feat(katalog): kategori ve ödeme türü uç noktaları, hane izolasyonu entegrasyon testleri

- /api/categories ve /api/payment-methods: listele, ekle, düzenle, sırala, pasife al - Sürüm kontrolü ile eşzamanlı düzenleme çakışması (409) - Backend lib + bin yapısına ayrıldı (entegrasyon testleri için) - tests/: hane izolasyonu (3) ve katalog (4) entegrasyon testleri - db:reset artık artık test veritabanlarını da siler - api.http tamamlandı; Faz 1 tamamlandı Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-11 23:54:16 +03:00
parent 4cc4fa5882
commit 6eb5440d4d
21 changed files with 1257 additions and 44 deletions
@@ -0,0 +1,216 @@
+//! Kategori ve ödeme türü davranış testleri.
+
+mod common;
+
+use axum::http::StatusCode;
+use common::TestApp;
+use serde_json::{Value, json};
+
+fn names(list: &Value) -> Vec<&str> {
+    list.as_array()
+        .unwrap()
+        .iter()
+        .map(|i| i["name"].as_str().unwrap())
+        .collect()
+}
+
+#[tokio::test]
+async fn new_household_gets_default_categories_and_payment_methods() {
+    let app = TestApp::new().await;
+    let s = app.register("Yeni", None).await;
+
+    let (_, cats) = app.get("/categories", &s).await;
+    assert_eq!(cats.as_array().unwrap().len(), 13);
+    // Grup sırası: needs → wants → culture → unexpected
+    let groups: Vec<&str> = cats
+        .as_array()
+        .unwrap()
+        .iter()
+        .map(|c| c["group"].as_str().unwrap())
+        .collect();
+    assert_eq!(groups.first(), Some(&"needs"));
+    assert_eq!(groups.last(), Some(&"unexpected"));
+
+    let (_, pms) = app.get("/payment-methods", &s).await;
+    assert_eq!(
+        names(&pms),
+        vec!["Nakit", "Kredi Kartı", "Banka Kartı", "Havale/EFT"]
+    );
+    assert!(
+        pms[0].get("group").is_none(),
+        "ödeme türünde group alanı olmamalı"
+    );
+
+    app.cleanup().await;
+}
+
+#[tokio::test]
+async fn create_validates_and_appends_to_end_of_group() {
+    let app = TestApp::new().await;
+    let s = app.register("Test", None).await;
+
+    // Grup zorunlu
+    let (st, _) = app
+        .post("/categories", &s, json!({ "name": "Grupsuz" }))
+        .await;
+    assert_eq!(st, StatusCode::BAD_REQUEST);
+    // Boş ad
+    let (st, _) = app
+        .post(
+            "/categories",
+            &s,
+            json!({ "group": "needs", "name": "   " }),
+        )
+        .await;
+    assert_eq!(st, StatusCode::BAD_REQUEST);
+    // Geçersiz grup
+    let (st, _) = app
+        .post("/categories", &s, json!({ "group": "luks", "name": "X" }))
+        .await;
+    assert_eq!(st, StatusCode::BAD_REQUEST);
+    // Aynı ad (büyük/küçük harf duyarsız) → 409
+    let (st, body) = app
+        .post(
+            "/categories",
+            &s,
+            json!({ "group": "needs", "name": "MARKET" }),
+        )
+        .await;
+    assert_eq!(st, StatusCode::CONFLICT, "{body}");
+    // Aynı ad başka grupta serbest
+    let (st, _) = app
+        .post(
+            "/categories",
+            &s,
+            json!({ "group": "wants", "name": "Market" }),
+        )
+        .await;
+    assert_eq!(st, StatusCode::CREATED);
+
+    // Yeni kayıt grubun sonuna eklenir
+    let (st, cat) = app
+        .post(
+            "/categories",
+            &s,
+            json!({ "group": "needs", "name": " Aidat ", "emoji": "🏢" }),
+        )
+        .await;
+    assert_eq!(st, StatusCode::CREATED);
+    assert_eq!(cat["name"], "Aidat");
+    let (_, cats) = app.get("/categories", &s).await;
+    let needs: Vec<&str> = cats
+        .as_array()
+        .unwrap()
+        .iter()
+        .filter(|c| c["group"] == "needs")
+        .map(|c| c["name"].as_str().unwrap())
+        .collect();
+    assert_eq!(needs.last(), Some(&"Aidat"));
+
+    app.cleanup().await;
+}
+
+#[tokio::test]
+async fn update_deactivate_and_version_conflict() {
+    let app = TestApp::new().await;
+    let s = app.register("Test", None).await;
+    let (_, pm) = app
+        .post(
+            "/payment-methods",
+            &s,
+            json!({ "name": "Yemek Kartı", "emoji": "🍽️" }),
+        )
+        .await;
+    let path = format!("/payment-methods/{}", pm["id"].as_str().unwrap());
+    assert_eq!(pm["version"], 1);
+
+    // Ad + emoji kaldırma, doğru sürümle
+    let (st, upd) = app
+        .patch(
+            &path,
+            &s,
+            json!({ "name": "Multinet", "emoji": "", "version": 1 }),
+        )
+        .await;
+    assert_eq!(st, StatusCode::OK);
+    assert_eq!(upd["name"], "Multinet");
+    assert_eq!(upd["emoji"], Value::Null);
+    assert_eq!(upd["version"], 2);
+
+    // Eski sürümle güncelleme → 409 (başkası değiştirmiş)
+    let (st, _) = app
+        .patch(&path, &s, json!({ "name": "Sodexo", "version": 1 }))
+        .await;
+    assert_eq!(st, StatusCode::CONFLICT);
+
+    // Pasife al: varsayılan listede görünmez, include_inactive ile görünür
+    let (st, _) = app.patch(&path, &s, json!({ "is_active": false })).await;
+    assert_eq!(st, StatusCode::OK);
+    let (_, active) = app.get("/payment-methods", &s).await;
+    assert!(!names(&active).contains(&"Multinet"));
+    let (_, all) = app.get("/payment-methods?include_inactive=true", &s).await;
+    assert!(names(&all).contains(&"Multinet"));
+
+    // Pasif kayıtla aynı adda yeni kayıt açılamaz
+    let (st, _) = app
+        .post("/payment-methods", &s, json!({ "name": "multinet" }))
+        .await;
+    assert_eq!(st, StatusCode::CONFLICT);
+
+    // Olmayan / bozuk kimlik → 404
+    let (st, _) = app
+        .patch(
+            "/payment-methods/01a1cc59-0000-7000-8000-000000000000",
+            &s,
+            json!({ "name": "X" }),
+        )
+        .await;
+    assert_eq!(st, StatusCode::NOT_FOUND);
+    let (st, _) = app
+        .patch("/payment-methods/bozuk", &s, json!({ "name": "X" }))
+        .await;
+    assert_eq!(st, StatusCode::NOT_FOUND);
+
+    app.cleanup().await;
+}
+
+#[tokio::test]
+async fn reorder_requires_complete_list() {
+    let app = TestApp::new().await;
+    let s = app.register("Test", None).await;
+
+    let (_, cats) = app.get("/categories", &s).await;
+    let mut culture: Vec<String> = cats
+        .as_array()
+        .unwrap()
+        .iter()
+        .filter(|c| c["group"] == "culture")
+        .map(|c| c["id"].as_str().unwrap().to_string())
+        .collect();
+    assert_eq!(culture.len(), 3);
+
+    // Eksik liste → 400
+    let (st, _) = app
+        .put(
+            "/categories/order",
+            &s,
+            json!({ "group": "culture", "ids": &culture[..2] }),
+        )
+        .await;
+    assert_eq!(st, StatusCode::BAD_REQUEST);
+
+    // Ters çevir → yeni sıra
+    culture.reverse();
+    let (st, ordered) = app
+        .put(
+            "/categories/order",
+            &s,
+            json!({ "group": "culture", "ids": culture }),
+        )
+        .await;
+    assert_eq!(st, StatusCode::OK);
+    assert_eq!(names(&ordered), vec!["Sinema/Konser", "Eğitim", "Kitap"]);
+    assert_eq!(ordered[0]["sort_order"], 10);
+
+    app.cleanup().await;
+}
@@ -0,0 +1,149 @@
+//! Entegrasyon testleri için yardımcılar.
+//!
+//! Her test kendi geçici veritabanını (`kakeibo_test_<uuid>`) kullanır ve sonunda siler.
+//! Gereken: yerel MongoDB çalışıyor olmalı (`npm run db:up`), `.env` içinde `MONGODB_URI`.
+
+#![allow(dead_code)] // her test dosyası tüm yardımcıları kullanmaz
+
+use axum::{
+    Router,
+    body::Body,
+    http::{Method, Request, StatusCode, header},
+};
+use http_body_util::BodyExt;
+use kakeibo::{config::Config, db, routes, state::AppState};
+use mongodb::Database;
+use serde_json::{Value, json};
+use tower::ServiceExt;
+
+pub struct TestApp {
+    router: Router,
+    pub db: Database,
+}
+
+/// Oturum açmış bir test kullanıcısı
+#[derive(Clone)]
+pub struct Session {
+    pub cookie: String,
+    pub household_id: String,
+}
+
+impl TestApp {
+    pub async fn new() -> Self {
+        dotenvy::dotenv().ok();
+        let uri = std::env::var("MONGODB_URI")
+            .expect("MONGODB_URI tanımlı değil (.env dosyasını kontrol edin)");
+
+        let base = db::connect(&uri)
+            .await
+            .expect("MongoDB'ye bağlanılamadı — `npm run db:up` çalıştırın");
+        let name = format!("kakeibo_test_{}", uuid::Uuid::new_v4().simple());
+        let db = base.client().database(&name);
+        db::prepare(&db).await.expect("test DB hazırlanamadı");
+
+        let config = Config {
+            mongodb_uri: uri,
+            jwt_secret: "test-jwt-secret-en-az-32-karakter-olmali!!".into(),
+            app_url: "http://localhost".into(),
+            port: 0,
+        };
+        let router = routes::router(AppState::new(db.clone(), config));
+        Self { router, db }
+    }
+
+    /// Test sonunda geçici veritabanını siler.
+    pub async fn cleanup(self) {
+        self.db.drop().await.ok();
+    }
+
+    /// İstek gönderir; (durum kodu, JSON gövde, set-cookie) döner.
+    pub async fn send(
+        &self,
+        method: Method,
+        path: &str,
+        cookie: Option<&str>,
+        body: Option<Value>,
+    ) -> (StatusCode, Value, Option<String>) {
+        let mut req = Request::builder().method(method).uri(format!("/api{path}"));
+        if let Some(c) = cookie {
+            req = req.header(header::COOKIE, c);
+        }
+        let req = match body {
+            Some(b) => req
+                .header(header::CONTENT_TYPE, "application/json")
+                .body(Body::from(b.to_string())),
+            None => req.body(Body::empty()),
+        }
+        .unwrap();
+
+        let res = self.router.clone().oneshot(req).await.unwrap();
+        let status = res.status();
+        let set_cookie = res
+            .headers()
+            .get(header::SET_COOKIE)
+            .and_then(|v| v.to_str().ok())
+            .and_then(|v| v.split(';').next())
+            .map(String::from);
+        let bytes = res.into_body().collect().await.unwrap().to_bytes();
+        let json = serde_json::from_slice(&bytes).unwrap_or(Value::Null);
+        (status, json, set_cookie)
+    }
+
+    pub async fn get(&self, path: &str, s: &Session) -> (StatusCode, Value) {
+        let (st, v, _) = self.send(Method::GET, path, Some(&s.cookie), None).await;
+        (st, v)
+    }
+
+    pub async fn post(&self, path: &str, s: &Session, body: Value) -> (StatusCode, Value) {
+        let (st, v, _) = self
+            .send(Method::POST, path, Some(&s.cookie), Some(body))
+            .await;
+        (st, v)
+    }
+
+    pub async fn patch(&self, path: &str, s: &Session, body: Value) -> (StatusCode, Value) {
+        let (st, v, _) = self
+            .send(Method::PATCH, path, Some(&s.cookie), Some(body))
+            .await;
+        (st, v)
+    }
+
+    pub async fn put(&self, path: &str, s: &Session, body: Value) -> (StatusCode, Value) {
+        let (st, v, _) = self
+            .send(Method::PUT, path, Some(&s.cookie), Some(body))
+            .await;
+        (st, v)
+    }
+
+    pub async fn delete(&self, path: &str, s: &Session) -> (StatusCode, Value) {
+        let (st, v, _) = self.send(Method::DELETE, path, Some(&s.cookie), None).await;
+        (st, v)
+    }
+
+    /// Yeni kullanıcı kaydeder (davet koduyla veya yeni hane olarak) ve oturumunu döner.
+    pub async fn register(&self, name: &str, invite_code: Option<&str>) -> Session {
+        let email = format!(
+            "{}-{}@test.com",
+            name.to_lowercase(),
+            uuid::Uuid::new_v4().simple()
+        );
+        let (status, body, cookie) = self
+            .send(
+                Method::POST,
+                "/auth/register",
+                None,
+                Some(json!({
+                    "name": name,
+                    "email": email,
+                    "password": "test-sifre-123",
+                    "invite_code": invite_code,
+                })),
+            )
+            .await;
+        assert_eq!(status, StatusCode::CREATED, "kayıt başarısız: {body}");
+        Session {
+            cookie: cookie.expect("kayıtta cookie dönmedi"),
+            household_id: body["household"]["id"].as_str().unwrap().to_string(),
+        }
+    }
+}
@@ -0,0 +1,168 @@
+//! Hane izolasyonu testleri: bir hane, başka hanenin verisini göremez ve değiştiremez.
+//! (KAKEIBO_PROMPT.md §11 — "başka hanenin verisine erişim imkânsız olmalı")
+
+mod common;
+
+use axum::http::{Method, StatusCode};
+use common::TestApp;
+use serde_json::{Value, json};
+
+fn ids(list: &Value) -> Vec<String> {
+    list.as_array()
+        .unwrap()
+        .iter()
+        .map(|i| i["id"].as_str().unwrap().to_string())
+        .collect()
+}
+
+#[tokio::test]
+async fn households_cannot_see_or_touch_each_other() {
+    let app = TestApp::new().await;
+    let a = app.register("Ayse", None).await;
+    let b = app.register("Burak", None).await;
+    assert_ne!(a.household_id, b.household_id);
+
+    // A'ya özel kategori ve ödeme türü
+    let (st, cat) = app
+        .post(
+            "/categories",
+            &a,
+            json!({ "group": "wants", "name": "A'nın gizli kategorisi" }),
+        )
+        .await;
+    assert_eq!(st, StatusCode::CREATED);
+    let cat_id = cat["id"].as_str().unwrap();
+    let (_, pm) = app
+        .post("/payment-methods", &a, json!({ "name": "A'nın kartı" }))
+        .await;
+    let pm_id = pm["id"].as_str().unwrap();
+    let (_, invite) = app.post("/household/invites", &a, json!({})).await;
+    let invite_id = invite["id"].as_str().unwrap();
+
+    // --- Okuma: B, A'nın kayıtlarını görmez ---
+    let (_, b_cats) = app.get("/categories?include_inactive=true", &b).await;
+    assert!(!ids(&b_cats).contains(&cat_id.to_string()));
+    let (_, b_pms) = app.get("/payment-methods?include_inactive=true", &b).await;
+    assert!(!ids(&b_pms).contains(&pm_id.to_string()));
+    let (_, b_hh) = app.get("/household", &b).await;
+    assert_eq!(b_hh["id"], b.household_id.as_str());
+    assert_eq!(b_hh["members"].as_array().unwrap().len(), 1);
+    let (_, b_invites) = app.get("/household/invites", &b).await;
+    assert_eq!(b_invites, json!([]));
+
+    // --- Yazma: B, A'nın kayıtlarını değiştiremez (404: varlığı bile sızmaz) ---
+    let (st, _) = app
+        .patch(
+            &format!("/categories/{cat_id}"),
+            &b,
+            json!({ "name": "ele geçirildi" }),
+        )
+        .await;
+    assert_eq!(st, StatusCode::NOT_FOUND);
+    let (st, _) = app
+        .patch(
+            &format!("/payment-methods/{pm_id}"),
+            &b,
+            json!({ "is_active": false }),
+        )
+        .await;
+    assert_eq!(st, StatusCode::NOT_FOUND);
+    let (st, _) = app
+        .delete(&format!("/household/invites/{invite_id}"), &b)
+        .await;
+    assert_eq!(st, StatusCode::NOT_FOUND);
+
+    // B, kendi sıralama listesine A'nın kaydını sokamaz
+    let mut b_wants: Vec<String> = b_cats
+        .as_array()
+        .unwrap()
+        .iter()
+        .filter(|c| c["group"] == "wants")
+        .map(|c| c["id"].as_str().unwrap().to_string())
+        .collect();
+    b_wants.push(cat_id.to_string());
+    let (st, _) = app
+        .put(
+            "/categories/order",
+            &b,
+            json!({ "group": "wants", "ids": b_wants }),
+        )
+        .await;
+    assert_eq!(st, StatusCode::BAD_REQUEST);
+
+    // --- A'nın verisi hiç değişmedi ---
+    let (_, a_cats) = app.get("/categories", &a).await;
+    let mine = a_cats
+        .as_array()
+        .unwrap()
+        .iter()
+        .find(|c| c["id"] == cat_id)
+        .unwrap();
+    assert_eq!(mine["name"], "A'nın gizli kategorisi");
+    assert_eq!(mine["version"], 1);
+    let (_, a_invites) = app.get("/household/invites", &a).await;
+    assert_eq!(ids(&a_invites), vec![invite_id.to_string()]);
+
+    app.cleanup().await;
+}
+
+#[tokio::test]
+async fn member_joins_via_invite_and_shares_household_data() {
+    let app = TestApp::new().await;
+    let owner = app.register("Sahip", None).await;
+    let (_, inv) = app.post("/household/invites", &owner, json!({})).await;
+    let member = app
+        .register("Uye", Some(inv["code"].as_str().unwrap()))
+        .await;
+
+    assert_eq!(member.household_id, owner.household_id);
+
+    // Üye, sahibin eklediği kategoriyi görür ve düzenleyebilir (ortak defter)
+    let (_, cat) = app
+        .post(
+            "/categories",
+            &owner,
+            json!({ "group": "needs", "name": "Ortak" }),
+        )
+        .await;
+    let (st, _) = app
+        .patch(
+            &format!("/categories/{}", cat["id"].as_str().unwrap()),
+            &member,
+            json!({ "emoji": "🤝" }),
+        )
+        .await;
+    assert_eq!(st, StatusCode::OK);
+
+    // Ama davet oluşturamaz
+    let (st, _) = app.post("/household/invites", &member, json!({})).await;
+    assert_eq!(st, StatusCode::FORBIDDEN);
+
+    app.cleanup().await;
+}
+
+#[tokio::test]
+async fn protected_endpoints_require_session() {
+    let app = TestApp::new().await;
+    let endpoints = [
+        (Method::GET, "/auth/me"),
+        (Method::GET, "/household"),
+        (Method::GET, "/household/invites"),
+        (Method::POST, "/household/invites"),
+        (Method::GET, "/categories"),
+        (Method::POST, "/categories"),
+        (Method::PUT, "/categories/order"),
+        (Method::GET, "/payment-methods"),
+        (Method::POST, "/payment-methods"),
+    ];
+    for (method, path) in endpoints {
+        // Oturumsuz ve sahte cookie ile
+        for cookie in [None, Some("kakeibo_session=sahte.token.degeri")] {
+            let (st, _, _) = app
+                .send(method.clone(), path, cookie, Some(json!({})))
+                .await;
+            assert_eq!(st, StatusCode::UNAUTHORIZED, "{method} {path} korumasız!");
+        }
+    }
+    app.cleanup().await;
+}