Unit, integration, functional tests in a 3 layer API

I am working on a API application using a 3 layer architecture, using express/sequelize, and I would like to get clarity where each layer is tested. I already read a lot about concepts and definitions of each type (unit, integration, functional) of test and it is clear to me that the concepts is not something that everyone agrees.

This is my API architecture:

This is the test pyramid I'm trying to follow:

In controller layer I have the routes and I'm almost sure that this layer is tested in functional test where the tests will really consume the API, check for the return status and body.

The others test layer I'm not sure at all. In service layer I have all the business logic and codes that will interact with my Models, some pseudocode like:

static async createUserWithDefaultPermissions(attributes: Object) {
    const user = await User.create(attributes);
    defaultPermissions = ['login', 'list-users', 'change-password]; // initial permissions
    defaultPermissions.forEach(permissions) {
        // save UserPermission relation
    }

    return user;
}

For now it's very simple but I'll have here all the business logic. Looks to me that this will be tested in the integration tests as it depends on the database.

And last, in data access layer, I have my sequelize defined models and its validations. I think that here should be done the unit tests.

Am I thinking correct or totally lost?

Besides where each layer is tested I'm not sure either what to test. For now I think that in unit tests I should test all the models validations rules without touching the database. For example, suppose my User model have only two fields:

• login: not null
• password: not null, at least 5 characters

I will run 3 tests:

• 1. check if validation fails when login is null
• 2. check if validation fails when password is null
• 3. check if validation fails when password is too short

Assuming that is the right thing I'm doing something like this in my integration tests:

const user = await UserService.createUserWithDefaultPermissions({fakeUserAttributes});
const databaseUser = User.findByPk(user.id);

// if databaUser was found test pass

Is that correct? Or should I test all the validations again like try to create an user with empty login, empty pass, etc?

Hope to get some guidance in this matter, thanks in advance