0pt/tests/auth/order-owner.test.ts

import { beforeEach, expect, it, vi } from "vitest";
import { NextRequest, NextResponse } from "next/server";

const mocks = vi.hoisted(() => ({ routeAuth: vi.fn() }));
vi.mock("@/src/auth/require-route-auth", () => ({ requireRouteAuth: mocks.routeAuth }));

import { requireOrderOwner } from "@/src/auth/require-order-owner";

beforeEach(() => mocks.routeAuth.mockReset());

const request = () => new NextRequest("https://0pt.app/api/orders", { method: "POST" });

it("passes through a failed Zitadel route-auth decision", async () => {
  mocks.routeAuth.mockResolvedValue({ response: NextResponse.json({ error: "unauthenticated" }, { status: 401 }) });
  expect((await requireOrderOwner(request())).response?.status).toBe(401);
});

it("rejects the local-dev auth bypass when no verified principal exists", async () => {
  mocks.routeAuth.mockResolvedValue({ ctx: { tenantId: "spoofable-header" } });
  expect((await requireOrderOwner(request())).response?.status).toBe(401);
});

it("uses only the verified JWT principal, not a request-supplied tenant", async () => {
  mocks.routeAuth.mockResolvedValue({
    ctx: { tenantId: "header-tenant", principal: { tenantId: "signed-tenant", sub: "signed-subject" } },
  });
  const result = await requireOrderOwner(request());
  expect(result.owner).toEqual({ tenantId: "signed-tenant", subject: "signed-subject" });
});