feat: harden bootstrap and add tests

tests/rooms-route.test.ts

@@ -0,0 +1,57 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { GET, POST } from '@/app/api/rooms/route';
+
+const { query, requireRole } = vi.hoisted(() => ({ query: vi.fn(), requireRole: vi.fn() }));
+
+vi.mock('@/lib/db', () => ({
+  db: {
+    query,
+  },
+}));
+
+vi.mock('@/lib/auth', () => ({
+  requireRole,
+}));
+
+describe('/api/rooms', () => {
+  beforeEach(() => {
+    query.mockReset();
+    requireRole.mockReset();
+  });
+
+  it('returns active rooms', async () => {
+    query.mockResolvedValueOnce({ rows: [{ id: 1, name: 'Suite', active: true }] });
+
+    const response = await GET();
+    const body = await response.json();
+
+    expect(response.status).toBe(200);
+    expect(body).toEqual({ data: [{ id: 1, name: 'Suite', active: true }] });
+  });
+
+  it('creates a room for admins', async () => {
+    requireRole.mockResolvedValueOnce({ id: 1, username: 'admin', role: 'admin' });
+    query.mockResolvedValueOnce({ rows: [{ id: 7, name: 'Garden Room', price: '120.00' }] });
+
+    const response = await POST(
+      new Request('http://localhost/api/rooms', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+          name: 'Garden Room',
+          description: 'Nice view',
+          price: '120.00',
+          photos: ['a.jpg'],
+          sort_order: 1,
+          featured_photo: 'a.jpg',
+        }),
+      }) as any
+    );
+
+    const body = await response.json();
+
+    expect(requireRole).toHaveBeenCalledWith('admin');
+    expect(response.status).toBe(200);
+    expect(body).toEqual({ data: { id: 7, name: 'Garden Room', price: '120.00' } });
+  });
+});