import Image from ‘next/image’;

multi-tenancy.test.js Test Suite Documentation

Overview

This Jest test suite validates the multi-tenancy behavior of the API for each entity defined in the metadata-cache.json. It ensures that resources created within one tenant environment are not accessible from another tenant, enforcing tenant data isolation and security.

Test Scope

• Tests multi-tenant API endpoints across two distinct tenant environments.
• Authenticates separately against each tenant to obtain distinct JWT tokens.
• Verifies that resources created in one tenant cannot be accessed or manipulated by users from another tenant.

Test source

This suite uses the API metadata to generate valid body for POST / PUT requests. The list of endpoints to test is hardcoded, but repeted for every entity. Snapshots are based on prior run.

Key Functionalities Tested

1. Tenant Authentication

• Logs in as an admin for Tenant 1 and Tenant 2 separately before tests run.
• Retrieves and stores JWT tokens for each tenant to authorize subsequent API requests.

2. Resource Isolation

• Creates a new resource in Tenant 1 using the provided sample entity data.
• Confirms the resource is successfully created with an HTTP 201 status.
• Retrieves the created resource from Tenant 1 to confirm it exists with HTTP 200.
• Attempts to access the same resource from Tenant 2:
  • Expects a 404 Not Found if isolation is enforced.
  • If accessible (HTTP 200), asserts that the resource data differs between tenants to confirm separation.

3. Cleanup

• Deletes the created resource from Tenant 1 after the test completes to maintain a clean state.
• Verifies successful deletion by accepting HTTP 200 or 204.

Environmental Setup

• Uses hardcoded base URLs for two tenant environments:
  • https://demo-sf5.cdk-ecs-dev.phpreaction.com/ (Tenant 1)
  • https://demo.phpreaction.com (Tenant 2)
• Test credentials for admin login are provided directly in the test suite.

Notes

• Ensures strong data isolation in multi-tenant applications, preventing cross-tenant data leakage.
• The test suite runs sequentially for each entity ensuring comprehensive coverage.
• Cleanup after tests avoids polluting tenant environments with test data.
• Includes a simple arithmetic test (adds 1 + 1 to equal 2) as a baseline sanity check.