80 lines
3.3 KiB
JavaScript
80 lines
3.3 KiB
JavaScript
import assert from 'node:assert/strict';
|
|
import test from 'node:test';
|
|
|
|
import { createSellerSettingsService } from '../../src/modules/settings/services/seller-settings-service.js';
|
|
import { buildApp } from '../../src/app/build-app.js';
|
|
|
|
function createTestApp({ authorizeUnsafeRequest } = {}) {
|
|
let settings = { pricing: { defaultStrategy: 'median' } };
|
|
return buildApp({
|
|
authenticateAdmin: async () => ({ sellerId: 'seller-1' }),
|
|
authorizeUnsafeRequest,
|
|
sellerSettingsService: createSellerSettingsService({ sellerSettingsRepository: {
|
|
async findBySellerId(sellerId) { assert.equal(sellerId, 'seller-1'); return { settings }; },
|
|
async upsert(sellerId, nextSettings) {
|
|
assert.equal(sellerId, 'seller-1');
|
|
settings = nextSettings;
|
|
return { settings };
|
|
},
|
|
} }),
|
|
});
|
|
}
|
|
|
|
test('reads and updates seller settings', async (testContext) => {
|
|
const app = createTestApp();
|
|
testContext.after(() => app.close());
|
|
|
|
const readResponse = await app.inject({ method: 'GET', url: '/api/v1/admin/settings' });
|
|
const updateResponse = await app.inject({
|
|
method: 'PATCH',
|
|
url: '/api/v1/admin/settings',
|
|
payload: { inventory: { maxImagesPerItem: 12 } },
|
|
});
|
|
|
|
assert.equal(readResponse.statusCode, 200);
|
|
assert.deepEqual(readResponse.json().data, { pricing: { defaultStrategy: 'median' } });
|
|
assert.equal(updateResponse.statusCode, 200);
|
|
assert.deepEqual(updateResponse.json().data, {
|
|
pricing: { defaultStrategy: 'median' },
|
|
inventory: { maxImagesPerItem: 12 },
|
|
});
|
|
});
|
|
|
|
test('protects settings updates with CSRF validation', async (testContext) => {
|
|
const app = createTestApp({
|
|
authorizeUnsafeRequest: async () => {
|
|
const error = new Error('CSRF validation failed.');
|
|
error.code = 'FORBIDDEN';
|
|
error.statusCode = 403;
|
|
throw error;
|
|
},
|
|
});
|
|
testContext.after(() => app.close());
|
|
|
|
const response = await app.inject({
|
|
method: 'PATCH',
|
|
url: '/api/v1/admin/settings',
|
|
payload: { pricing: { defaultStrategy: 'median' } },
|
|
});
|
|
|
|
assert.equal(response.statusCode, 403);
|
|
assert.equal(response.json().error.code, 'FORBIDDEN');
|
|
});
|
|
|
|
|
|
test('clears public contacts explicitly while omitted fields retain their values', async (testContext) => {
|
|
const app = createTestApp();
|
|
testContext.after(() => app.close());
|
|
const patch = (general) => app.inject({ method: 'PATCH', url: '/api/v1/admin/settings', payload: { general } });
|
|
assert.equal((await patch({ publicContactEmail: ' owner@example.test ', publicContactPhone: '555-0100', publicDescription: 'Collector.' })).statusCode, 200);
|
|
const clearedEmail = await patch({ publicContactEmail: ' ' });
|
|
assert.equal(clearedEmail.statusCode, 200);
|
|
assert.deepEqual(clearedEmail.json().data.general, { publicContactEmail: '', publicContactPhone: '555-0100', publicDescription: 'Collector.' });
|
|
assert.equal((await patch({ publicContactPhone: '' })).statusCode, 200);
|
|
const read = await app.inject({ method: 'GET', url: '/api/v1/admin/settings' });
|
|
assert.deepEqual(read.json().data.general, { publicContactEmail: '', publicContactPhone: '', publicDescription: 'Collector.' });
|
|
for (const general of [{ publicContactEmail: 'invalid' }, { publicContactEmail: null }, { publicContactPhone: 'x'.repeat(51) }]) {
|
|
assert.equal((await patch(general)).statusCode, 400);
|
|
}
|
|
});
|