/** * Port-scoped global tenancies list - locks in feat(marina): the * `GET /api/v1/tenancies` endpoint that powers the * `[portSlug]/tenancies` page. The route is thin (parseQuery → * listTenancies); the test guarantees port scoping at the handler * boundary so a future refactor of the service can't accidentally leak * cross-port rows. */ import { describe, it, expect } from 'vitest'; import { listHandler } from '@/app/api/v1/tenancies/handlers'; import { createHandler as createTenancyHandler } from '@/app/api/v1/berths/[id]/tenancies/handlers'; import { enableTenanciesModule } from '@/lib/services/tenancies-module.service'; import { makeMockCtx, makeMockRequest } from '../../helpers/route-tester'; import { makeBerth, makeClient, makeFullPermissions, makePort, makeYacht, } from '../../helpers/factories'; async function makePortWithTenancies(): Promise>> { const port = await makePort(); await enableTenanciesModule(port.id); return port; } async function seedTenancy(portId: string) { const berth = await makeBerth({ portId }); const client = await makeClient({ portId }); const yacht = await makeYacht({ portId, ownerType: 'client', ownerId: client.id }); const ctx = makeMockCtx({ portId, permissions: makeFullPermissions() }); const res = await createTenancyHandler( makeMockRequest('POST', `http://localhost/api/v1/berths/${berth.id}/tenancies`, { body: { clientId: client.id, yachtId: yacht.id, startDate: new Date().toISOString(), }, }), ctx, { id: berth.id }, ); return ((await res.json()) as any).data as { id: string; berthId: string }; } describe('GET /api/v1/tenancies', () => { it('returns all tenancies for the requesting port', async () => { const port = await makePortWithTenancies(); const r1 = await seedTenancy(port.id); const r2 = await seedTenancy(port.id); const ctx = makeMockCtx({ portId: port.id, permissions: makeFullPermissions() }); const res = await listHandler(makeMockRequest('GET', 'http://localhost/api/v1/tenancies'), ctx); expect(res.status).toBe(200); const body = (await res.json()) as any; const ids = (body.data as Array<{ id: string }>).map((r) => r.id).sort(); expect(ids).toEqual([r1.id, r2.id].sort()); expect(body.pagination).toMatchObject({ page: 1, total: 2 }); }); it('does not leak tenancies from a different port', async () => { const portA = await makePortWithTenancies(); const portB = await makePortWithTenancies(); const tenancyInB = await seedTenancy(portB.id); // Caller is operating in portA; portB's tenancy must not appear. const ctx = makeMockCtx({ portId: portA.id, permissions: makeFullPermissions() }); const res = await listHandler(makeMockRequest('GET', 'http://localhost/api/v1/tenancies'), ctx); expect(res.status).toBe(200); const body = (await res.json()) as any; const ids = (body.data as Array<{ id: string }>).map((r) => r.id); expect(ids).not.toContain(tenancyInB.id); }); it('honors pagination via query params', async () => { const port = await makePortWithTenancies(); await seedTenancy(port.id); await seedTenancy(port.id); await seedTenancy(port.id); const ctx = makeMockCtx({ portId: port.id, permissions: makeFullPermissions() }); const res = await listHandler( makeMockRequest('GET', 'http://localhost/api/v1/tenancies?page=1&limit=2'), ctx, ); expect(res.status).toBe(200); const body = (await res.json()) as any; expect(body.data).toHaveLength(2); expect(body.pagination).toMatchObject({ page: 1, pageSize: 2, total: 3, totalPages: 2, hasNextPage: true, hasPreviousPage: false, }); }); });