Files
la-huasca-ts/tests/rooms-route.test.ts
T
muken dc0c5fd289 feat: add security hardening for reservation APIs
- Add rate limiting (5/hr public, 100/min admin endpoints)
- Add honeypot bot protection on public POST
- Add audit logging for status changes and deletions
- Add input validation (email, phone, date, length limits)
- Fix missing auth on private event GET endpoints
- Add audit_log table to schema
- Fix failing tests (auth.test, rooms-route.test)
2026-07-02 20:56:36 -05:00

63 lines
1.8 KiB
TypeScript

import { beforeEach, describe, expect, it, vi } from 'vitest';
import { GET, POST } from '@/app/api/rooms/route';
const { query, requireRole } = vi.hoisted(() => ({ query: vi.fn(), requireRole: vi.fn() }));
vi.mock('@/lib/db', () => ({
db: {
query,
},
}));
vi.mock('@/lib/auth', () => ({
requireRole,
}));
describe('/api/rooms', () => {
beforeEach(() => {
query.mockReset();
requireRole.mockReset();
});
it('returns active rooms', async () => {
// Mock rooms query
query.mockResolvedValueOnce({ rows: [{ id: 1, name: 'Suite', active: true }] });
// Mock amenities query
query.mockResolvedValueOnce({ rows: [] });
// Mock images query
query.mockResolvedValueOnce({ rows: [] });
const response = await GET();
const body = await response.json();
expect(response.status).toBe(200);
expect(body).toEqual({ data: [{ id: 1, name: 'Suite', active: true, photos: [], amenities: [] }] });
});
it('creates a room for admins', async () => {
requireRole.mockResolvedValueOnce({ id: 1, username: 'admin', role: 'admin' });
query.mockResolvedValueOnce({ rows: [{ id: 7, name: 'Garden Room', price: '120.00' }] });
const response = await POST(
new Request('http://localhost/api/rooms', {
method: 'POST',
headers: { 'content-type': 'application/json' },
body: JSON.stringify({
name: 'Garden Room',
description: 'Nice view',
price: '120.00',
photos: ['a.jpg'],
sort_order: 1,
featured_photo: 'a.jpg',
}),
}) as any
);
const body = await response.json();
expect(requireRole).toHaveBeenCalledWith('admin');
expect(response.status).toBe(200);
expect(body).toEqual({ data: { id: 7, name: 'Garden Room', price: '120.00', photos: [], amenity_ids: [] } });
});
});