pokemon-inventory/apps/api/tests/http/acquisition-routes.test.js

import assert from "node:assert/strict";
import test from "node:test";

import { buildApp } from "../../src/app/build-app.js";

function createTestApp({ authenticateAdmin, authorizeUnsafeRequest } = {}) {
  return buildApp({
    authenticateAdmin,
    authorizeUnsafeRequest,
    acquisitionService: {
      async create(input) {
        return { id: "acquisition-1", ...input, costBasisMinor: 1075 };
      },
      async list() {
        return [];
      },
    },
  });
}

test("creates an acquisition for the authenticated seller", async (testContext) => {
  let csrfChecked = false;
  const app = createTestApp({
    authenticateAdmin: async () => ({ sellerId: "seller-1" }),
    authorizeUnsafeRequest: async () => {
      csrfChecked = true;
    },
  });
  testContext.after(() => app.close());

  const response = await app.inject({
    method: "POST",
    url: "/api/v1/admin/acquisitions",
    headers: { "x-csrf-token": "csrf-token" },
    payload: {
      inventoryItemId: "d2f67d74-9647-48d5-b3a4-74d3b16ea9f8",
      method: "PURCHASE",
      costMinor: 1000,
    },
  });

  assert.equal(response.statusCode, 201);
  assert.equal(response.json().data.costBasisMinor, 1075);
  assert.equal(csrfChecked, true);
});

test("rejects invalid acquisition requests", async (testContext) => {
  const app = createTestApp({
    authenticateAdmin: async () => ({ sellerId: "seller-1" }),
  });
  testContext.after(() => app.close());

  const response = await app.inject({
    method: "POST",
    url: "/api/v1/admin/acquisitions",
    payload: { inventoryItemId: "not-a-uuid", method: "", costMinor: -1 },
  });

  assert.equal(response.statusCode, 400);
  assert.equal(response.json().error.code, "VALIDATION_ERROR");
});