lux_fiscal/backend/tests/test_orders_router.py

"""Тесты роутера заказов.

Auth подменена через dependency_overrides, сервисный слой (`app.services.orders`)
— через monkeypatch. `SessionDep` создаёт `AsyncSession`, но соединение с БД
открывается лениво только при первом запросе — раз сервисные функции его не
трогают, реальная БД не нужна.
"""

from __future__ import annotations

import uuid
from datetime import UTC, datetime

import pytest
from fastapi.testclient import TestClient

from app.api.deps import get_crm_client, get_current_user
from app.db.models.order import Order
from app.db.models.user import User, UserRole
from app.main import app
from app.services.crm.stub_client import StubCrmClient

pytestmark = pytest.mark.usefixtures("_patch_orders_service")


def _user(role: UserRole) -> User:
    return User(
        id=uuid.uuid4(),
        email="test@example.com",
        password_hash="x",
        full_name="Тест",
        role=role,
        is_active=True,
    )


def _order(order_id: str = "1") -> Order:
    return Order(
        id=order_id,
        create_date_time=datetime(2026, 9, 20, 10, 0, 0, tzinfo=UTC),
        recipient_name="Тест Тестов",
        recipient_phone="+380501112233",
        recipient_email=None,
        waybill_number="20450123456789",
        notes=None,
        total_amount_kopecks=120000,
        goods=[
            {
                "id": "1",
                "sku": "SKU-1",
                "name": "Товар 1",
                "price": "1200.00",
                "quantity": "1.000",
                "discount_amount": "0.00",
                "discount_percent": "0.00",
                "amount": "1200.00",
            }
        ],
        is_deleted=False,
        deleted_at=None,
        receipt_created_at=None,
    )


@pytest.fixture
def _patch_orders_service(monkeypatch: pytest.MonkeyPatch) -> None:
    import app.api.v1.orders as orders_router

    async def fake_sync(session: object, crm: object) -> None:
        return None

    async def fake_list(session: object, *, has_receipt: bool) -> list[Order]:
        return [] if has_receipt else [_order()]

    async def fake_delete(session: object, order_id: str) -> Order | None:
        return _order(order_id) if order_id == "1" else None

    monkeypatch.setattr(orders_router.orders_service, "sync_orders_from_crm", fake_sync)
    monkeypatch.setattr(orders_router.orders_service, "list_orders", fake_list)
    monkeypatch.setattr(orders_router.orders_service, "delete_order", fake_delete)

    async def fake_record(session: object, **kwargs: object) -> None:
        return None

    monkeypatch.setattr(orders_router.audit, "record", fake_record)

    # session.commit() вызывается напрямую роутером после audit.record — сама
    # сессия не трогает БД до первого execute/commit, поэтому патчим только
    # commit, а не всю SessionDep.
    from sqlalchemy.ext.asyncio import AsyncSession

    async def fake_commit(self: AsyncSession) -> None:
        return None

    monkeypatch.setattr(AsyncSession, "commit", fake_commit)


@pytest.fixture
def client() -> TestClient:
    app.dependency_overrides[get_crm_client] = lambda: StubCrmClient()
    try:
        yield TestClient(app)
    finally:
        app.dependency_overrides.pop(get_crm_client, None)
        app.dependency_overrides.pop(get_current_user, None)


class TestListOrders:
    @pytest.mark.parametrize("role", [UserRole.ADMIN, UserRole.CASHIER, UserRole.VIEWER])
    def test_any_authenticated_role_can_list_no_receipt_orders(
        self, client: TestClient, role: UserRole
    ) -> None:
        app.dependency_overrides[get_current_user] = lambda: _user(role)

        response = client.get("/api/v1/orders", params={"has_receipt": "false"})

        assert response.status_code == 200
        body = response.json()
        assert len(body) == 1
        assert body[0]["id"] == "1"
        assert body[0]["total_amount"] == "1200.00"
        assert body[0]["has_receipt"] is False
        assert body[0]["goods"][0]["sku"] == "SKU-1"

    def test_has_receipt_tab_is_empty_for_now(self, client: TestClient) -> None:
        app.dependency_overrides[get_current_user] = lambda: _user(UserRole.CASHIER)

        response = client.get("/api/v1/orders", params={"has_receipt": "true"})

        assert response.status_code == 200
        assert response.json() == []

    def test_requires_authentication(self, client: TestClient) -> None:
        response = client.get("/api/v1/orders")
        assert response.status_code == 401


class TestDeleteOrder:
    @pytest.mark.parametrize("role", [UserRole.ADMIN, UserRole.CASHIER])
    def test_admin_and_cashier_can_delete(self, client: TestClient, role: UserRole) -> None:
        app.dependency_overrides[get_current_user] = lambda: _user(role)

        response = client.delete("/api/v1/orders/1")

        assert response.status_code == 204

    def test_viewer_cannot_delete(self, client: TestClient) -> None:
        app.dependency_overrides[get_current_user] = lambda: _user(UserRole.VIEWER)

        response = client.delete("/api/v1/orders/1")

        assert response.status_code == 403

    def test_deleting_unknown_order_is_404(self, client: TestClient) -> None:
        app.dependency_overrides[get_current_user] = lambda: _user(UserRole.CASHIER)

        response = client.delete("/api/v1/orders/does-not-exist")

        assert response.status_code == 404