0pt/tests/api/document-actor-identity.test.ts

import { afterEach, describe, expect, it, vi } from 'vitest';
import { NextRequest } from 'next/server';
import { POST as capture } from '@/app/api/0pt/documents/capture/route';
import { POST as extract } from '@/app/api/0pt/documents/[documentId]/extraction/route';
import { documentCaptureService } from '@/src/services/document-capture-service';
import { documentExtractionService } from '@/src/services/document-extraction-service';

function request(body: object) {
  return new NextRequest('http://localhost/api/0pt/documents', { method: 'POST',
    headers: { 'content-type': 'application/json', 'x-0pt-verified-tenant': 'tenant-a', 'x-0pt-verified-sub': 'user-a' },
    body: JSON.stringify(body) });
}
const base = { tenant_id: 'tenant-a', project_id: 'project-a', model_id: 'model-test' };
const mailbox = { tenant_id: 'directory', client_id: 'test', client_secret: 'test', mailbox_address: 'test@example.test' };
describe('document route verified actor', () => {
  afterEach(() => vi.restoreAllMocks());
  it('rejects forged body actors before either service is called', async () => {
    const captured = vi.spyOn(documentCaptureService, 'captureFromMailbox');
    const extracted = vi.spyOn(documentExtractionService, 'extractDocument');
    expect((await capture(request({ ...base, mailbox, actor_id: 'victim' }))).status).toBe(403);
    expect((await extract(request({ ...base, actor_id: 'victim' }), { params: Promise.resolve({ documentId: 'd' }) })).status).toBe(403);
    expect(captured).not.toHaveBeenCalled();
    expect(extracted).not.toHaveBeenCalled();
  });
  it('fills the actor from the verified subject when the body omits it', async () => {
    const captured = vi.spyOn(documentCaptureService, 'captureFromMailbox').mockResolvedValue({} as never);
    const extracted = vi.spyOn(documentExtractionService, 'extractDocument').mockResolvedValue({} as never);
    expect((await capture(request({ ...base, mailbox }))).status).toBe(201);
    expect((await extract(request(base), { params: Promise.resolve({ documentId: 'd' }) })).status).toBe(201);
    expect(captured.mock.calls[0]?.[1].actor_id).toBe('user-a');
    expect(extracted.mock.calls[0]?.[1].actor_id).toBe('user-a');
  });
});