From be47eb69d382567ec50eaceafb44c16b5d05c711 Mon Sep 17 00:00:00 2001
From: toanhoang <toanhoang@appsrv01.toanhoang.local>
Date: Tue, 4 Aug 2026 06:40:13 -0400
Subject: [PATCH] test: add malformed/non-object body tests for assets,
 employees, requests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Closes the coverage gap noted in CLAUDE.md's "Việc còn dở" — mirrors the
existing pattern in tests/licenses.test.ts and tests/assignments.test.ts for
POST /api/assets, POST /api/employees, POST /api/requests (the only body-
accepting methods on these three routes; none have a PATCH route yet).
---
 tests/assets.test.ts    | 24 ++++++++++++++++++++++++
 tests/employees.test.ts | 24 ++++++++++++++++++++++++
 tests/requests.test.ts  | 24 ++++++++++++++++++++++++
 3 files changed, 72 insertions(+)

diff --git a/tests/assets.test.ts b/tests/assets.test.ts
index 480e3d4..2817517 100644
--- a/tests/assets.test.ts
+++ b/tests/assets.test.ts
@@ -297,6 +297,30 @@ describe("POST /api/assets", () => {
     const remaining = await prisma.assetItem.findMany();
     expect(remaining).toHaveLength(0);
   });
+
+  it("rejects an invalid JSON body", async () => {
+    const req = new Request("http://localhost/api/assets", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: "not json",
+    });
+
+    const res = await POST(req);
+    expect(res.status).toBe(400);
+    const body = await res.json();
+    expect(body.error).toMatch(/JSON/i);
+  });
+
+  it("rejects a non-object JSON body", async () => {
+    // Note: arrays are `typeof "object"` in JS, so they pass the route's
+    // object check — use a JSON string primitive here to actually exercise
+    // the "not an object" branch (mirrors tests/licenses.test.ts).
+    const res = await POST(postRequest("not an object"));
+
+    expect(res.status).toBe(400);
+    const body = await res.json();
+    expect(body.error).toMatch(/JSON object/i);
+  });
 });
 
 describe("GET /api/assets", () => {
diff --git a/tests/employees.test.ts b/tests/employees.test.ts
index 60c2786..fc40025 100644
--- a/tests/employees.test.ts
+++ b/tests/employees.test.ts
@@ -125,6 +125,30 @@ describe("POST /api/employees", () => {
     });
     expect(updated.managerId).toBe(created.id);
   });
+
+  it("rejects an invalid JSON body", async () => {
+    const req = new Request("http://localhost/api/employees", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: "not json",
+    });
+
+    const res = await POST(req);
+    expect(res.status).toBe(400);
+    const body = await res.json();
+    expect(body.error).toMatch(/JSON/i);
+  });
+
+  it("rejects a non-object JSON body", async () => {
+    // Note: arrays are `typeof "object"` in JS, so they pass the route's
+    // object check — use a JSON string primitive here to actually exercise
+    // the "not an object" branch (mirrors tests/licenses.test.ts).
+    const res = await POST(postRequest("not an object"));
+
+    expect(res.status).toBe(400);
+    const body = await res.json();
+    expect(body.error).toMatch(/JSON object/i);
+  });
 });
 
 describe("GET /api/employees", () => {
diff --git a/tests/requests.test.ts b/tests/requests.test.ts
index c671d4f..d4d2922 100644
--- a/tests/requests.test.ts
+++ b/tests/requests.test.ts
@@ -239,6 +239,30 @@ describe("POST /api/requests", () => {
     const body = await res.json();
     expect(body.error).toMatch(/purchase_order_id/i);
   });
+
+  it("rejects an invalid JSON body", async () => {
+    const req = new Request("http://localhost/api/requests", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: "not json",
+    });
+
+    const res = await POST(req);
+    expect(res.status).toBe(400);
+    const body = await res.json();
+    expect(body.error).toMatch(/JSON/i);
+  });
+
+  it("rejects a non-object JSON body", async () => {
+    // Note: arrays are `typeof "object"` in JS, so they pass the route's
+    // object check — use a JSON string primitive here to actually exercise
+    // the "not an object" branch (mirrors tests/licenses.test.ts).
+    const res = await POST(postRequest("not an object"));
+
+    expect(res.status).toBe(400);
+    const body = await res.json();
+    expect(body.error).toMatch(/JSON object/i);
+  });
 });
 
 describe("GET /api/requests", () => {