feat: establish auth listing and image vertical slices

Includes MFA-capable authentication, session and CSRF security, password recovery, listing lifecycle and ownership rules, inventory image metadata, local ImageStorage, migrations, tests, and implementation status documentation. Verification: npm test (62 passing) and integration suite (14 passing).

apps/api/tests/http/admin-product-routes.test.js

@@ -0,0 +1,173 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { buildApp } from '../../src/app/build-app.js';
+import { createInventoryItemService } from '../../src/modules/inventory/services/inventory-item-service.js';
+import { createProductService } from '../../src/modules/products/services/product-service.js';
+
+function createTestApp({ authenticateAdmin, authorizeUnsafeRequest } = {}) {
+  const products = [];
+  const productRepository = {
+    async create(product) {
+      const createdProduct = {
+        id: '8a0a836a-a597-454d-8c5e-e146d27dbbf1',
+        ...product,
+        createdAt: new Date('2026-09-07T00:00:00.000Z'),
+        updatedAt: new Date('2026-09-07T00:00:00.000Z'),
+      };
+      products.push(createdProduct);
+      return createdProduct;
+    },
+    async findBySellerIdAndSlug(sellerId, slug) {
+      return products.find(
+        (product) => product.sellerId === sellerId && product.slug === slug,
+      );
+    },
+    async listBySellerId(sellerId) {
+      return products.filter((product) => product.sellerId === sellerId);
+    },
+  };
+
+  return buildApp({
+    authenticateAdmin,
+    authorizeUnsafeRequest,
+    inventoryItemService: createInventoryItemService({
+      productRepository: {
+        async findById(id) {
+          return products.find((product) => product.id === id) ?? null;
+        },
+      },
+      conditionRepository: {
+        async findById(id) {
+          return id === '21eb218b-7a95-4f80-a9e3-e306f7ca1f2e'
+            ? {
+                id,
+                categoryId: 'ab8150c7-96c1-4b55-8d69-7d0b77d48958',
+              }
+            : null;
+        },
+      },
+      inventoryItemRepository: {
+        async create(inventoryItem) {
+          return {
+            id: 'inventory-1',
+            ...inventoryItem,
+            status: 'ACTIVE',
+            createdAt: new Date('2026-09-07T00:00:00.000Z'),
+            updatedAt: new Date('2026-09-07T00:00:00.000Z'),
+          };
+        },
+      },
+    }),
+    productService: createProductService({ productRepository }),
+  });
+}
+
+test('creates and lists products for the authenticated seller', async (testContext) => {
+  const app = createTestApp({
+    authenticateAdmin: async () => ({ sellerId: 'b078adf4-6a91-4b3d-a263-740246c11e3f' }),
+  });
+  testContext.after(() => app.close());
+
+  const createResponse = await app.inject({
+    method: 'POST',
+    url: '/api/v1/admin/products',
+    payload: {
+      name: 'Pikachu Plush',
+      categoryId: 'ab8150c7-96c1-4b55-8d69-7d0b77d48958',
+    },
+  });
+
+  assert.equal(createResponse.statusCode, 201);
+  assert.equal(createResponse.json().data.slug, 'pikachu-plush');
+
+  const listResponse = await app.inject({
+    method: 'GET',
+    url: '/api/v1/admin/products',
+  });
+
+  assert.equal(listResponse.statusCode, 200);
+  assert.equal(listResponse.json().data.length, 1);
+});
+
+test('rejects invalid product requests', async (testContext) => {
+  const app = createTestApp({
+    authenticateAdmin: async () => ({ sellerId: 'b078adf4-6a91-4b3d-a263-740246c11e3f' }),
+  });
+  testContext.after(() => app.close());
+
+  const response = await app.inject({
+    method: 'POST',
+    url: '/api/v1/admin/products',
+    payload: { name: '' },
+  });
+
+  assert.equal(response.statusCode, 400);
+  assert.equal(response.json().error.code, 'VALIDATION_ERROR');
+});
+
+test('rejects unauthenticated admin requests by default', async (testContext) => {
+  const app = createTestApp();
+  testContext.after(() => app.close());
+
+  const response = await app.inject({
+    method: 'GET',
+    url: '/api/v1/admin/products',
+  });
+
+  assert.equal(response.statusCode, 401);
+  assert.equal(response.json().error.code, 'UNAUTHORIZED');
+});
+
+test('creates inventory only for the authenticated sellers product', async (testContext) => {
+  const app = createTestApp({
+    authenticateAdmin: async () => ({ sellerId: 'b078adf4-6a91-4b3d-a263-740246c11e3f' }),
+  });
+  testContext.after(() => app.close());
+  const productResponse = await app.inject({
+    method: 'POST',
+    url: '/api/v1/admin/products',
+    payload: {
+      name: 'Pikachu Plush',
+      categoryId: 'ab8150c7-96c1-4b55-8d69-7d0b77d48958',
+    },
+  });
+
+  const response = await app.inject({
+    method: 'POST',
+    url: '/api/v1/admin/inventory',
+    payload: {
+      productId: productResponse.json().data.id,
+      conditionId: '21eb218b-7a95-4f80-a9e3-e306f7ca1f2e',
+    },
+  });
+
+  assert.equal(response.statusCode, 201);
+  assert.equal(response.json().data.status, 'ACTIVE');
+});
+
+test('rejects an authenticated product write without a CSRF token', async (testContext) => {
+  const app = createTestApp({
+    authenticateAdmin: async () => ({ sellerId: 'b078adf4-6a91-4b3d-a263-740246c11e3f' }),
+    authorizeUnsafeRequest: async () => {
+      const error = new Error('CSRF validation failed.');
+      error.code = 'FORBIDDEN';
+      error.statusCode = 403;
+      throw error;
+    },
+  });
+  testContext.after(() => app.close());
+
+  const response = await app.inject({
+    method: 'POST',
+    url: '/api/v1/admin/products',
+    headers: { cookie: 'pokemon_inventory_session=raw-session-token' },
+    payload: {
+      name: 'Pikachu Plush',
+      categoryId: 'ab8150c7-96c1-4b55-8d69-7d0b77d48958',
+    },
+  });
+
+  assert.equal(response.statusCode, 403);
+  assert.equal(response.json().error.code, 'FORBIDDEN');
+});