Some checks failed
Security: - Fix TOCTOU race conditions: move balance/limit checks after row lock in redeem_points, add_stamp, redeem_stamps - Add PIN ownership verification to update/delete/unlock store routes - Gate adjust_points endpoint to merchant_owner role only Data integrity: - Track total_points_voided in void_points - Add order_reference idempotency guard in earn_points Correctness: - Fix LoyaltyProgramAlreadyExistsException to use merchant_id parameter - Add StorefrontProgramResponse excluding wallet IDs from public API - Add bounds (±100000) to PointsAdjustRequest.points_delta Audit & config: - Add CARD_REACTIVATED transaction type with audit record - Improve admin audit logging with actor identity and old values - Use merchant-specific PIN lockout settings with global fallback - Guard MerchantLoyaltySettings creation with get_or_create pattern Tests: 27 new tests (265 total) covering all 12 items — unit and integration. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
180 lines
5.9 KiB
Python
180 lines
5.9 KiB
Python
"""Unit tests for loyalty schemas."""
|
|
|
|
from datetime import UTC, datetime
|
|
|
|
import pytest
|
|
from pydantic import ValidationError
|
|
|
|
from app.modules.loyalty.schemas.card import (
|
|
CardEnrollRequest,
|
|
TransactionResponse,
|
|
)
|
|
from app.modules.loyalty.schemas.points import PointsAdjustRequest
|
|
from app.modules.loyalty.schemas.program import StorefrontProgramResponse
|
|
|
|
|
|
@pytest.mark.unit
|
|
@pytest.mark.loyalty
|
|
class TestCardEnrollRequest:
|
|
"""Tests for enrollment request schema validation."""
|
|
|
|
def test_valid_with_email(self):
|
|
"""Email-only enrollment is valid."""
|
|
req = CardEnrollRequest(email="test@example.com")
|
|
assert req.email == "test@example.com"
|
|
assert req.customer_id is None
|
|
|
|
def test_valid_with_customer_id(self):
|
|
"""Customer ID enrollment is valid."""
|
|
req = CardEnrollRequest(customer_id=42)
|
|
assert req.customer_id == 42
|
|
assert req.email is None
|
|
|
|
def test_self_enrollment_fields(self):
|
|
"""Self-enrollment accepts name, phone, birthday."""
|
|
req = CardEnrollRequest(
|
|
email="self@example.com",
|
|
customer_name="Jane Doe",
|
|
customer_phone="+352123456",
|
|
customer_birthday="1990-01-15",
|
|
)
|
|
assert req.customer_name == "Jane Doe"
|
|
assert req.customer_phone == "+352123456"
|
|
assert req.customer_birthday == "1990-01-15"
|
|
|
|
|
|
@pytest.mark.unit
|
|
@pytest.mark.loyalty
|
|
class TestTransactionResponse:
|
|
"""Tests for transaction response schema."""
|
|
|
|
def test_customer_name_field_defaults_none(self):
|
|
"""customer_name field exists and defaults to None."""
|
|
now = datetime.now(UTC)
|
|
tx = TransactionResponse(
|
|
id=1,
|
|
card_id=1,
|
|
transaction_type="points_earned",
|
|
stamps_delta=0,
|
|
points_delta=50,
|
|
transaction_at=now,
|
|
created_at=now,
|
|
)
|
|
assert tx.customer_name is None
|
|
|
|
def test_customer_name_can_be_set(self):
|
|
"""customer_name can be explicitly set."""
|
|
now = datetime.now(UTC)
|
|
tx = TransactionResponse(
|
|
id=1,
|
|
card_id=1,
|
|
transaction_type="card_created",
|
|
stamps_delta=0,
|
|
points_delta=0,
|
|
customer_name="John Doe",
|
|
transaction_at=now,
|
|
created_at=now,
|
|
)
|
|
assert tx.customer_name == "John Doe"
|
|
|
|
|
|
# ============================================================================
|
|
# Item 8: PointsAdjustRequest bounds
|
|
# ============================================================================
|
|
|
|
|
|
@pytest.mark.unit
|
|
@pytest.mark.loyalty
|
|
class TestPointsAdjustRequestBounds:
|
|
"""Tests for PointsAdjustRequest.points_delta bounds."""
|
|
|
|
def test_valid_positive_delta(self):
|
|
"""Positive delta within bounds is valid."""
|
|
req = PointsAdjustRequest(points_delta=100, reason="Bonus for customer")
|
|
assert req.points_delta == 100
|
|
|
|
def test_valid_negative_delta(self):
|
|
"""Negative delta within bounds is valid."""
|
|
req = PointsAdjustRequest(points_delta=-500, reason="Correction needed")
|
|
assert req.points_delta == -500
|
|
|
|
def test_max_boundary(self):
|
|
"""Delta at max boundary (100000) is valid."""
|
|
req = PointsAdjustRequest(points_delta=100000, reason="Max allowed delta")
|
|
assert req.points_delta == 100000
|
|
|
|
def test_min_boundary(self):
|
|
"""Delta at min boundary (-100000) is valid."""
|
|
req = PointsAdjustRequest(points_delta=-100000, reason="Min allowed delta")
|
|
assert req.points_delta == -100000
|
|
|
|
def test_exceeds_max_rejected(self):
|
|
"""Delta exceeding 100000 is rejected."""
|
|
with pytest.raises(ValidationError):
|
|
PointsAdjustRequest(points_delta=100001, reason="Too many points")
|
|
|
|
def test_exceeds_min_rejected(self):
|
|
"""Delta below -100000 is rejected."""
|
|
with pytest.raises(ValidationError):
|
|
PointsAdjustRequest(points_delta=-100001, reason="Too many negative")
|
|
|
|
|
|
# ============================================================================
|
|
# Item 7: StorefrontProgramResponse excludes wallet fields
|
|
# ============================================================================
|
|
|
|
|
|
@pytest.mark.unit
|
|
@pytest.mark.loyalty
|
|
class TestStorefrontProgramResponse:
|
|
"""Tests for StorefrontProgramResponse excluding wallet IDs."""
|
|
|
|
def test_wallet_fields_excluded_from_serialization(self):
|
|
"""Wallet integration IDs are excluded from JSON output."""
|
|
now = datetime.now(UTC)
|
|
response = StorefrontProgramResponse(
|
|
id=1,
|
|
merchant_id=1,
|
|
loyalty_type="points",
|
|
stamps_target=10,
|
|
stamps_reward_description="Free item",
|
|
points_per_euro=10,
|
|
cooldown_minutes=15,
|
|
max_daily_stamps=5,
|
|
require_staff_pin=True,
|
|
card_color="#4F46E5",
|
|
is_active=True,
|
|
created_at=now,
|
|
updated_at=now,
|
|
)
|
|
|
|
data = response.model_dump()
|
|
assert "google_issuer_id" not in data
|
|
assert "google_class_id" not in data
|
|
assert "apple_pass_type_id" not in data
|
|
|
|
def test_non_wallet_fields_present(self):
|
|
"""Non-wallet fields are still present."""
|
|
now = datetime.now(UTC)
|
|
response = StorefrontProgramResponse(
|
|
id=1,
|
|
merchant_id=1,
|
|
loyalty_type="points",
|
|
stamps_target=10,
|
|
stamps_reward_description="Free item",
|
|
points_per_euro=10,
|
|
cooldown_minutes=15,
|
|
max_daily_stamps=5,
|
|
require_staff_pin=True,
|
|
card_color="#4F46E5",
|
|
is_active=True,
|
|
created_at=now,
|
|
updated_at=now,
|
|
)
|
|
|
|
data = response.model_dump()
|
|
assert data["id"] == 1
|
|
assert data["loyalty_type"] == "points"
|
|
assert data["points_per_euro"] == 10
|
|
assert data["card_color"] == "#4F46E5"
|