pokemon-inventory/apps/api/tests/http/sale-routes.test.js

import assert from 'node:assert/strict';
import test from 'node:test';

import { buildApp } from '../../src/app/build-app.js';

const saleResult = {
  sale: {
    id: 'sale-1',
    sellerId: 'seller-1',
    saleDate: '2026-09-09',
    soldPriceMinor: 2499,
    currency: 'USD',
    platformFeesMinor: 0,
    paymentProcessingFeesMinor: 0,
    shippingCostMinor: 0,
    taxesMinor: 0,
    otherFeesMinor: 0,
  },
  saleItem: {
    id: 'sale-item-1',
    inventoryItemId: 'inventory-1',
    soldPriceMinor: 2499,
    costBasisMinor: 1200,
  },
  inventoryItem: { id: 'inventory-1', status: 'SOLD' },
};

function createTestApp({ authenticateAdmin, authorizeUnsafeRequest } = {}) {
  return buildApp({
    authenticateAdmin,
    authorizeUnsafeRequest,
    saleService: {
      async create(input) {
        assert.equal(input.sellerId, 'seller-1');
        return saleResult;
      },
    },
  });
}

test('creates a sale for the authenticated seller with CSRF protection', async (testContext) => {
  let csrfChecks = 0;
  const app = createTestApp({
    authenticateAdmin: async () => ({ sellerId: 'seller-1' }),
    authorizeUnsafeRequest: async () => { csrfChecks += 1; },
  });
  testContext.after(() => app.close());

  const response = await app.inject({
    method: 'POST',
    url: '/api/v1/admin/sales',
    headers: { 'x-csrf-token': 'csrf-token' },
    payload: {
      inventoryItemId: 'd2f67d74-9647-48d5-b3a4-74d3b16ea9f8',
      costBasisMinor: 1200,
      saleDate: '2026-09-09',
      soldPriceMinor: 2499,
    },
  });

  assert.equal(response.statusCode, 201);
  assert.equal(response.json().data.inventoryItem.status, 'SOLD');
  assert.equal(csrfChecks, 1);
});

test('rejects invalid sale requests and unauthenticated requests', async (testContext) => {
  const app = createTestApp({ authenticateAdmin: async () => ({ sellerId: 'seller-1' }) });
  testContext.after(() => app.close());

  const invalidResponse = await app.inject({
    method: 'POST',
    url: '/api/v1/admin/sales',
    payload: {
      inventoryItemId: 'not-a-uuid',
      costBasisMinor: -1,
      saleDate: 'tomorrow',
      soldPriceMinor: 0,
    },
  });
  assert.equal(invalidResponse.statusCode, 400);
  assert.equal(invalidResponse.json().error.code, 'VALIDATION_ERROR');

  const unauthenticatedApp = createTestApp();
  testContext.after(() => unauthenticatedApp.close());
  const unauthenticatedResponse = await unauthenticatedApp.inject({
    method: 'POST',
    url: '/api/v1/admin/sales',
    payload: {},
  });
  assert.equal(unauthenticatedResponse.statusCode, 401);
  assert.equal(unauthenticatedResponse.json().error.code, 'UNAUTHORIZED');
});

test('voids a sale with CSRF protection and actor identity', async (testContext) => {
  let voidInput;
  const app = buildApp({
    authenticateAdmin: async () => ({ userId: 'user-1', sellerId: 'seller-1' }),
    authorizeUnsafeRequest: async () => {},
    saleService: {
      async void(input) {
        voidInput = input;
        return saleResult;
      },
    },
  });
  testContext.after(() => app.close());

  const response = await app.inject({
    method: 'POST',
    url: '/api/v1/admin/sales/sale-1/void',
    headers: { 'x-csrf-token': 'csrf-token' },
    payload: { reason: 'Duplicate entry' },
  });

  assert.equal(response.statusCode, 200);
  assert.equal(voidInput.actorUserId, 'user-1');
  assert.equal(response.json().data.inventoryItem.status, 'SOLD');
});