From d810a2ec0fde431ca31a8447908b6a9a210f1e42 Mon Sep 17 00:00:00 2001
From: saopig1 <4x7sw862st@gmail.com>
Date: Sat, 30 May 2026 13:15:01 +0800
Subject: [PATCH] test(perm): cover requireBotAccess 401 + missing-param cases

---
 src/web/middleware/requirePermission.test.ts | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/src/web/middleware/requirePermission.test.ts b/src/web/middleware/requirePermission.test.ts
index f8bead8..db1df2d 100644
--- a/src/web/middleware/requirePermission.test.ts
+++ b/src/web/middleware/requirePermission.test.ts
@@ -47,4 +47,15 @@ describe("requireBotAccess", () => {
   it("200 for admin", async () => {
     expect((await request(appWith(admin)).post("/bot/b1")).status).toBe(200);
   });
+  it("401 when unauthenticated", async () => {
+    const app = express();
+    app.post("/bot/:botId", requireBotAccess("botId"), (_r, res) => res.json({ ok: true }));
+    expect((await request(app).post("/bot/b1")).status).toBe(401);
+  });
+  it("403 when the route param is absent", async () => {
+    const app = express();
+    app.use((req, _res, next) => { (req as any).user = member([], ["b1"]); next(); });
+    app.post("/bot/:botId", requireBotAccess("nope"), (_r, res) => res.json({ ok: true }));
+    expect((await request(app).post("/bot/b1")).status).toBe(403);
+  });
 });