feat: add public product catalog boundary

apps/api/src/app/build-app.js

@@ -7,6 +7,7 @@ import { registerAdminInventoryRoutes } from '../modules/inventory/routes/admin-
 import { registerAdminImageRoutes } from '../modules/inventory/routes/admin-image-routes.js';
 import { registerAdminListingRoutes } from '../modules/listings/routes/admin-listing-routes.js';
 import { registerAdminProductRoutes } from '../modules/products/routes/admin-product-routes.js';
+import { registerPublicProductRoutes } from '../modules/products/routes/public-product-routes.js';
 import { registerPublicSearchRoutes } from '../modules/search/routes/public-search-routes.js';
 
 export function buildApp(dependencies) {
@@ -55,6 +56,10 @@ export function buildApp(dependencies) {
     ...dependencies,
     prefix: '/api/v1',
   });
+  app.register(registerPublicProductRoutes, {
+    ...dependencies,
+    prefix: '/api/v1',
+  });
 
   return app;
 }

apps/api/src/app/server.js

@@ -24,6 +24,7 @@ import { createListingRepository } from '../modules/listings/repositories/listin
 import { createListingService } from '../modules/listings/services/listing-service.js';
 import { createProductRepository } from '../modules/products/repositories/product-repository.js';
 import { createProductService } from '../modules/products/services/product-service.js';
+import { createPublicProductService } from '../modules/products/services/public-product-service.js';
 import { createSearchService } from '../modules/search/services/search-service.js';
 
 function parsePort(value) {
@@ -86,6 +87,7 @@ async function startServer() {
     }),
     listingService: createListingService({ listingRepository, inventoryImageRepository }),
     productService: createProductService({ productRepository }),
+    publicProductService: createPublicProductService({ productRepository }),
     searchService: createSearchService({ listingRepository }),
   });
 

apps/api/src/modules/products/repositories/product-repository.js

@@ -1,6 +1,10 @@
-import { and, asc, eq } from 'drizzle-orm';
+import { and, asc, eq, inArray } from 'drizzle-orm';
 
-import { products } from '../../../infrastructure/database/schema.js';
+import {
+  inventoryItems,
+  listings,
+  products,
+} from '../../../infrastructure/database/schema.js';
 
 export function createProductRepository(db) {
   return {
@@ -18,6 +22,22 @@ export function createProductRepository(db) {
       return product ?? null;
     },
 
+    async findPublicBySlug(slug) {
+      const [result] = await db
+        .select({ product: products })
+        .from(products)
+        .innerJoin(inventoryItems, eq(inventoryItems.productId, products.id))
+        .innerJoin(listings, eq(listings.inventoryItemId, inventoryItems.id))
+        .where(and(
+          eq(products.slug, slug),
+          eq(inventoryItems.status, 'ACTIVE'),
+          inArray(listings.status, ['AVAILABLE', 'PENDING']),
+        ))
+        .limit(1);
+
+      return result?.product ?? null;
+    },
+
     async findBySellerIdAndSlug(sellerId, slug) {
       const [product] = await db
         .select()

apps/api/src/modules/products/routes/public-product-routes.js

@@ -0,0 +1,10 @@
+import { toPublicProductDto } from '@pokemon-inventory/contracts/public-product';
+
+export async function registerPublicProductRoutes(app, options) {
+  const { publicProductService } = options;
+
+  app.get('/public/products/:slug', async (request) => {
+    const product = await publicProductService.getBySlug(request.params.slug);
+    return { data: toPublicProductDto(product) };
+  });
+}

apps/api/src/modules/products/services/public-product-service.js

@@ -0,0 +1,15 @@
+import { createApplicationError } from '../../../shared/errors/application-error.js';
+
+export function createPublicProductService({ productRepository }) {
+  return {
+    async getBySlug(slug) {
+      const product = await productRepository.findPublicBySlug(slug);
+
+      if (!product) {
+        throw createApplicationError('PRODUCT_NOT_FOUND', 'Product was not found.', 404);
+      }
+
+      return product;
+    },
+  };
+}

apps/api/tests/application/public-product-service.test.js

@@ -0,0 +1,42 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { createPublicProductService } from '../../src/modules/products/services/public-product-service.js';
+
+test('returns only a publicly visible product', async () => {
+  const service = createPublicProductService({
+    productRepository: {
+      async findPublicBySlug(slug) {
+        assert.equal(slug, 'pikachu-plush');
+        return {
+          id: 'product-1',
+          sellerId: 'private-seller-id',
+          categoryId: 'category-1',
+          name: 'Pikachu Plush',
+          slug,
+          description: 'A friendly plush.',
+        };
+      },
+    },
+  });
+
+  assert.deepEqual(await service.getBySlug('pikachu-plush'), {
+    id: 'product-1',
+    sellerId: 'private-seller-id',
+    categoryId: 'category-1',
+    name: 'Pikachu Plush',
+    slug: 'pikachu-plush',
+    description: 'A friendly plush.',
+  });
+});
+
+test('returns a not-found application error for non-public products', async () => {
+  const service = createPublicProductService({
+    productRepository: { async findPublicBySlug() { return null; } },
+  });
+
+  await assert.rejects(
+    () => service.getBySlug('hidden-product'),
+    (error) => error.code === 'PRODUCT_NOT_FOUND' && error.statusCode === 404,
+  );
+});

apps/api/tests/http/public-product-routes.test.js

@@ -0,0 +1,70 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { buildApp } from '../../src/app/build-app.js';
+
+function createTestApp() {
+  return buildApp({
+    publicProductService: {
+      async getBySlug(slug) {
+        if (slug !== 'pikachu-plush') {
+          const error = new Error('Product was not found.');
+          error.code = 'PRODUCT_NOT_FOUND';
+          error.statusCode = 404;
+          throw error;
+        }
+
+        return {
+          id: 'product-1',
+          sellerId: 'private-seller-id',
+          categoryId: 'category-1',
+          name: 'Pikachu Plush',
+          slug,
+          description: 'A friendly plush.',
+          createdAt: new Date('2026-09-07T00:00:00.000Z'),
+          updatedAt: new Date('2026-09-07T00:00:00.000Z'),
+        };
+      },
+    },
+  });
+}
+
+test('returns a public product without private seller identity', async (testContext) => {
+  const app = createTestApp();
+  testContext.after(() => app.close());
+
+  const response = await app.inject({
+    method: 'GET',
+    url: '/api/v1/public/products/pikachu-plush',
+  });
+
+  assert.equal(response.statusCode, 200);
+  assert.deepEqual(response.json().data, {
+    id: 'product-1',
+    categoryId: 'category-1',
+    name: 'Pikachu Plush',
+    slug: 'pikachu-plush',
+    description: 'A friendly plush.',
+    brand: null,
+    setName: null,
+    cardNumber: null,
+    eventName: null,
+    releaseYear: null,
+    createdAt: '2026-09-07T00:00:00.000Z',
+    updatedAt: '2026-09-07T00:00:00.000Z',
+  });
+  assert.equal('sellerId' in response.json().data, false);
+});
+
+test('returns not found when a product is not publicly visible', async (testContext) => {
+  const app = createTestApp();
+  testContext.after(() => app.close());
+
+  const response = await app.inject({
+    method: 'GET',
+    url: '/api/v1/public/products/hidden-product',
+  });
+
+  assert.equal(response.statusCode, 404);
+  assert.equal(response.json().error.code, 'PRODUCT_NOT_FOUND');
+});

apps/api/tests/integration/catalog-repositories.test.js

@@ -8,6 +8,7 @@ import {
   categories,
   conditionProfiles,
   conditions,
+  listings,
   mfaMethods,
   passwordResetTokens,
   securityAuditEvents,
@@ -154,6 +155,41 @@ test('finds a product by both its seller and slug', async () => {
   );
 });
 
+test('finds only products with active inventory and a public listing', async () => {
+  const { seller, category, condition } = await createCatalogPrerequisites();
+  const product = await productRepository.create({
+    sellerId: seller.id,
+    categoryId: category.id,
+    name: 'Public Pikachu Plush',
+    slug: 'public-pikachu-plush',
+  });
+  const inventoryItem = await inventoryItemRepository.create({
+    productId: product.id,
+    conditionId: condition.id,
+  });
+
+  await database.db.insert(listings).values({
+    inventoryItemId: inventoryItem.id,
+    productName: product.name,
+    categoryId: category.id,
+    conditionId: condition.id,
+    askingPriceMinor: 2499,
+    status: 'PENDING',
+  });
+
+  assert.equal(
+    (await productRepository.findPublicBySlug(product.slug))?.id,
+    product.id,
+  );
+
+  await database.db
+    .update(listings)
+    .set({ status: 'CLOSED' })
+    .where(sql`inventory_item_id = ${inventoryItem.id}`);
+
+  assert.equal(await productRepository.findPublicBySlug(product.slug), null);
+});
+
 test('retrieves only non-revoked, non-expired sessions', async () => {
   const { user, seller } = await createCatalogPrerequisites();
   const tokenHash = 'a hashed session token';