feat: harden bootstrap and add tests

tests/auth.test.ts

@@ -0,0 +1,52 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { authenticateUser, createUser, hashPassword, verifyPassword } from '@/lib/auth';
+
+const { query } = vi.hoisted(() => ({ query: vi.fn() }));
+
+vi.mock('@/lib/db', () => ({
+  db: {
+    query,
+  },
+}));
+
+describe('auth helpers', () => {
+  beforeEach(() => {
+    query.mockReset();
+  });
+
+  it('hashes passwords before storing a user', async () => {
+    query.mockResolvedValueOnce({ rows: [{ id: 1, username: 'alice', role: 'user' }] });
+
+    const user = await createUser('alice', 's3cret', 'user');
+
+    expect(user).toEqual({ id: 1, username: 'alice', role: 'user' });
+    expect(query).toHaveBeenCalledTimes(1);
+
+    const [, params] = query.mock.calls[0];
+    expect(params[0]).toBe('alice');
+    expect(params[1]).not.toBe('s3cret');
+    expect(await verifyPassword('s3cret', params[1] as string)).toBe(true);
+  });
+
+  it('authenticates a user with the stored password hash', async () => {
+    const passwordHash = await hashPassword('secret-password');
+    query.mockResolvedValueOnce({
+      rows: [{ id: 2, username: 'bob', password_hash: passwordHash, role: 'admin' }],
+    });
+
+    await expect(authenticateUser('bob', 'secret-password')).resolves.toEqual({
+      id: 2,
+      username: 'bob',
+      role: 'admin',
+    });
+  });
+
+  it('rejects an invalid password', async () => {
+    const passwordHash = await hashPassword('secret-password');
+    query.mockResolvedValueOnce({
+      rows: [{ id: 2, username: 'bob', password_hash: passwordHash, role: 'admin' }],
+    });
+
+    await expect(authenticateUser('bob', 'wrong-password')).resolves.toBeNull();
+  });
+});

tests/db-init-route.test.ts

@@ -0,0 +1,55 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { POST } from '@/app/api/db/init/route';
+
+const { initSchema, seed, resetDatabase, migrateFromLegacyPlaces } = vi.hoisted(() => ({
+  initSchema: vi.fn(),
+  seed: vi.fn(),
+  resetDatabase: vi.fn(),
+  migrateFromLegacyPlaces: vi.fn(),
+}));
+
+vi.mock('@/lib/schema', () => ({
+  initSchema,
+  seed,
+  resetDatabase,
+  migrateFromLegacyPlaces,
+}));
+
+describe('/api/db/init', () => {
+  beforeEach(() => {
+    initSchema.mockReset();
+    seed.mockReset();
+    resetDatabase.mockReset();
+    migrateFromLegacyPlaces.mockReset();
+  });
+
+  it('initializes schema and seed data', async () => {
+    initSchema.mockResolvedValueOnce(undefined);
+    migrateFromLegacyPlaces.mockResolvedValueOnce(undefined);
+    seed.mockResolvedValueOnce(undefined);
+
+    const response = await POST(new Request('http://localhost/api/db/init'));
+    const body = await response.json();
+
+    expect(response.status).toBe(200);
+    expect(body).toEqual({ ok: true });
+    expect(initSchema).toHaveBeenCalledTimes(1);
+    expect(migrateFromLegacyPlaces).toHaveBeenCalledTimes(1);
+    expect(seed).toHaveBeenCalledTimes(1);
+    expect(resetDatabase).not.toHaveBeenCalled();
+  });
+
+  it('uses the reset path when requested', async () => {
+    resetDatabase.mockResolvedValueOnce(undefined);
+
+    const response = await POST(new Request('http://localhost/api/db/init?reset=true'));
+    const body = await response.json();
+
+    expect(response.status).toBe(200);
+    expect(body).toEqual({ ok: true, reset: true });
+    expect(resetDatabase).toHaveBeenCalledTimes(1);
+    expect(initSchema).not.toHaveBeenCalled();
+    expect(seed).not.toHaveBeenCalled();
+    expect(migrateFromLegacyPlaces).not.toHaveBeenCalled();
+  });
+});

tests/health-route.test.ts

@@ -0,0 +1,14 @@
+import { describe, expect, it } from 'vitest';
+import { GET } from '@/app/api/health/route';
+
+describe('/api/health', () => {
+  it('returns a fast healthy response', async () => {
+    const response = await GET();
+    const body = await response.json();
+
+    expect(response.status).toBe(200);
+    expect(body.ok).toBe(true);
+    expect(body.status).toBe('healthy');
+    expect(response.headers.get('cache-control')).toContain('no-store');
+  });
+});

tests/language-switcher.test.tsx

@@ -0,0 +1,21 @@
+import { beforeEach, describe, expect, it } from 'vitest';
+import { fireEvent, render, screen } from '@testing-library/react';
+import LanguageSwitcher from '@/components/LanguageSwitcher';
+
+describe('LanguageSwitcher', () => {
+  beforeEach(() => {
+    localStorage.clear();
+  });
+
+  it('switches language without reloading the page', () => {
+    localStorage.setItem('language', 'en');
+
+    render(<LanguageSwitcher />);
+
+    const button = screen.getByRole('button', { name: 'Switch to Spanish' });
+    fireEvent.click(button);
+
+    expect(localStorage.getItem('language')).toBe('es');
+    expect(screen.getByRole('button', { name: 'Switch to English' })).toBeInTheDocument();
+  });
+});

tests/rooms-route.test.ts

@@ -0,0 +1,57 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { GET, POST } from '@/app/api/rooms/route';
+
+const { query, requireRole } = vi.hoisted(() => ({ query: vi.fn(), requireRole: vi.fn() }));
+
+vi.mock('@/lib/db', () => ({
+  db: {
+    query,
+  },
+}));
+
+vi.mock('@/lib/auth', () => ({
+  requireRole,
+}));
+
+describe('/api/rooms', () => {
+  beforeEach(() => {
+    query.mockReset();
+    requireRole.mockReset();
+  });
+
+  it('returns active rooms', async () => {
+    query.mockResolvedValueOnce({ rows: [{ id: 1, name: 'Suite', active: true }] });
+
+    const response = await GET();
+    const body = await response.json();
+
+    expect(response.status).toBe(200);
+    expect(body).toEqual({ data: [{ id: 1, name: 'Suite', active: true }] });
+  });
+
+  it('creates a room for admins', async () => {
+    requireRole.mockResolvedValueOnce({ id: 1, username: 'admin', role: 'admin' });
+    query.mockResolvedValueOnce({ rows: [{ id: 7, name: 'Garden Room', price: '120.00' }] });
+
+    const response = await POST(
+      new Request('http://localhost/api/rooms', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+          name: 'Garden Room',
+          description: 'Nice view',
+          price: '120.00',
+          photos: ['a.jpg'],
+          sort_order: 1,
+          featured_photo: 'a.jpg',
+        }),
+      }) as any
+    );
+
+    const body = await response.json();
+
+    expect(requireRole).toHaveBeenCalledWith('admin');
+    expect(response.status).toBe(200);
+    expect(body).toEqual({ data: { id: 7, name: 'Garden Room', price: '120.00' } });
+  });
+});