feat: add seller settings

apps/api/tests/application/seller-settings-service.test.js

@@ -0,0 +1,42 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { createSellerSettingsService } from '../../src/modules/settings/services/seller-settings-service.js';
+
+test('merges validated seller settings without replacing other categories', async () => {
+  let stored = null;
+  const service = createSellerSettingsService({
+    sellerSettingsRepository: {
+      async findBySellerId() { return stored; },
+      async upsert(sellerId, settings) {
+        stored = { sellerId, settings };
+        return stored;
+      },
+    },
+  });
+
+  await service.update({
+    sellerId: 'seller-1',
+    settings: { pricing: { defaultStrategy: 'median' }, general: { publicContactEmail: 'owner@example.test' } },
+  });
+  const result = await service.update({
+    sellerId: 'seller-1',
+    settings: { inventory: { maxImagesPerItem: 12 } },
+  });
+
+  assert.deepEqual(result, {
+    pricing: { defaultStrategy: 'median' },
+    general: { publicContactEmail: 'owner@example.test' },
+    inventory: { maxImagesPerItem: 12 },
+  });
+});
+
+test('rejects unknown or invalid settings', async () => {
+  const service = createSellerSettingsService({
+    sellerSettingsRepository: { async findBySellerId() { return null; } },
+  });
+
+  await assert.rejects(
+    () => service.update({ sellerId: 'seller-1', settings: { secrets: { token: 'nope' } } }),
+  );
+});

apps/api/tests/http/admin-settings-routes.test.js

@@ -0,0 +1,60 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { buildApp } from '../../src/app/build-app.js';
+
+function createTestApp({ authorizeUnsafeRequest } = {}) {
+  let settings = { pricing: { defaultStrategy: 'median' } };
+  return buildApp({
+    authenticateAdmin: async () => ({ sellerId: 'seller-1' }),
+    authorizeUnsafeRequest,
+    sellerSettingsService: {
+      async get() { return settings; },
+      async update({ settings: nextSettings }) {
+        settings = { ...settings, ...nextSettings };
+        return settings;
+      },
+    },
+  });
+}
+
+test('reads and updates seller settings', async (testContext) => {
+  const app = createTestApp();
+  testContext.after(() => app.close());
+
+  const readResponse = await app.inject({ method: 'GET', url: '/api/v1/admin/settings' });
+  const updateResponse = await app.inject({
+    method: 'PATCH',
+    url: '/api/v1/admin/settings',
+    payload: { inventory: { maxImagesPerItem: 12 } },
+  });
+
+  assert.equal(readResponse.statusCode, 200);
+  assert.deepEqual(readResponse.json().data, { pricing: { defaultStrategy: 'median' } });
+  assert.equal(updateResponse.statusCode, 200);
+  assert.deepEqual(updateResponse.json().data, {
+    pricing: { defaultStrategy: 'median' },
+    inventory: { maxImagesPerItem: 12 },
+  });
+});
+
+test('protects settings updates with CSRF validation', async (testContext) => {
+  const app = createTestApp({
+    authorizeUnsafeRequest: async () => {
+      const error = new Error('CSRF validation failed.');
+      error.code = 'FORBIDDEN';
+      error.statusCode = 403;
+      throw error;
+    },
+  });
+  testContext.after(() => app.close());
+
+  const response = await app.inject({
+    method: 'PATCH',
+    url: '/api/v1/admin/settings',
+    payload: { pricing: { defaultStrategy: 'median' } },
+  });
+
+  assert.equal(response.statusCode, 403);
+  assert.equal(response.json().error.code, 'FORBIDDEN');
+});