feat: add public product catalog boundary

apps/api/tests/application/public-product-service.test.js

@@ -0,0 +1,42 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { createPublicProductService } from '../../src/modules/products/services/public-product-service.js';
+
+test('returns only a publicly visible product', async () => {
+  const service = createPublicProductService({
+    productRepository: {
+      async findPublicBySlug(slug) {
+        assert.equal(slug, 'pikachu-plush');
+        return {
+          id: 'product-1',
+          sellerId: 'private-seller-id',
+          categoryId: 'category-1',
+          name: 'Pikachu Plush',
+          slug,
+          description: 'A friendly plush.',
+        };
+      },
+    },
+  });
+
+  assert.deepEqual(await service.getBySlug('pikachu-plush'), {
+    id: 'product-1',
+    sellerId: 'private-seller-id',
+    categoryId: 'category-1',
+    name: 'Pikachu Plush',
+    slug: 'pikachu-plush',
+    description: 'A friendly plush.',
+  });
+});
+
+test('returns a not-found application error for non-public products', async () => {
+  const service = createPublicProductService({
+    productRepository: { async findPublicBySlug() { return null; } },
+  });
+
+  await assert.rejects(
+    () => service.getBySlug('hidden-product'),
+    (error) => error.code === 'PRODUCT_NOT_FOUND' && error.statusCode === 404,
+  );
+});

apps/api/tests/http/public-product-routes.test.js

@@ -0,0 +1,70 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { buildApp } from '../../src/app/build-app.js';
+
+function createTestApp() {
+  return buildApp({
+    publicProductService: {
+      async getBySlug(slug) {
+        if (slug !== 'pikachu-plush') {
+          const error = new Error('Product was not found.');
+          error.code = 'PRODUCT_NOT_FOUND';
+          error.statusCode = 404;
+          throw error;
+        }
+
+        return {
+          id: 'product-1',
+          sellerId: 'private-seller-id',
+          categoryId: 'category-1',
+          name: 'Pikachu Plush',
+          slug,
+          description: 'A friendly plush.',
+          createdAt: new Date('2026-09-07T00:00:00.000Z'),
+          updatedAt: new Date('2026-09-07T00:00:00.000Z'),
+        };
+      },
+    },
+  });
+}
+
+test('returns a public product without private seller identity', async (testContext) => {
+  const app = createTestApp();
+  testContext.after(() => app.close());
+
+  const response = await app.inject({
+    method: 'GET',
+    url: '/api/v1/public/products/pikachu-plush',
+  });
+
+  assert.equal(response.statusCode, 200);
+  assert.deepEqual(response.json().data, {
+    id: 'product-1',
+    categoryId: 'category-1',
+    name: 'Pikachu Plush',
+    slug: 'pikachu-plush',
+    description: 'A friendly plush.',
+    brand: null,
+    setName: null,
+    cardNumber: null,
+    eventName: null,
+    releaseYear: null,
+    createdAt: '2026-09-07T00:00:00.000Z',
+    updatedAt: '2026-09-07T00:00:00.000Z',
+  });
+  assert.equal('sellerId' in response.json().data, false);
+});
+
+test('returns not found when a product is not publicly visible', async (testContext) => {
+  const app = createTestApp();
+  testContext.after(() => app.close());
+
+  const response = await app.inject({
+    method: 'GET',
+    url: '/api/v1/public/products/hidden-product',
+  });
+
+  assert.equal(response.statusCode, 404);
+  assert.equal(response.json().error.code, 'PRODUCT_NOT_FOUND');
+});

apps/api/tests/integration/catalog-repositories.test.js

@@ -8,6 +8,7 @@ import {
   categories,
   conditionProfiles,
   conditions,
+  listings,
   mfaMethods,
   passwordResetTokens,
   securityAuditEvents,
@@ -154,6 +155,41 @@ test('finds a product by both its seller and slug', async () => {
   );
 });
 
+test('finds only products with active inventory and a public listing', async () => {
+  const { seller, category, condition } = await createCatalogPrerequisites();
+  const product = await productRepository.create({
+    sellerId: seller.id,
+    categoryId: category.id,
+    name: 'Public Pikachu Plush',
+    slug: 'public-pikachu-plush',
+  });
+  const inventoryItem = await inventoryItemRepository.create({
+    productId: product.id,
+    conditionId: condition.id,
+  });
+
+  await database.db.insert(listings).values({
+    inventoryItemId: inventoryItem.id,
+    productName: product.name,
+    categoryId: category.id,
+    conditionId: condition.id,
+    askingPriceMinor: 2499,
+    status: 'PENDING',
+  });
+
+  assert.equal(
+    (await productRepository.findPublicBySlug(product.slug))?.id,
+    product.id,
+  );
+
+  await database.db
+    .update(listings)
+    .set({ status: 'CLOSED' })
+    .where(sql`inventory_item_id = ${inventoryItem.id}`);
+
+  assert.equal(await productRepository.findPublicBySlug(product.slug), null);
+});
+
 test('retrieves only non-revoked, non-expired sessions', async () => {
   const { user, seller } = await createCatalogPrerequisites();
   const tokenHash = 'a hashed session token';