- createRequestSchema now requires employee_id to be a UUID-format
string (was a free-text non-empty check), matching the new FK to
Employee in schema.prisma.
- createRequest() now returns a CreateRequestResult discriminated
union and catches Prisma P2003 (FK violation), returning a friendly
ok:false error instead of a raw 500 when employee_id does not
reference an existing Employee. POST /api/requests branches on
created.ok and returns 400 in that case.
- tests/requests.test.ts: every test that used to POST a fake string
employee_id (emp-1, emp-2) now creates a real Employee first via
createTestEmployee() and uses its id, since employee_id is now a
real FK. Added coverage for a syntactically invalid UUID and for a
well-formed but non-existent UUID (expects the friendly 400 from
the P2003 catch, not a raw 500) - the exact case this retrofit was
meant to protect against.
Mirrors tests/requests.test.ts's structure and @/auth mocking
pattern. Covers: successful create (with and without managerId),
empty name/department validation failures, malformed managerId UUID,
nonexistent managerId (FK violation -> friendly 400, not a raw 500),
a self-referential manager sanity check via direct Prisma update,
list ordering, empty list, and 401-when-unauthenticated for both
routes.
Mocks @/auth (vi.mock) instead of exercising the real auth(): that
helper reads cookies via next/headers under the hood, which only
works inside Next.js own request-handling machinery, not when these
tests import and call GET()/POST() directly. beforeEach mocks a
valid session by default so the existing business-logic tests are
unaffected, and two new tests mock a null session to assert both
GET and POST return 401 with { error: Unauthorized } and that POST
does not create a row.
middleware.ts itself has no automated test - it runs on the Edge
Runtime and is not exercised by vitest calling route handlers
directly. Verified manually instead via next build + next start:
curl confirmed GET / redirects to /login (307), GET /login stays
200 with no redirect loop, GET/POST /api/requests return 401 JSON
unauthenticated, and GET /api/auth/session (needed for the login
flow) is not blocked.
toanhoang
toanhoang