mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-19 05:26:47 +00:00
Maurice
00cbc5aae3
tests/setup.ts mocks src/config once with tests/helpers/test-config.ts. A suite that needs other values calls overrideTestConfig(), and the setup file restores the defaults after every case. The 191 per-file factories are gone; config.test.ts takes the real module through vi.unmock, and the few suites that signed tokens with their own literal secret read it from TEST_CONFIG.
920 lines
42 KiB
TypeScript
920 lines
42 KiB
TypeScript
/**
|
|
* Days & Accommodations API integration tests.
|
|
* Covers DAY-001 through DAY-013 and ACCOM-001 through ACCOM-006.
|
|
*/
|
|
import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
|
|
import request from 'supertest';
|
|
import type { Application } from 'express';
|
|
import type { INestApplication } from '@nestjs/common';
|
|
import { MikroORM } from '@mikro-orm/core';
|
|
|
|
// ─────────────────────────────────────────────────────────────────────────────
|
|
// In-memory DB — schema applied in beforeAll after mocks register
|
|
// ─────────────────────────────────────────────────────────────────────────────
|
|
vi.mock('../../src/db/database', async () => {
|
|
const { createSnapshotTestDb, buildDbMock } = await import('../helpers/db-mock');
|
|
return buildDbMock(createSnapshotTestDb());
|
|
});
|
|
vi.mock('../../src/websocket', () => ({ broadcast: vi.fn(), broadcastToUser: vi.fn() }));
|
|
|
|
import { db as testDb } from '../../src/db/database';
|
|
import { buildApp } from '../../src/bootstrap';
|
|
import { resetTestDb, resetRateLimits } from '../helpers/test-db';
|
|
import { createUser, createTrip, createDay, createPlace, addTripMember, createDayAccommodation, createReservation } from '../helpers/factories';
|
|
import { authCookie } from '../helpers/auth';
|
|
import { countRows, deleteRows, findRow, findRows, insertRow, updateRows } from '../helpers/factories/rows';
|
|
import { setAppSetting } from '../helpers/factories/settings';
|
|
import type { FactoryOrm } from '../helpers/factories/context';
|
|
import { AppSettings } from '../../src/db/entities/AppSettings.entity';
|
|
import { BudgetItems } from '../../src/db/entities/BudgetItems.entity';
|
|
import { DayAccommodations } from '../../src/db/entities/DayAccommodations.entity';
|
|
import { Days } from '../../src/db/entities/Days.entity';
|
|
import { Reservations } from '../../src/db/entities/Reservations.entity';
|
|
import { Trips } from '../../src/db/entities/Trips.entity';
|
|
import { legacyBoundIntegerText } from '../../src/nest/common/row-id';
|
|
|
|
let nestApp: INestApplication;
|
|
let app: Application;
|
|
/** The app's own ORM, which the factories seed and read through. */
|
|
const orm = (): FactoryOrm => nestApp.get(MikroORM);
|
|
|
|
const dayCount = (tripId: number) => countRows(orm(), Days, { trip: tripId });
|
|
|
|
/** The trip's days in day order: id, number and date, as the reorder cases compare them. */
|
|
const dayList = async (tripId: number) =>
|
|
(await findRows(orm(), Days, { trip: tripId }, { day_number: 'asc' })).map((d) => ({ id: d.id, day_number: d.day_number, date: d.date }));
|
|
|
|
/** The stay's check-in and check-out days. */
|
|
const stayDays = async (id: number) => {
|
|
const stay = await findRow(orm(), DayAccommodations, { id });
|
|
return { start_day_id: stay?.start_day_id, end_day_id: stay?.end_day_id };
|
|
};
|
|
beforeAll(async () => {
|
|
nestApp = await buildApp();
|
|
app = nestApp.getHttpAdapter().getInstance();
|
|
});
|
|
beforeEach(async () => { resetTestDb(testDb); await resetRateLimits(nestApp); });
|
|
afterAll(async () => {
|
|
await nestApp.close();
|
|
testDb.close();
|
|
});
|
|
|
|
// ─────────────────────────────────────────────────────────────────────────────
|
|
// List days (DAY-001, DAY-002)
|
|
// ─────────────────────────────────────────────────────────────────────────────
|
|
|
|
describe('List days', () => {
|
|
it('DAY-001 — GET /api/trips/:tripId/days returns days for a trip the user can access', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Paris Trip', start_date: '2026-06-01', end_date: '2026-06-03' });
|
|
|
|
const res = await request(app)
|
|
.get(`/api/trips/${trip.id}/days`)
|
|
.set('Cookie', authCookie(user.id));
|
|
|
|
expect(res.status).toBe(200);
|
|
expect(res.body.days).toBeDefined();
|
|
expect(Array.isArray(res.body.days)).toBe(true);
|
|
expect(res.body.days).toHaveLength(3);
|
|
});
|
|
|
|
it('DAY-001 — Member can list days for a shared trip', async () => {
|
|
const { user: owner } = createUser(testDb);
|
|
const { user: member } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id, { title: 'Shared Trip', start_date: '2026-07-01', end_date: '2026-07-02' });
|
|
addTripMember(testDb, trip.id, member.id);
|
|
|
|
const res = await request(app)
|
|
.get(`/api/trips/${trip.id}/days`)
|
|
.set('Cookie', authCookie(member.id));
|
|
|
|
expect(res.status).toBe(200);
|
|
expect(res.body.days).toHaveLength(2);
|
|
});
|
|
|
|
it('DAY-002 — Non-member cannot list days (404)', async () => {
|
|
const { user: owner } = createUser(testDb);
|
|
const { user: stranger } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id, { title: 'Private Trip' });
|
|
|
|
const res = await request(app)
|
|
.get(`/api/trips/${trip.id}/days`)
|
|
.set('Cookie', authCookie(stranger.id));
|
|
|
|
expect(res.status).toBe(404);
|
|
});
|
|
|
|
it('DAY-002 — Unauthenticated request returns 401', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Trip' });
|
|
|
|
const res = await request(app).get(`/api/trips/${trip.id}/days`);
|
|
expect(res.status).toBe(401);
|
|
});
|
|
});
|
|
|
|
// ─────────────────────────────────────────────────────────────────────────────
|
|
// Create day (DAY-006, DAY-011 to DAY-013)
|
|
// ─────────────────────────────────────────────────────────────────────────────
|
|
|
|
describe('Create day', () => {
|
|
it('DAY-006 — POST /api/trips/:tripId/days creates a standalone day with no date', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Open Trip' });
|
|
|
|
const res = await request(app)
|
|
.post(`/api/trips/${trip.id}/days`)
|
|
.set('Cookie', authCookie(user.id))
|
|
.send({ notes: 'A free day' });
|
|
|
|
expect(res.status).toBe(201);
|
|
expect(res.body.day).toBeDefined();
|
|
expect(res.body.day.trip_id).toBe(trip.id);
|
|
expect(res.body.day.date).toBeNull();
|
|
expect(res.body.day.notes).toBe('A free day');
|
|
});
|
|
|
|
it('DAY-006 — POST /api/trips/:tripId/days creates a day with a date', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Dated Trip' });
|
|
|
|
const res = await request(app)
|
|
.post(`/api/trips/${trip.id}/days`)
|
|
.set('Cookie', authCookie(user.id))
|
|
.send({ date: '2026-08-15' });
|
|
|
|
expect(res.status).toBe(201);
|
|
expect(res.body.day.date).toBe('2026-08-15');
|
|
});
|
|
|
|
it('DAY-006 — Non-member cannot create a day (404)', async () => {
|
|
const { user: owner } = createUser(testDb);
|
|
const { user: stranger } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id, { title: 'Private' });
|
|
|
|
const res = await request(app)
|
|
.post(`/api/trips/${trip.id}/days`)
|
|
.set('Cookie', authCookie(stranger.id))
|
|
.send({ notes: 'Infiltration' });
|
|
|
|
expect(res.status).toBe(404);
|
|
});
|
|
|
|
it('DAY-011: a dated create adds the next date behind the dated days, and the trip ends on it', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Trip', start_date: '2026-08-01', end_date: '2026-08-02' });
|
|
const spare = createDay(testDb, trip.id);
|
|
|
|
const res = await request(app)
|
|
.post(`/api/trips/${trip.id}/days`)
|
|
.set('Cookie', authCookie(user.id))
|
|
.send({ dated: true });
|
|
|
|
expect(res.status).toBe(201);
|
|
expect(res.body.day).toMatchObject({ trip_id: trip.id, day_number: 3, date: '2026-08-03' });
|
|
expect(res.body.trip).toMatchObject({ id: trip.id, end_date: '2026-08-03', day_count: 4 });
|
|
expect(res.body.trip).not.toHaveProperty('feed_token', expect.anything());
|
|
const reread = await request(app).get(`/api/trips/${trip.id}`).set('Cookie', authCookie(user.id));
|
|
expect(reread.body.trip).toMatchObject({ start_date: '2026-08-01', end_date: '2026-08-03' });
|
|
const list = await request(app).get(`/api/trips/${trip.id}/days`).set('Cookie', authCookie(user.id));
|
|
expect(list.body.days.map((d: { id: number; date: string | null }) => [d.id, d.date])).toEqual([
|
|
[expect.any(Number), '2026-08-01'],
|
|
[expect.any(Number), '2026-08-02'],
|
|
[res.body.day.id, '2026-08-03'],
|
|
[spare.id, null],
|
|
]);
|
|
});
|
|
|
|
it('DAY-012: a dated create on a trip without dates is refused with 400 and adds nothing', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Open Trip' });
|
|
createDay(testDb, trip.id);
|
|
|
|
const res = await request(app)
|
|
.post(`/api/trips/${trip.id}/days`)
|
|
.set('Cookie', authCookie(user.id))
|
|
.send({ dated: true });
|
|
|
|
expect(res.status).toBe(400);
|
|
expect(res.body).toEqual({ error: 'This trip has no dates. Add a day without a date instead.' });
|
|
expect(await dayCount(trip.id)).toBe(1);
|
|
});
|
|
|
|
it('DAY-013: dated next to a position is refused by the contract with 400 and adds nothing', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Trip', start_date: '2026-08-01', end_date: '2026-08-02' });
|
|
|
|
const res = await request(app)
|
|
.post(`/api/trips/${trip.id}/days`)
|
|
.set('Cookie', authCookie(user.id))
|
|
.send({ dated: true, position: 1 });
|
|
|
|
expect(res.status).toBe(400);
|
|
expect(JSON.stringify(res.body)).toContain('dated cannot be combined with date or position');
|
|
expect(await dayCount(trip.id)).toBe(2);
|
|
expect((await findRow(orm(), Trips, { id: trip.id }))?.end_date).toBe('2026-08-02');
|
|
});
|
|
});
|
|
|
|
// ─────────────────────────────────────────────────────────────────────────────
|
|
// Update day (DAY-003, DAY-004)
|
|
// ─────────────────────────────────────────────────────────────────────────────
|
|
|
|
describe('Update day', () => {
|
|
it('DAY-003 — PUT /api/trips/:tripId/days/:dayId updates the day title', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'My Trip' });
|
|
const day = createDay(testDb, trip.id, { title: 'Old Title' });
|
|
|
|
const res = await request(app)
|
|
.put(`/api/trips/${trip.id}/days/${day.id}`)
|
|
.set('Cookie', authCookie(user.id))
|
|
.send({ title: 'New Title' });
|
|
|
|
expect(res.status).toBe(200);
|
|
expect(res.body.day).toBeDefined();
|
|
expect(res.body.day.title).toBe('New Title');
|
|
});
|
|
|
|
it('DAY-004 — PUT /api/trips/:tripId/days/:dayId updates the day notes', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'My Trip' });
|
|
const day = createDay(testDb, trip.id);
|
|
|
|
const res = await request(app)
|
|
.put(`/api/trips/${trip.id}/days/${day.id}`)
|
|
.set('Cookie', authCookie(user.id))
|
|
.send({ notes: 'Visit the Louvre' });
|
|
|
|
expect(res.status).toBe(200);
|
|
expect(res.body.day.notes).toBe('Visit the Louvre');
|
|
});
|
|
|
|
it('DAY-003 — PUT returns 404 for a day that does not belong to the trip', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'My Trip' });
|
|
createDay(testDb, trip.id);
|
|
|
|
const res = await request(app)
|
|
.put(`/api/trips/${trip.id}/days/999999`)
|
|
.set('Cookie', authCookie(user.id))
|
|
.send({ title: 'Ghost' });
|
|
|
|
expect(res.status).toBe(404);
|
|
expect(res.body.error).toMatch(/not found/i);
|
|
});
|
|
|
|
it('DAY-003 — Non-member cannot update a day (404)', async () => {
|
|
const { user: owner } = createUser(testDb);
|
|
const { user: stranger } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id, { title: 'Private' });
|
|
const day = createDay(testDb, trip.id, { title: 'Original' });
|
|
|
|
const res = await request(app)
|
|
.put(`/api/trips/${trip.id}/days/${day.id}`)
|
|
.set('Cookie', authCookie(stranger.id))
|
|
.send({ title: 'Hacked' });
|
|
|
|
expect(res.status).toBe(404);
|
|
});
|
|
});
|
|
|
|
// ─────────────────────────────────────────────────────────────────────────────
|
|
// Reorder days (DAY-005)
|
|
// ─────────────────────────────────────────────────────────────────────────────
|
|
|
|
describe('Reorder days', () => {
|
|
it('DAY-005 — Reorder: GET days returns them in day_number order', async () => {
|
|
const { user } = createUser(testDb);
|
|
// Create trip with 3 days auto-generated
|
|
const trip = createTrip(testDb, user.id, {
|
|
title: 'Trip',
|
|
start_date: '2026-09-01',
|
|
end_date: '2026-09-03',
|
|
});
|
|
|
|
const res = await request(app)
|
|
.get(`/api/trips/${trip.id}/days`)
|
|
.set('Cookie', authCookie(user.id));
|
|
|
|
expect(res.status).toBe(200);
|
|
expect(res.body.days).toHaveLength(3);
|
|
// Days should be ordered by day_number ascending (the service sorts by day_number ASC)
|
|
expect(res.body.days[0].date).toBe('2026-09-01');
|
|
expect(res.body.days[2].date).toBe('2026-09-03');
|
|
});
|
|
});
|
|
|
|
// ─────────────────────────────────────────────────────────────────────────────
|
|
// Delete day
|
|
// ─────────────────────────────────────────────────────────────────────────────
|
|
|
|
describe('Delete day', () => {
|
|
it('DELETE /api/trips/:tripId/days/:dayId removes the day', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Trip' });
|
|
const day = createDay(testDb, trip.id);
|
|
createDay(testDb, trip.id);
|
|
|
|
const res = await request(app)
|
|
.delete(`/api/trips/${trip.id}/days/${day.id}`)
|
|
.set('Cookie', authCookie(user.id));
|
|
|
|
expect(res.status).toBe(200);
|
|
expect(res.body.success).toBe(true);
|
|
|
|
expect(await findRow(orm(), Days, { id: day.id })).toBeNull();
|
|
});
|
|
|
|
it('DELETE /api/trips/:tripId/days/:dayId returns 404 for unknown day', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Trip' });
|
|
|
|
const res = await request(app)
|
|
.delete(`/api/trips/${trip.id}/days/999999`)
|
|
.set('Cookie', authCookie(user.id));
|
|
|
|
expect(res.status).toBe(404);
|
|
expect(res.body.error).toMatch(/not found/i);
|
|
});
|
|
|
|
it('DAY-007: the days after a deleted one close up, and the answer carries the trip with its new day count', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Trip' });
|
|
const [a, b, c] = [createDay(testDb, trip.id), createDay(testDb, trip.id), createDay(testDb, trip.id)];
|
|
|
|
const res = await request(app)
|
|
.delete(`/api/trips/${trip.id}/days/${b.id}`)
|
|
.set('Cookie', authCookie(user.id));
|
|
|
|
expect(res.status).toBe(200);
|
|
expect(res.body).toMatchObject({ success: true, trip: { id: trip.id, day_count: 2 } });
|
|
const list = await request(app).get(`/api/trips/${trip.id}/days`).set('Cookie', authCookie(user.id));
|
|
expect(list.body.days.map((d: { id: number; day_number: number }) => [d.id, d.day_number])).toEqual([[a.id, 1], [c.id, 2]]);
|
|
});
|
|
|
|
it('DAY-008: deleting a dated day with no day left to take the last date ends the trip a day earlier', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Trip', start_date: '2026-08-01', end_date: '2026-08-03' });
|
|
const [first] = await dayList(trip.id);
|
|
|
|
const res = await request(app)
|
|
.delete(`/api/trips/${trip.id}/days/${first.id}`)
|
|
.set('Cookie', authCookie(user.id));
|
|
|
|
expect(res.status).toBe(200);
|
|
expect(res.body.trip).toMatchObject({ start_date: '2026-08-01', end_date: '2026-08-02' });
|
|
const reread = await request(app).get(`/api/trips/${trip.id}`).set('Cookie', authCookie(user.id));
|
|
expect(reread.body.trip).toMatchObject({ start_date: '2026-08-01', end_date: '2026-08-02' });
|
|
const list = await request(app).get(`/api/trips/${trip.id}/days`).set('Cookie', authCookie(user.id));
|
|
expect(list.body.days.map((d: { date: string }) => d.date)).toEqual(['2026-08-01', '2026-08-02']);
|
|
});
|
|
|
|
it('DAY-009: the last day of a trip is refused with 400 and stays', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Trip' });
|
|
const day = createDay(testDb, trip.id);
|
|
|
|
const res = await request(app)
|
|
.delete(`/api/trips/${trip.id}/days/${day.id}`)
|
|
.set('Cookie', authCookie(user.id));
|
|
|
|
expect(res.status).toBe(400);
|
|
expect(res.body).toEqual({ error: 'A trip needs at least one day.' });
|
|
expect(await findRow(orm(), Days, { id: day.id })).not.toBeNull();
|
|
});
|
|
|
|
it('DAY-010: a member without day_edit gets 403 and the day stays', async () => {
|
|
const { user: owner } = createUser(testDb);
|
|
const { user: member } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id, { title: 'Trip' });
|
|
addTripMember(testDb, trip.id, member.id);
|
|
const day = createDay(testDb, trip.id);
|
|
createDay(testDb, trip.id);
|
|
await setAppSetting(orm(), 'perm_day_edit', 'trip_owner');
|
|
const { invalidatePermissionsCache } = await import('../../src/nest/permissions/permissions-cache');
|
|
await invalidatePermissionsCache();
|
|
try {
|
|
const res = await request(app)
|
|
.delete(`/api/trips/${trip.id}/days/${day.id}`)
|
|
.set('Cookie', authCookie(member.id));
|
|
expect(res.status).toBe(403);
|
|
expect(await findRow(orm(), Days, { id: day.id })).not.toBeNull();
|
|
} finally {
|
|
await deleteRows(orm(), AppSettings, { key: 'perm_day_edit' });
|
|
await invalidatePermissionsCache();
|
|
}
|
|
});
|
|
});
|
|
|
|
// ─────────────────────────────────────────────────────────────────────────────
|
|
// Accommodations (ACCOM-001, ACCOM-002, ACCOM-003)
|
|
// ─────────────────────────────────────────────────────────────────────────────
|
|
|
|
describe('Accommodations', () => {
|
|
it('ACCOM-001 — POST /api/trips/:tripId/accommodations creates an accommodation', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Hotel Trip' });
|
|
const day1 = createDay(testDb, trip.id, { date: '2026-10-01' });
|
|
const day2 = createDay(testDb, trip.id, { date: '2026-10-03' });
|
|
const place = createPlace(testDb, trip.id, { name: 'Grand Hotel' });
|
|
|
|
const res = await request(app)
|
|
.post(`/api/trips/${trip.id}/accommodations`)
|
|
.set('Cookie', authCookie(user.id))
|
|
.send({
|
|
place_id: place.id,
|
|
start_day_id: day1.id,
|
|
end_day_id: day2.id,
|
|
check_in: '15:00',
|
|
check_out: '11:00',
|
|
confirmation: 'ABC123',
|
|
notes: 'Breakfast included',
|
|
});
|
|
|
|
expect(res.status).toBe(201);
|
|
expect(res.body.accommodation).toBeDefined();
|
|
expect(res.body.accommodation.place_id).toBe(place.id);
|
|
expect(res.body.accommodation.start_day_id).toBe(day1.id);
|
|
expect(res.body.accommodation.end_day_id).toBe(day2.id);
|
|
expect(res.body.accommodation.confirmation).toBe('ABC123');
|
|
});
|
|
|
|
it('ACCOM-001 — POST missing required fields returns 400', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Trip' });
|
|
|
|
const res = await request(app)
|
|
.post(`/api/trips/${trip.id}/accommodations`)
|
|
.set('Cookie', authCookie(user.id))
|
|
.send({ notes: 'no ids' });
|
|
|
|
expect(res.status).toBe(400);
|
|
expect(res.body.error).toMatch(/required/i);
|
|
});
|
|
|
|
it('ACCOM-001 — POST with invalid place_id returns 404', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Trip' });
|
|
const day = createDay(testDb, trip.id);
|
|
|
|
const res = await request(app)
|
|
.post(`/api/trips/${trip.id}/accommodations`)
|
|
.set('Cookie', authCookie(user.id))
|
|
.send({ place_id: 999999, start_day_id: day.id, end_day_id: day.id });
|
|
|
|
expect(res.status).toBe(404);
|
|
});
|
|
|
|
it('ACCOM-002 — GET /api/trips/:tripId/accommodations returns accommodations for the trip', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Hotel Trip' });
|
|
const day1 = createDay(testDb, trip.id, { date: '2026-11-01' });
|
|
const day2 = createDay(testDb, trip.id, { date: '2026-11-03' });
|
|
const place = createPlace(testDb, trip.id, { name: 'Boutique Inn' });
|
|
|
|
// Seed accommodation directly
|
|
await insertRow(orm(), DayAccommodations, { trip: trip.id, place: place.id, startDay: day1.id, endDay: day2.id });
|
|
|
|
const res = await request(app)
|
|
.get(`/api/trips/${trip.id}/accommodations`)
|
|
.set('Cookie', authCookie(user.id));
|
|
|
|
expect(res.status).toBe(200);
|
|
expect(res.body.accommodations).toBeDefined();
|
|
expect(Array.isArray(res.body.accommodations)).toBe(true);
|
|
expect(res.body.accommodations).toHaveLength(1);
|
|
expect(res.body.accommodations[0].place_name).toBe('Boutique Inn');
|
|
});
|
|
|
|
it('ACCOM-002 — Non-member cannot get accommodations (404)', async () => {
|
|
const { user: owner } = createUser(testDb);
|
|
const { user: stranger } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id, { title: 'Private Trip' });
|
|
|
|
const res = await request(app)
|
|
.get(`/api/trips/${trip.id}/accommodations`)
|
|
.set('Cookie', authCookie(stranger.id));
|
|
|
|
expect(res.status).toBe(404);
|
|
});
|
|
|
|
it('ACCOM-003 — DELETE /api/trips/:tripId/accommodations/:id removes accommodation', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Hotel Trip' });
|
|
const day1 = createDay(testDb, trip.id, { date: '2026-12-01' });
|
|
const day2 = createDay(testDb, trip.id, { date: '2026-12-03' });
|
|
const place = createPlace(testDb, trip.id, { name: 'Budget Hostel' });
|
|
|
|
const createRes = await request(app)
|
|
.post(`/api/trips/${trip.id}/accommodations`)
|
|
.set('Cookie', authCookie(user.id))
|
|
.send({ place_id: place.id, start_day_id: day1.id, end_day_id: day2.id });
|
|
|
|
expect(createRes.status).toBe(201);
|
|
const accommodationId = createRes.body.accommodation.id;
|
|
|
|
const deleteRes = await request(app)
|
|
.delete(`/api/trips/${trip.id}/accommodations/${accommodationId}`)
|
|
.set('Cookie', authCookie(user.id));
|
|
|
|
expect(deleteRes.status).toBe(200);
|
|
expect(deleteRes.body.success).toBe(true);
|
|
|
|
// Verify removed from DB
|
|
expect(await findRow(orm(), DayAccommodations, { id: accommodationId })).toBeNull();
|
|
});
|
|
|
|
it('ACCOM-003 — DELETE non-existent accommodation returns 404', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Trip' });
|
|
|
|
const res = await request(app)
|
|
.delete(`/api/trips/${trip.id}/accommodations/999999`)
|
|
.set('Cookie', authCookie(user.id));
|
|
|
|
expect(res.status).toBe(404);
|
|
expect(res.body.error).toMatch(/not found/i);
|
|
});
|
|
|
|
it('ACCOM-001 — Creating accommodation also creates a linked reservation', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Hotel Trip' });
|
|
const day1 = createDay(testDb, trip.id, { date: '2026-10-10' });
|
|
const day2 = createDay(testDb, trip.id, { date: '2026-10-12' });
|
|
const place = createPlace(testDb, trip.id, { name: 'Luxury Resort' });
|
|
|
|
const res = await request(app)
|
|
.post(`/api/trips/${trip.id}/accommodations`)
|
|
.set('Cookie', authCookie(user.id))
|
|
.send({ place_id: place.id, start_day_id: day1.id, end_day_id: day2.id, confirmation: 'CONF-XYZ' });
|
|
|
|
expect(res.status).toBe(201);
|
|
|
|
// Linked reservation should exist
|
|
const reservation = await findRow(orm(), Reservations, { accommodation_id: legacyBoundIntegerText(res.body.accommodation.id) });
|
|
expect(reservation).not.toBeNull();
|
|
expect(reservation!.type).toBe('hotel');
|
|
expect(reservation!.confirmation_number).toBe('CONF-XYZ');
|
|
});
|
|
|
|
it('ACCOM-004 — PUT /api/trips/:tripId/accommodations/:id updates the accommodation', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Hotel Trip' });
|
|
const day1 = createDay(testDb, trip.id, { date: '2026-10-20' });
|
|
const day2 = createDay(testDb, trip.id, { date: '2026-10-22' });
|
|
const day3 = createDay(testDb, trip.id, { date: '2026-10-25' });
|
|
const place = createPlace(testDb, trip.id, { name: 'City Inn' });
|
|
|
|
const createRes = await request(app)
|
|
.post(`/api/trips/${trip.id}/accommodations`)
|
|
.set('Cookie', authCookie(user.id))
|
|
.send({ place_id: place.id, start_day_id: day1.id, end_day_id: day2.id, notes: 'Original' });
|
|
|
|
expect(createRes.status).toBe(201);
|
|
const accommodationId = createRes.body.accommodation.id;
|
|
|
|
const updateRes = await request(app)
|
|
.put(`/api/trips/${trip.id}/accommodations/${accommodationId}`)
|
|
.set('Cookie', authCookie(user.id))
|
|
.send({ place_id: place.id, start_day_id: day1.id, end_day_id: day3.id, notes: 'Extended stay' });
|
|
|
|
expect(updateRes.status).toBe(200);
|
|
expect(updateRes.body.accommodation).toBeDefined();
|
|
expect(updateRes.body.accommodation.end_day_id).toBe(day3.id);
|
|
expect(updateRes.body.accommodation.notes).toBe('Extended stay');
|
|
});
|
|
|
|
it('ACCOM-004 — PUT non-existent accommodation returns 404', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Trip' });
|
|
|
|
const res = await request(app)
|
|
.put(`/api/trips/${trip.id}/accommodations/999999`)
|
|
.set('Cookie', authCookie(user.id))
|
|
.send({ notes: 'Ghost update' });
|
|
|
|
expect(res.status).toBe(404);
|
|
expect(res.body.error).toMatch(/not found/i);
|
|
});
|
|
|
|
it('ACCOM-003 — Deleting accommodation also removes the linked reservation', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Hotel Trip' });
|
|
const day1 = createDay(testDb, trip.id, { date: '2026-10-15' });
|
|
const day2 = createDay(testDb, trip.id, { date: '2026-10-17' });
|
|
const place = createPlace(testDb, trip.id, { name: 'Mountain Lodge' });
|
|
|
|
const createRes = await request(app)
|
|
.post(`/api/trips/${trip.id}/accommodations`)
|
|
.set('Cookie', authCookie(user.id))
|
|
.send({ place_id: place.id, start_day_id: day1.id, end_day_id: day2.id });
|
|
|
|
const accommodationId = createRes.body.accommodation.id;
|
|
const reservationBefore = await findRow(orm(), Reservations, { accommodation_id: legacyBoundIntegerText(accommodationId) });
|
|
expect(reservationBefore).not.toBeNull();
|
|
|
|
const deleteRes = await request(app)
|
|
.delete(`/api/trips/${trip.id}/accommodations/${accommodationId}`)
|
|
.set('Cookie', authCookie(user.id));
|
|
expect(deleteRes.status).toBe(200);
|
|
|
|
expect(await findRow(orm(), Reservations, { id: reservationBefore!.id })).toBeNull();
|
|
});
|
|
|
|
it('ACCOM-006 — DELETE accommodation also removes its linked budget item (issue #933)', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Hotel Budget Trip' });
|
|
const day1 = createDay(testDb, trip.id, { date: '2026-11-01' });
|
|
const day2 = createDay(testDb, trip.id, { date: '2026-11-03' });
|
|
const place = createPlace(testDb, trip.id, { name: 'Grand Hotel' });
|
|
|
|
// Create a hotel reservation that creates an accommodation and a linked budget item
|
|
const createRes = await request(app)
|
|
.post(`/api/trips/${trip.id}/reservations`)
|
|
.set('Cookie', authCookie(user.id))
|
|
.send({
|
|
title: 'Grand Hotel Stay',
|
|
type: 'hotel',
|
|
day_id: day1.id,
|
|
create_accommodation: { place_id: place.id, start_day_id: day1.id, end_day_id: day2.id },
|
|
create_budget_entry: { total_price: 450, category: 'Accommodation' },
|
|
});
|
|
expect(createRes.status).toBe(201);
|
|
|
|
const accommodationId = await findRow(orm(), DayAccommodations, { trip: trip.id });
|
|
expect(accommodationId).not.toBeNull();
|
|
|
|
const budgetBefore = await findRow(orm(), BudgetItems, { trip: trip.id });
|
|
expect(budgetBefore).not.toBeNull();
|
|
|
|
// Delete via the accommodation endpoint (the primary bug path)
|
|
const delRes = await request(app)
|
|
.delete(`/api/trips/${trip.id}/accommodations/${accommodationId!.id}`)
|
|
.set('Cookie', authCookie(user.id));
|
|
expect(delRes.status).toBe(200);
|
|
|
|
expect(await findRow(orm(), BudgetItems, { trip: trip.id })).toBeNull();
|
|
});
|
|
});
|
|
|
|
// ─────────────────────────────────────────────────────────────────────────────
|
|
// Plan 3c Task 9 fix wave — A-H2 (live regression): `DaysService` was
|
|
// converted with a bare `Number(tripId)` at every entry point while
|
|
// `restampReservationDates`/`assertNoInvertedAccommodation` (Plan 3d
|
|
// survivors) kept binding the RAW route string — an affinity seam a
|
|
// hex-spelled trip id never matches. `TripAccessGuard` authorises a
|
|
// hex-spelled id whose `Number()` value is a real trip (`Number('0x12')`
|
|
// is `18`), so one `PUT .../days/reorder` request could renumber that real
|
|
// trip's days (the `Number()` half) while its own inverted-accommodation
|
|
// guard silently matched zero rows (the raw-string half) — writing a stay
|
|
// whose end precedes its start with no error. Every entry point now parses
|
|
// ONCE with `toRowId` and threads that value into every survivor; a
|
|
// `toRowId` miss answers a legacy-shaped not-found instead of letting the
|
|
// guard's wider `Number()` grant reach a downstream raw bind that disagrees
|
|
// with it.
|
|
// ─────────────────────────────────────────────────────────────────────────────
|
|
|
|
describe('A-H2 — DaysService trip id parsed once, threaded to every survivor (Task 9 fix wave)', () => {
|
|
it('GET /days by the hex-spelled trip id answers the legacy-shaped miss ({ days: [] }), not the real trip\'s days', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Trip', start_date: '2026-09-01', end_date: '2026-09-03' });
|
|
const hexTripId = '0x' + trip.id.toString(16);
|
|
|
|
const res = await request(app)
|
|
.get(`/api/trips/${hexTripId}/days`)
|
|
.set('Cookie', authCookie(user.id));
|
|
expect(res.status).toBe(200);
|
|
expect(res.body).toEqual({ days: [] });
|
|
});
|
|
|
|
it('PUT /days/:id by the hex-spelled trip id 404s "Day not found" (getDay\'s own toRowId gate), not the real trip\'s day', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Trip' });
|
|
const day = createDay(testDb, trip.id, { title: 'Original' });
|
|
const hexTripId = '0x' + trip.id.toString(16);
|
|
|
|
const res = await request(app)
|
|
.put(`/api/trips/${hexTripId}/days/${day.id}`)
|
|
.set('Cookie', authCookie(user.id))
|
|
.send({ title: 'Renamed' });
|
|
expect(res.status).toBe(404);
|
|
expect(res.body).toEqual({ error: 'Day not found' });
|
|
const row = await findRow(orm(), Days, { id: day.id });
|
|
expect(row?.title).toBe('Original');
|
|
});
|
|
|
|
it('POST /days by the hex-spelled trip id (append, no position) answers the guard\'s own 404 "Trip not found" and writes no day (M-1 narrowing, Task 9 fix round 2 — was a manufactured 500)', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Trip' });
|
|
const hexTripId = '0x' + trip.id.toString(16);
|
|
const before = await dayCount(trip.id);
|
|
|
|
const res = await request(app)
|
|
.post(`/api/trips/${hexTripId}/days`)
|
|
.set('Cookie', authCookie(user.id))
|
|
.send({});
|
|
expect(res.status).toBe(404);
|
|
expect(res.body).toEqual({ error: 'Trip not found' });
|
|
const after = await dayCount(trip.id);
|
|
expect(after).toBe(before);
|
|
});
|
|
|
|
it('POST /days {position} (insert) by the hex-spelled trip id answers the guard\'s own 404 "Trip not found" and writes no day (M-1 narrowing, Task 9 fix round 2 — was a manufactured 500)', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Trip', start_date: '2026-09-01', end_date: '2026-09-02' });
|
|
const hexTripId = '0x' + trip.id.toString(16);
|
|
const before = await dayCount(trip.id);
|
|
|
|
const res = await request(app)
|
|
.post(`/api/trips/${hexTripId}/days`)
|
|
.set('Cookie', authCookie(user.id))
|
|
.send({ position: 1 });
|
|
expect(res.status).toBe(404);
|
|
expect(res.body).toEqual({ error: 'Trip not found' });
|
|
const after = await dayCount(trip.id);
|
|
expect(after).toBe(before);
|
|
});
|
|
|
|
it('POST /days (append, no position) by trip id "N.0" answers 404 "Trip not found" and writes no day (M-1 narrowing, Task 9 fix round 2)', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Trip' });
|
|
const shapedTripId = `${trip.id}.0`;
|
|
const before = await dayCount(trip.id);
|
|
|
|
const res = await request(app)
|
|
.post(`/api/trips/${shapedTripId}/days`)
|
|
.set('Cookie', authCookie(user.id))
|
|
.send({});
|
|
expect(res.status).toBe(404);
|
|
expect(res.body).toEqual({ error: 'Trip not found' });
|
|
const after = await dayCount(trip.id);
|
|
expect(after).toBe(before);
|
|
});
|
|
|
|
it('POST /days {position} (insert) by trip id "N.0" answers 404 "Trip not found" and writes no day (M-1 narrowing, Task 9 fix round 2)', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Trip', start_date: '2026-09-01', end_date: '2026-09-02' });
|
|
const shapedTripId = `${trip.id}.0`;
|
|
const before = await dayCount(trip.id);
|
|
|
|
const res = await request(app)
|
|
.post(`/api/trips/${shapedTripId}/days`)
|
|
.set('Cookie', authCookie(user.id))
|
|
.send({ position: 1 });
|
|
expect(res.status).toBe(404);
|
|
expect(res.body).toEqual({ error: 'Trip not found' });
|
|
const after = await dayCount(trip.id);
|
|
expect(after).toBe(before);
|
|
});
|
|
|
|
it('POST /days (append, no position) by trip id "N%20" (trailing space) answers 404 "Trip not found" and writes no day (M-1 narrowing, Task 9 fix round 2)', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Trip' });
|
|
const shapedTripId = `${trip.id}%20`;
|
|
const before = await dayCount(trip.id);
|
|
|
|
const res = await request(app)
|
|
.post(`/api/trips/${shapedTripId}/days`)
|
|
.set('Cookie', authCookie(user.id))
|
|
.send({});
|
|
expect(res.status).toBe(404);
|
|
expect(res.body).toEqual({ error: 'Trip not found' });
|
|
const after = await dayCount(trip.id);
|
|
expect(after).toBe(before);
|
|
});
|
|
|
|
it('POST /days {position} (insert) by trip id "N%20" (trailing space) answers 404 "Trip not found" and writes no day (M-1 narrowing, Task 9 fix round 2)', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Trip', start_date: '2026-09-01', end_date: '2026-09-02' });
|
|
const shapedTripId = `${trip.id}%20`;
|
|
const before = await dayCount(trip.id);
|
|
|
|
const res = await request(app)
|
|
.post(`/api/trips/${shapedTripId}/days`)
|
|
.set('Cookie', authCookie(user.id))
|
|
.send({ position: 1 });
|
|
expect(res.status).toBe(404);
|
|
expect(res.body).toEqual({ error: 'Trip not found' });
|
|
const after = await dayCount(trip.id);
|
|
expect(after).toBe(before);
|
|
});
|
|
|
|
it('POST /days (append, no position) by trip id "%2BN" (leading plus) answers 404 "Trip not found" and writes no day (M-1 narrowing, Task 9 fix round 2)', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Trip' });
|
|
const shapedTripId = `%2B${trip.id}`;
|
|
const before = await dayCount(trip.id);
|
|
|
|
const res = await request(app)
|
|
.post(`/api/trips/${shapedTripId}/days`)
|
|
.set('Cookie', authCookie(user.id))
|
|
.send({});
|
|
expect(res.status).toBe(404);
|
|
expect(res.body).toEqual({ error: 'Trip not found' });
|
|
const after = await dayCount(trip.id);
|
|
expect(after).toBe(before);
|
|
});
|
|
|
|
it('POST /days {position} (insert) by trip id "%2BN" (leading plus) answers 404 "Trip not found" and writes no day (M-1 narrowing, Task 9 fix round 2)', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Trip', start_date: '2026-09-01', end_date: '2026-09-02' });
|
|
const shapedTripId = `%2B${trip.id}`;
|
|
const before = await dayCount(trip.id);
|
|
|
|
const res = await request(app)
|
|
.post(`/api/trips/${shapedTripId}/days`)
|
|
.set('Cookie', authCookie(user.id))
|
|
.send({ position: 1 });
|
|
expect(res.status).toBe(404);
|
|
expect(res.body).toEqual({ error: 'Trip not found' });
|
|
const after = await dayCount(trip.id);
|
|
expect(after).toBe(before);
|
|
});
|
|
|
|
it('POST /days (append, no position) by trip id "Ne0" (exponent form) answers 404 "Trip not found" and writes no day (M-1 narrowing, Task 9 fix round 2)', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Trip' });
|
|
const shapedTripId = `${trip.id}e0`;
|
|
const before = await dayCount(trip.id);
|
|
|
|
const res = await request(app)
|
|
.post(`/api/trips/${shapedTripId}/days`)
|
|
.set('Cookie', authCookie(user.id))
|
|
.send({});
|
|
expect(res.status).toBe(404);
|
|
expect(res.body).toEqual({ error: 'Trip not found' });
|
|
const after = await dayCount(trip.id);
|
|
expect(after).toBe(before);
|
|
});
|
|
|
|
it('POST /days {position} (insert) by trip id "Ne0" (exponent form) answers 404 "Trip not found" and writes no day (M-1 narrowing, Task 9 fix round 2)', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Trip', start_date: '2026-09-01', end_date: '2026-09-02' });
|
|
const shapedTripId = `${trip.id}e0`;
|
|
const before = await dayCount(trip.id);
|
|
|
|
const res = await request(app)
|
|
.post(`/api/trips/${shapedTripId}/days`)
|
|
.set('Cookie', authCookie(user.id))
|
|
.send({ position: 1 });
|
|
expect(res.status).toBe(404);
|
|
expect(res.body).toEqual({ error: 'Trip not found' });
|
|
const after = await dayCount(trip.id);
|
|
expect(after).toBe(before);
|
|
});
|
|
|
|
it('PUT /days/reorder by the hex-spelled trip id 400s "orderedIds must be a permutation…" and writes NOTHING — the live H2 bug: it used to 200 and invert a real accommodation', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Trip', start_date: '2026-06-01', end_date: '2026-06-03' });
|
|
const days = await dayList(trip.id);
|
|
expect(days).toHaveLength(3);
|
|
const [d1, d2, d3] = days;
|
|
const place = createPlace(testDb, trip.id, { name: 'Hotel' });
|
|
// A valid (non-inverted) stay d1 -> d2, and a reservation on d1 — exactly
|
|
// the shape the compiled-boot evidence used to catch reorder inverting.
|
|
const stay = createDayAccommodation(testDb, trip.id, place.id, d1.id, d2.id);
|
|
const reservation = createReservation(testDb, trip.id, { day_id: d1.id, title: 'Dinner' });
|
|
await updateRows(orm(), Reservations, { id: reservation.id }, { reservation_time: '2026-06-01T19:00:00' });
|
|
const hexTripId = '0x' + trip.id.toString(16);
|
|
|
|
const res = await request(app)
|
|
.put(`/api/trips/${hexTripId}/days/reorder`)
|
|
.set('Cookie', authCookie(user.id))
|
|
.send({ orderedIds: [d2.id, d1.id, d3.id] });
|
|
expect(res.status).toBe(400);
|
|
expect(res.body).toEqual({ error: 'orderedIds must be a permutation of the trip day ids.' });
|
|
|
|
// Nothing renumbered.
|
|
const after = await dayList(trip.id);
|
|
expect(after).toEqual(days);
|
|
// The stay is still d1 -> d2, never inverted.
|
|
const stayAfter = await stayDays(stay.id);
|
|
expect(stayAfter).toEqual({ start_day_id: d1.id, end_day_id: d2.id });
|
|
// The reservation's stamped time is untouched.
|
|
const resAfter = await findRow(orm(), Reservations, { id: reservation.id });
|
|
expect(resAfter?.reservation_time).toBe('2026-06-01T19:00:00');
|
|
});
|
|
|
|
it('PUT /days/reorder with the REAL numeric trip id still works and can still be legitimately rejected for inverting a stay (unchanged, base 400) — L-5: zero days rows changed, not only the stay', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Trip', start_date: '2026-06-01', end_date: '2026-06-03' });
|
|
const days = await dayList(trip.id);
|
|
const [d1, d2, d3] = days;
|
|
const place = createPlace(testDb, trip.id, { name: 'Hotel' });
|
|
const stay = createDayAccommodation(testDb, trip.id, place.id, d1.id, d3.id);
|
|
|
|
const res = await request(app)
|
|
.put(`/api/trips/${trip.id}/days/reorder`)
|
|
.set('Cookie', authCookie(user.id))
|
|
.send({ orderedIds: [d3.id, d2.id, d1.id] });
|
|
expect(res.status).toBe(400);
|
|
expect(res.body).toEqual({ error: 'This move would make an accommodation end before it starts.' });
|
|
const stayAfter = await stayDays(stay.id);
|
|
expect(stayAfter).toEqual({ start_day_id: d1.id, end_day_id: d3.id });
|
|
// L-5: the rollback holds on every day row, not only the stay — zero rows changed.
|
|
const daysAfter = await dayList(trip.id);
|
|
expect(daysAfter).toEqual(days);
|
|
});
|
|
});
|