pokemon-inventory/apps/api/tests/http/acquisition-routes.test.js

import assert from 'node:assert/strict';
import test from 'node:test';

import { buildApp } from '../../src/app/build-app.js';

function createTestApp({ authenticateAdmin, authorizeUnsafeRequest } = {}) {
  return buildApp({
    authenticateAdmin,
    authorizeUnsafeRequest,
    acquisitionService: {
      async create(input) {
        return { id: 'acquisition-1', ...input, costBasisMinor: 1075 };
      },
      async list() {
        return [];
      },
    },
  });
}

test('creates an acquisition for the authenticated seller', async (testContext) => {
  let csrfChecked = false;
  const app = createTestApp({
    authenticateAdmin: async () => ({ sellerId: 'seller-1' }),
    authorizeUnsafeRequest: async () => { csrfChecked = true; },
  });
  testContext.after(() => app.close());

  const response = await app.inject({
    method: 'POST',
    url: '/api/v1/admin/acquisitions',
    headers: { 'x-csrf-token': 'csrf-token' },
    payload: {
      inventoryItemId: 'd2f67d74-9647-48d5-b3a4-74d3b16ea9f8',
      method: 'PURCHASE',
      costMinor: 1000,
    },
  });

  assert.equal(response.statusCode, 201);
  assert.equal(response.json().data.costBasisMinor, 1075);
  assert.equal(csrfChecked, true);
});

test('rejects invalid acquisition requests', async (testContext) => {
  const app = createTestApp({ authenticateAdmin: async () => ({ sellerId: 'seller-1' }) });
  testContext.after(() => app.close());

  const response = await app.inject({
    method: 'POST',
    url: '/api/v1/admin/acquisitions',
    payload: { inventoryItemId: 'not-a-uuid', method: '', costMinor: -1 },
  });

  assert.equal(response.statusCode, 400);
  assert.equal(response.json().error.code, 'VALIDATION_ERROR');
});