}`)
+        .attach('avatar', Buffer.from('not-an-image'), {
+            filename: 'notevil.txt',
+            contentType: 'text/plain'
+        });
+
+    expect(res.status).toBe(400);
+    expect(res.body).toHaveProperty('error');
+    expect(fs.readdirSync(uploadsDir).length).toBe(0);
+});
+
+test('accepts image avatar upload and stores file', async () => {
+    const { user, password } = await createUserWithRole('regular');
+    const token = await login(user.utorid, password);
+
+    const res = await request(app)
+        .patch('/users/me')
+        .set('Authorization', `Bearer ${token}`)
+        .attach('avatar', Buffer.from([0x89, 0x50, 0x4e, 0x47]), {
+            filename: 'avatar.png',
+            contentType: 'image/png'
+        });
+
+    expect(res.status).toBe(200);
+    expect(res.body).toHaveProperty('avatarUrl');
+    expect(res.body.avatarUrl).toContain('/uploads/');
+    expect(fs.readdirSync(uploadsDir).length).toBe(1);
+});