0pt/tests/api/orders-idempotency.test.ts

/**
 * P014: HTTP-level proof that POST /api/orders honors the `Idempotency-Key`
 * header end to end (route -> lib/orders-store.ts), matching the pattern
 * used elsewhere in this suite (tests/api/anonymous-routes-auth.test.ts) of
 * calling the route handler directly with a hand-built NextRequest.
 */
import { describe, it, expect, vi } from "vitest";
import { NextRequest } from "next/server";
vi.mock("@/src/auth/require-order-owner", () => ({
  requireOrderOwner: vi.fn().mockResolvedValue({ owner: { tenantId: "tenant-test", subject: "buyer-test" } }),
}));
import { POST as ordersPOST } from "@/app/api/orders/route";

function postReq(body: unknown, headers: Record<string, string> = {}): NextRequest {
  return new NextRequest(new URL("/api/orders", "http://localhost"), {
    method: "POST",
    headers: { "content-type": "application/json", ...headers },
    body: JSON.stringify(body),
  });
}

const BODY = { flow: "custom", config: { markets: ["SE"], type: "Bolag", fieldIds: ["identity"], volume: 1000 } };
const BODY_DIFFERENT = { flow: "custom", config: { markets: ["NO"], type: "Bolag", fieldIds: ["identity"], volume: 9000 } };

describe("POST /api/orders — Idempotency-Key", () => {
  it("no header: two identical requests create two distinct orders (201, 201)", async () => {
    const r1 = await ordersPOST(postReq(BODY));
    const r2 = await ordersPOST(postReq(BODY));
    expect(r1.status).toBe(201);
    expect(r2.status).toBe(201);
    const b1 = await r1.json();
    const b2 = await r2.json();
    expect(b1.order_id).not.toBe(b2.order_id);
  });

  it("REGRESSION: same Idempotency-Key replays the original order (201 then 200, same order_id)", async () => {
    const key = `idem_${crypto.randomUUID()}`;
    const r1 = await ordersPOST(postReq(BODY, { "Idempotency-Key": key }));
    const r2 = await ordersPOST(postReq(BODY, { "Idempotency-Key": key }));
    expect(r1.status).toBe(201);
    expect(r2.status).toBe(200); // replayed, not created
    const b1 = await r1.json();
    const b2 = await r2.json();
    expect(b2.order_id).toBe(b1.order_id);
    expect(b2.total_ore).toBe(b1.total_ore);
  });

  it("reusing the same key for a materially different order is a 409, not a silent merge", async () => {
    const key = `idem_${crypto.randomUUID()}`;
    const r1 = await ordersPOST(postReq(BODY, { "Idempotency-Key": key }));
    expect(r1.status).toBe(201);
    const r2 = await ordersPOST(postReq(BODY_DIFFERENT, { "Idempotency-Key": key }));
    expect(r2.status).toBe(409);
    const b2 = await r2.json();
    expect(b2.error.code).toBe("idempotency_key_conflict");
  });

  it("header name is case-insensitive (Fetch/Next Headers normalize casing)", async () => {
    const key = `idem_${crypto.randomUUID()}`;
    const r1 = await ordersPOST(postReq(BODY, { "idempotency-key": key }));
    const r2 = await ordersPOST(postReq(BODY, { "IDEMPOTENCY-KEY": key }));
    expect(r1.status).toBe(201);
    expect(r2.status).toBe(200);
  });
});