message: Extend API tests for Data Erasure form
diff: @@ -10,7 +10,50 @@ const BASE_URL = 'http://localhost:3000'
  const REST_URL = 'http://localhost:3000/rest'
  describe('/dataerasure', () => {
  - it('Erasure request does not actually delete the user', () => {
  + it('GET erasure form for logged-in users includes their email and security question', () => {
  + return frisby.post(REST_URL + '/user/login', {
  + headers: jsonHeader,
  + body: {
  + email: 'bjoern@owasp.org',
  + password: 'kitten lesser pooch karate buffoon indoors'
  + }
  + })
  + .expect('status', 200)
  + .then(({ json: jsonLogin }) => {
  + return frisby.get(BASE_URL + '/dataerasure/', {
  + headers: { Cookie: 'token=' + jsonLogin.authentication.token }
  + })
  + .expect('status', 200)
  + .expect('bodyContains', 'bjoern@owasp.org')
  + .expect('bodyContains', 'Name of your favorite pet?')
  + })
  + })
  +
  + it('GET erasure form rendering fails for users without assigned security answer', () => {
  + return frisby.post(REST_URL + '/user/login', {
  + headers: jsonHeader,
  + body: {
  + email: 'bjoern.kimminich@gmail.com',
  + password: 'bW9jLmxpYW1nQGhjaW5pbW1pay5ucmVvamI='
  + }
  + })
  + .expect('status', 200)
  + .then(({ json: jsonLogin }) => {
  + return frisby.get(BASE_URL + '/dataerasure/', {
  + headers: { Cookie: 'token=' + jsonLogin.authentication.token }
  + })
  + .expect('status', 500)
  + .expect('bodyContains', 'Error: No answer found!')
  + })
  + })
  +
  + it('GET erasure form rendering fails on unauthenticated access', () => {
  + return frisby.get(BASE_URL + '/dataerasure/')
  + .expect('status', 500)
  + .expect('bodyContains', 'Error: Blocked illegal activity')
  + })
  +
  + it('POST erasure request does not actually delete the user', () => {
  const form = frisby.formData()
  form.append('email', 'bjoern.kimminich@gmail.com')
  @@ -41,4 +84,10 @@ describe('/dataerasure', () => {
  })
  })
  })
  +
  + it('POST erasure form fails on unauthenticated access', () => {
  + return frisby.post(BASE_URL + '/dataerasure/')
  + .expect('status', 500)
  + .expect('bodyContains', 'Error: Blocked illegal activity')
  + })
  })
  