support_backend/tests/integration/product-integration-auth.test.ts

import { describe, it, expect, beforeAll, afterAll } from 'vitest';
import { buildApp } from '@/app';
import { prismaClient } from '@/infrastructure/database';
import { FastifyInstance } from 'fastify';
import {
  encryptCredential,
  generateCredentialSecret,
  issueIntegrationToken,
} from '@/modules/catalog/products';

/**
 * Covers specs/002-saas-integration/quickstart.md Scenarios 1, 2, 4 end-to-end against a real
 * Postgres/Redis (matching the vitest env DATABASE_URL/REDIS_* config — requires
 * docker-compose.test.yml's postgres/redis services to be reachable at that address; see
 * specs/002-saas-integration/checklists/requirements.md implementation notes for a known gap
 * in how the current test DATABASE_URL is wired to those services).
 */
describe('Product Integration Auth (full preHandler)', () => {
  let app: FastifyInstance;
  let secret: string;
  const externalProductId = `TEST_PROD_${Date.now()}`;

  beforeAll(async () => {
    app = await buildApp();

    const product = await prismaClient.product.create({
      data: { externalProductId, name: 'Integration Test Product', status: 'active' },
    });

    secret = generateCredentialSecret();
    await prismaClient.productIntegration.create({
      data: {
        productId: product.id,
        credentialRef: encryptCredential(secret),
        authMechanism: 'signed_token',
        allowedScope: { tenantIds: ['tenant-1'] },
        status: 'active',
      },
    });
  });

  afterAll(async () => {
    await prismaClient.productIntegration.deleteMany({
      where: { product: { externalProductId } },
    });
    await prismaClient.product.deleteMany({ where: { externalProductId } });
    await app.close();
  });

  it('Scenario 1: accepts a valid, in-scope request', async () => {
    const token = issueIntegrationToken(secret, {
      externalProductId,
      tenantId: 'tenant-1',
      userId: 'user-1',
    });

    const response = await app.inject({
      method: 'POST',
      url: '/v1/support/requests',
      headers: { authorization: `Bearer ${token}` },
      payload: {
        productId: externalProductId,
        tenantId: 'tenant-1',
        userId: 'user-1',
        source: 'test',
        problem: 'test problem',
      },
    });

    expect(response.statusCode).toBe(202);
    expect(response.json()).toMatchObject({ success: true });
  });

  it('Scenario 2: rejects an invalid credential and an unregistered product identically', async () => {
    const badToken = issueIntegrationToken('wrong-secret', {
      externalProductId,
      tenantId: 'tenant-1',
      userId: 'user-1',
    });

    const invalidCredentialResponse = await app.inject({
      method: 'POST',
      url: '/v1/support/requests',
      headers: { authorization: `Bearer ${badToken}` },
      payload: {
        productId: externalProductId,
        tenantId: 'tenant-1',
        userId: 'user-1',
        source: 'test',
        problem: 'x',
      },
    });

    const unregisteredResponse = await app.inject({
      method: 'POST',
      url: '/v1/support/requests',
      headers: { authorization: `Bearer ${badToken}` },
      payload: {
        productId: 'NEVER_REGISTERED',
        tenantId: 'tenant-1',
        userId: 'user-1',
        source: 'test',
        problem: 'x',
      },
    });

    expect(invalidCredentialResponse.statusCode).toBe(401);
    expect(unregisteredResponse.statusCode).toBe(401);
    // Same error shape for both — a caller cannot tell "wrong credential" apart from
    // "unregistered product" (FR-010). Compare everything except the per-request requestId.
    expect(invalidCredentialResponse.json().error).toEqual(unregisteredResponse.json().error);
    expect(invalidCredentialResponse.json().error.code).toBe('INVALID_INTEGRATION_CREDENTIAL');
  });

  it('Scenario 4: rejects a request with an unrecognized field', async () => {
    const token = issueIntegrationToken(secret, {
      externalProductId,
      tenantId: 'tenant-1',
      userId: 'user-1',
    });

    const response = await app.inject({
      method: 'POST',
      url: '/v1/support/requests',
      headers: { authorization: `Bearer ${token}` },
      payload: {
        productId: externalProductId,
        tenantId: 'tenant-1',
        userId: 'user-1',
        source: 'test',
        problem: 'x',
        somethingUnexpected: true,
      },
    });

    expect(response.statusCode).toBe(400);
    expect(response.json().error.code).toBe('VALIDATION_ERROR');
  });

  it('replay of the same token is rejected on the second use', async () => {
    const token = issueIntegrationToken(secret, {
      externalProductId,
      tenantId: 'tenant-1',
      userId: 'user-1',
    });
    const payload = {
      productId: externalProductId,
      tenantId: 'tenant-1',
      userId: 'user-1',
      source: 'test',
      problem: 'replay check',
    };

    const first = await app.inject({
      method: 'POST',
      url: '/v1/support/requests',
      headers: { authorization: `Bearer ${token}` },
      payload,
    });
    const second = await app.inject({
      method: 'POST',
      url: '/v1/support/requests',
      headers: { authorization: `Bearer ${token}` },
      payload,
    });

    expect(first.statusCode).toBe(202);
    expect(second.statusCode).toBe(401);
    expect(second.json().error.code).toBe('INVALID_INTEGRATION_CREDENTIAL');
  });
});