pokemon-inventory/apps/api/tests/http/admin-product-routes.test.js

import assert from 'node:assert/strict';
import test from 'node:test';

import { buildApp } from '../../src/app/build-app.js';
import { createInventoryItemService } from '../../src/modules/inventory/services/inventory-item-service.js';
import { createProductService } from '../../src/modules/products/services/product-service.js';

function createTestApp({ authenticateAdmin, authorizeUnsafeRequest } = {}) {
  const products = [];
  const inventoryItems = [];
  const productRepository = {
    async create(product) {
      const createdProduct = {
        id: '8a0a836a-a597-454d-8c5e-e146d27dbbf1',
        ...product,
        createdAt: new Date('2026-09-07T00:00:00.000Z'),
        updatedAt: new Date('2026-09-07T00:00:00.000Z'),
      };
      products.push(createdProduct);
      return createdProduct;
    },
    async findBySellerIdAndSlug(sellerId, slug) {
      return products.find(
        (product) => product.sellerId === sellerId && product.slug === slug,
      );
    },
    async listBySellerId(sellerId) {
      return products.filter((product) => product.sellerId === sellerId);
    },
  };

  return buildApp({
    authenticateAdmin,
    authorizeUnsafeRequest,
    inventoryItemService: createInventoryItemService({
      productRepository: {
        async findById(id) {
          return products.find((product) => product.id === id) ?? null;
        },
      },
      conditionRepository: {
        async findById(id) {
          return id === '21eb218b-7a95-4f80-a9e3-e306f7ca1f2e'
            ? {
                id,
                categoryId: 'ab8150c7-96c1-4b55-8d69-7d0b77d48958',
              }
            : null;
        },
      },
      inventoryItemRepository: {
        async create(inventoryItem) {
          const createdItem = {
            id: '8a0a836a-a597-454d-8c5e-e146d27dbbf2',
            ...inventoryItem,
            status: 'ACTIVE',
            createdAt: new Date('2026-09-07T00:00:00.000Z'),
            updatedAt: new Date('2026-09-07T00:00:00.000Z'),
          };
          inventoryItems.push(createdItem);
          return createdItem;
        },
        async listBySellerId() {
          return inventoryItems;
        },
        async archiveByIdsForSeller(ids) {
          return inventoryItems.filter(({ id }) => ids.includes(id)).map((item) => {
            item.status = 'ARCHIVED';
            return item;
          });
        },
      },
    }),
    productService: createProductService({ productRepository }),
  });
}

test('creates and lists products for the authenticated seller', async (testContext) => {
  const app = createTestApp({
    authenticateAdmin: async () => ({ sellerId: 'b078adf4-6a91-4b3d-a263-740246c11e3f' }),
  });
  testContext.after(() => app.close());

  const createResponse = await app.inject({
    method: 'POST',
    url: '/api/v1/admin/products',
    payload: {
      name: 'Pikachu Plush',
      categoryId: 'ab8150c7-96c1-4b55-8d69-7d0b77d48958',
    },
  });

  assert.equal(createResponse.statusCode, 201);
  assert.equal(createResponse.json().data.slug, 'pikachu-plush');

  const listResponse = await app.inject({
    method: 'GET',
    url: '/api/v1/admin/products',
  });

  assert.equal(listResponse.statusCode, 200);
  assert.equal(listResponse.json().data.length, 1);
});

test('rejects invalid product requests', async (testContext) => {
  const app = createTestApp({
    authenticateAdmin: async () => ({ sellerId: 'b078adf4-6a91-4b3d-a263-740246c11e3f' }),
  });
  testContext.after(() => app.close());

  const response = await app.inject({
    method: 'POST',
    url: '/api/v1/admin/products',
    payload: { name: '' },
  });

  assert.equal(response.statusCode, 400);
  assert.equal(response.json().error.code, 'VALIDATION_ERROR');
});

test('rejects unauthenticated admin requests by default', async (testContext) => {
  const app = createTestApp();
  testContext.after(() => app.close());

  const response = await app.inject({
    method: 'GET',
    url: '/api/v1/admin/products',
  });

  assert.equal(response.statusCode, 401);
  assert.equal(response.json().error.code, 'UNAUTHORIZED');
});

test('creates inventory only for the authenticated sellers product', async (testContext) => {
  const app = createTestApp({
    authenticateAdmin: async () => ({ sellerId: 'b078adf4-6a91-4b3d-a263-740246c11e3f' }),
  });
  testContext.after(() => app.close());
  const productResponse = await app.inject({
    method: 'POST',
    url: '/api/v1/admin/products',
    payload: {
      name: 'Pikachu Plush',
      categoryId: 'ab8150c7-96c1-4b55-8d69-7d0b77d48958',
    },
  });

  const response = await app.inject({
    method: 'POST',
    url: '/api/v1/admin/inventory',
    payload: {
      productId: productResponse.json().data.id,
      conditionId: '21eb218b-7a95-4f80-a9e3-e306f7ca1f2e',
    },
  });

  assert.equal(response.statusCode, 201);
  assert.equal(response.json().data.status, 'ACTIVE');
});

test('archives selected inventory through the authenticated bulk route', async (testContext) => {
  const app = createTestApp({
    authenticateAdmin: async () => ({ sellerId: 'b078adf4-6a91-4b3d-a263-740246c11e3f' }),
  });
  testContext.after(() => app.close());

  const productResponse = await app.inject({
    method: 'POST',
    url: '/api/v1/admin/products',
    payload: {
      name: 'Pikachu Plush',
      categoryId: 'ab8150c7-96c1-4b55-8d69-7d0b77d48958',
    },
  });
  await app.inject({
    method: 'POST',
    url: '/api/v1/admin/inventory',
    payload: {
      productId: productResponse.json().data.id,
      conditionId: '21eb218b-7a95-4f80-a9e3-e306f7ca1f2e',
    },
  });
  const response = await app.inject({
    method: 'POST',
    url: '/api/v1/admin/bulk',
    payload: {
      action: 'ARCHIVE',
      inventoryItemIds: ['8a0a836a-a597-454d-8c5e-e146d27dbbf2'],
    },
  });

  assert.equal(response.statusCode, 200);
  assert.equal(response.json().data[0].status, 'ARCHIVED');
});

test('rejects an authenticated product write without a CSRF token', async (testContext) => {
  const app = createTestApp({
    authenticateAdmin: async () => ({ sellerId: 'b078adf4-6a91-4b3d-a263-740246c11e3f' }),
    authorizeUnsafeRequest: async () => {
      const error = new Error('CSRF validation failed.');
      error.code = 'FORBIDDEN';
      error.statusCode = 403;
      throw error;
    },
  });
  testContext.after(() => app.close());

  const response = await app.inject({
    method: 'POST',
    url: '/api/v1/admin/products',
    headers: { cookie: 'pokemon_inventory_session=raw-session-token' },
    payload: {
      name: 'Pikachu Plush',
      categoryId: 'ab8150c7-96c1-4b55-8d69-7d0b77d48958',
    },
  });

  assert.equal(response.statusCode, 403);
  assert.equal(response.json().error.code, 'FORBIDDEN');
});