smb-online/backoffice/app/tests/test_provisioning.py

"""Flask test client / real-DB integration tests for the onboarding
provisioning endpoints (#24): POST /api/resources, /api/services, and
/api/owner_users, used by n8n/onboarding.json in place of the retired EA
provider-account chain.
"""
import pytest

import app as app_module
import booking_db as bdb
from app import app as flask_app

CLIENT_A = "C-TEST-PROV-A"
CLIENT_B = "C-TEST-PROV-B"
AUTH = {"X-CRM-Token": "test-crm-token"}


@pytest.fixture
def client(monkeypatch):
    flask_app.config["TESTING"] = True
    monkeypatch.setattr(app_module, "CRM_TOKEN", "test-crm-token")
    return flask_app.test_client()


def _insert_client(client_id):
    with bdb.db.connect() as conn, conn.cursor() as cur:
        cur.execute(
            "INSERT INTO clients (client_id, business_name) VALUES (%s, %s) "
            "ON CONFLICT (client_id) DO NOTHING",
            (client_id, "Café " + client_id))
        conn.commit()


# ---- /api/clients slug (generic entity POST, #24) ----

def test_create_client_persists_slug(client):
    resp = client.post("/api/clients", headers=AUTH, json={
        "business_name": "Slug Test Client", "slug": "slug-test-abcd"})
    assert resp.status_code == 201
    client_id = resp.get_json()["added"]
    assert bdb.get_client_by_slug("slug-test-abcd")["client_id"] == client_id


# ---- /api/locations ----

def test_create_location_requires_crm_token(client):
    resp = client.post("/api/locations", json={"client_id": CLIENT_A, "name": "Hauptfiliale"})
    assert resp.status_code == 403


def test_create_location_creates_row(client):
    _insert_client(CLIENT_A)
    resp = client.post("/api/locations", headers=AUTH,
                        json={"client_id": CLIENT_A, "name": "Hauptfiliale"})
    assert resp.status_code == 201
    location_id = resp.get_json()["location_id"]
    assert bdb.get_location(CLIENT_A, location_id)["name"] == "Hauptfiliale"


def test_create_location_requires_name(client):
    _insert_client(CLIENT_A)
    resp = client.post("/api/locations", headers=AUTH, json={"client_id": CLIENT_A})
    assert resp.status_code == 400


# ---- /api/resources ----

def test_create_resource_requires_crm_token(client):
    resp = client.post("/api/resources", json={"client_id": CLIENT_A, "name": "Hauptressource"})
    assert resp.status_code == 403


def test_create_resource_sets_hours(client):
    _insert_client(CLIENT_A)
    location = bdb.create_location(CLIENT_A, "Hauptfiliale")
    resp = client.post("/api/resources", headers=AUTH, json={
        "client_id": CLIENT_A, "location_id": location["location_id"], "name": "Hauptressource",
        "hours": [{"weekday": 0, "opens_at": "09:00", "closes_at": "18:00"}]})
    assert resp.status_code == 201
    resource_id = resp.get_json()["resource_id"]
    hours = bdb.get_resource_hours(CLIENT_A, resource_id)
    assert 0 in hours


def test_create_resource_requires_name(client):
    _insert_client(CLIENT_A)
    location = bdb.create_location(CLIENT_A, "Hauptfiliale")
    resp = client.post("/api/resources", headers=AUTH,
                        json={"client_id": CLIENT_A, "location_id": location["location_id"]})
    assert resp.status_code == 400


def test_create_resource_requires_location_id(client):
    _insert_client(CLIENT_A)
    resp = client.post("/api/resources", headers=AUTH,
                        json={"client_id": CLIENT_A, "name": "Hauptressource"})
    assert resp.status_code == 400


def test_create_resource_rejects_unknown_location(client):
    _insert_client(CLIENT_A)
    resp = client.post("/api/resources", headers=AUTH, json={
        "client_id": CLIENT_A, "location_id": "LOC-does-not-exist", "name": "Hauptressource"})
    assert resp.status_code == 404


# ---- /api/services ----

def test_create_service_requires_crm_token(client):
    resp = client.post("/api/services", json={
        "client_id": CLIENT_A, "name": "Termin", "duration_minutes": 30})
    assert resp.status_code == 403


def test_create_service_creates_active_service(client):
    _insert_client(CLIENT_A)
    resp = client.post("/api/services", headers=AUTH, json={
        "client_id": CLIENT_A, "name": "Termin", "duration_minutes": 30})
    assert resp.status_code == 201
    service_id = resp.get_json()["service_id"]
    row = bdb.get_service(CLIENT_A, service_id)
    assert row["active"] is True
    assert row["duration_minutes"] == 30


def test_create_service_requires_duration(client):
    _insert_client(CLIENT_A)
    resp = client.post("/api/services", headers=AUTH,
                        json={"client_id": CLIENT_A, "name": "Termin"})
    assert resp.status_code == 400


# ---- /api/owner_users ----

def test_create_owner_user_requires_crm_token(client):
    resp = client.post("/api/owner_users", json={
        "client_id": CLIENT_A, "email": "owner@example.com", "password": "pw12345"})
    assert resp.status_code == 403


def test_create_owner_user_creates_login(client):
    _insert_client(CLIENT_A)
    resp = client.post("/api/owner_users", headers=AUTH, json={
        "client_id": CLIENT_A, "email": "owner@example.com", "password": "pw12345"})
    assert resp.status_code == 201
    user = bdb.find_user_by_email("owner@example.com")
    assert user["client_id"] == CLIENT_A
    assert bdb.verify_password(user, "pw12345")


def test_create_owner_user_rejects_duplicate_email(client):
    _insert_client(CLIENT_A)
    _insert_client(CLIENT_B)
    bdb.create_user(CLIENT_A, "owner@example.com", "pw12345")
    resp = client.post("/api/owner_users", headers=AUTH, json={
        "client_id": CLIENT_B, "email": "owner@example.com", "password": "pw67890"})
    assert resp.status_code == 409


def test_create_owner_user_requires_password(client):
    _insert_client(CLIENT_A)
    resp = client.post("/api/owner_users", headers=AUTH,
                        json={"client_id": CLIENT_A, "email": "owner@example.com"})
    assert resp.status_code == 400