fix: allow sellers to remove public contact methods

apps/api/tests/http/admin-settings-routes.test.js

@@ -1,6 +1,7 @@
 import assert from 'node:assert/strict';
 import test from 'node:test';
 
+import { createSellerSettingsService } from '../../src/modules/settings/services/seller-settings-service.js';
 import { buildApp } from '../../src/app/build-app.js';
 
 function createTestApp({ authorizeUnsafeRequest } = {}) {
@@ -8,13 +9,14 @@ function createTestApp({ authorizeUnsafeRequest } = {}) {
   return buildApp({
     authenticateAdmin: async () => ({ sellerId: 'seller-1' }),
     authorizeUnsafeRequest,
-    sellerSettingsService: {
-      async get() { return settings; },
-      async update({ settings: nextSettings }) {
-        settings = { ...settings, ...nextSettings };
-        return settings;
+    sellerSettingsService: createSellerSettingsService({ sellerSettingsRepository: {
+      async findBySellerId(sellerId) { assert.equal(sellerId, 'seller-1'); return { settings }; },
+      async upsert(sellerId, nextSettings) {
+        assert.equal(sellerId, 'seller-1');
+        settings = nextSettings;
+        return { settings };
       },
-    },
+    } }),
   });
 }
 
@@ -58,3 +60,20 @@ test('protects settings updates with CSRF validation', async (testContext) => {
   assert.equal(response.statusCode, 403);
   assert.equal(response.json().error.code, 'FORBIDDEN');
 });
+
+
+test('clears public contacts explicitly while omitted fields retain their values', async (testContext) => {
+  const app = createTestApp();
+  testContext.after(() => app.close());
+  const patch = (general) => app.inject({ method: 'PATCH', url: '/api/v1/admin/settings', payload: { general } });
+  assert.equal((await patch({ publicContactEmail: ' owner@example.test ', publicContactPhone: '555-0100', publicDescription: 'Collector.' })).statusCode, 200);
+  const clearedEmail = await patch({ publicContactEmail: '  ' });
+  assert.equal(clearedEmail.statusCode, 200);
+  assert.deepEqual(clearedEmail.json().data.general, { publicContactEmail: '', publicContactPhone: '555-0100', publicDescription: 'Collector.' });
+  assert.equal((await patch({ publicContactPhone: '' })).statusCode, 200);
+  const read = await app.inject({ method: 'GET', url: '/api/v1/admin/settings' });
+  assert.deepEqual(read.json().data.general, { publicContactEmail: '', publicContactPhone: '', publicDescription: 'Collector.' });
+  for (const general of [{ publicContactEmail: 'invalid' }, { publicContactEmail: null }, { publicContactPhone: 'x'.repeat(51) }]) {
+    assert.equal((await patch(general)).statusCode, 400);
+  }
+});