test: add tests for admins reverting others' imports

server/src/server/router/api/v1/imports/router.test.ts

@@ -1,4 +1,5 @@
 import db from "external/mongo/db";
+import { UserAuthLevels } from "tachi-common";
 import t from "tap";
 import { CreateFakeAuthCookie } from "test-utils/fake-auth";
 import { mkFakeImport } from "test-utils/misc";
@@ -98,6 +99,15 @@ t.test("POST /api/v1/imports/:importID/revert", async (t) => {
 	});
 
 	t.test("Should return 403 if the user is authed as someone else.", async (t) => {
+		await db.users.update(
+			{
+				id: 1,
+			},
+			{
+				$set: { authLevel: UserAuthLevels.USER },
+			}
+		);
+
 		const someoneElsesImport = mkFakeImport({ userID: 2, importID: "someone_elses" });
 		await db.imports.insert(someoneElsesImport);
 
@@ -110,5 +120,39 @@ t.test("POST /api/v1/imports/:importID/revert", async (t) => {
 		t.end();
 	});
 
+	t.test(
+		"Should allow reverting another users import if the requester is an admin.",
+		async (t) => {
+			await db.users.update(
+				{
+					id: 1,
+				},
+				{
+					$set: { authLevel: UserAuthLevels.ADMIN },
+				}
+			);
+
+			const someoneElsesImport = mkFakeImport({ userID: 2, importID: "someone_elses" });
+			await db.imports.insert(someoneElsesImport);
+
+			const res = await mockApi
+				.post(`/api/v1/imports/${someoneElsesImport.importID}/revert`)
+				.set("Cookie", cookie);
+
+			t.equal(res.statusCode, 200, "Should return 200.");
+
+			t.strictSame(res.body.body, {}, "The response body should be empty.");
+
+			t.resolveMatch(
+				db.scores.findOne({ scoreID: FakeImport.scoreIDs[0] }),
+				// @ts-expect-error https://github.com/DefinitelyTyped/DefinitelyTyped/pull/60020
+				null,
+				"The scores that were part of this import should be deleted."
+			);
+
+			t.end();
+		}
+	);
+
 	t.end();
 });