api/services/nginx/app/tests/Api/OrderBookingsCompletionApiTest.php

<?php

declare(strict_types=1);

usesApiSuite();

it('rejects standalone order booking completion outside POS', function (): void {
    $customer = api_fixtures()->createUser(['display_name' => 'Standalone Booking Customer']);
    $department = api_fixtures()->createDepartment();
    $booking = api_fixtures()->createOrderBooking([
        'customer_number' => $customer['customer_number'],
        'department' => $department['id'],
        'order_id' => null,
    ]);
    $session = api_fixtures()->createUserSession([
        'complete_bookings',
        'department_access_' . $department['id'],
    ]);

    $response = api_client()->post('/order-bookings/complete', [
        'id' => $booking['id'],
    ], $session['headers']);

    $response
        ->assertStatus(409)
        ->assertEnvelope()
        ->assertSuccess(false)
        ->assertMessage('Booking completion must be completed through POS desktop or mobile steps.');

    $result = api_test_runtime()->db()
        ->query('SELECT order_id FROM order_bookings WHERE id = ' . (int)$booking['id'] . ' LIMIT 1');

    expect($result)->not->toBeFalse();
    $row = $result->fetch_assoc();
    expect($row)->toBeArray();
    expect($row['order_id'] ?? null)->toBeNull();

    $result = api_test_runtime()->db()
        ->query('SELECT COUNT(*) AS total FROM orders WHERE customer_id = ' . (int)$customer['customer_number']);

    expect($result)->not->toBeFalse();
    $row = $result->fetch_assoc();
    expect((int)($row['total'] ?? -1))->toBe(0);
});

it('allows linked POS order booking completion for mobile POS compatibility', function (): void {
    $customer = api_fixtures()->createUser(['display_name' => 'Linked Booking Customer']);
    $department = api_fixtures()->createDepartment();
    $cashier = api_fixtures()->createUser(['display_name' => 'Linked Booking Cashier']);
    $order = api_fixtures()->createOrder([
        'customer_id' => $customer['customer_number'],
        'cashier_id' => $cashier['id'],
        'department_id' => $department['id'],
        'safety_seal' => null,
    ]);
    $booking = api_fixtures()->createOrderBooking([
        'customer_number' => $customer['customer_number'],
        'department' => $department['id'],
        'order_id' => $order['id'],
    ]);
    $session = api_fixtures()->createUserSession([
        'complete_bookings',
        'department_access_' . $department['id'],
    ]);

    $response = api_client()->post('/order-bookings/complete', [
        'id' => $booking['id'],
        'safety_seal' => 123456,
    ], $session['headers']);

    $response
        ->assertStatus(200)
        ->assertEnvelope()
        ->assertSuccess();

    expect($response->data()['id'] ?? null)->toBe($booking['id']);
    expect($response->data()['order_id'] ?? null)->toBe($order['id']);

    $result = api_test_runtime()->db()
        ->query('SELECT order_id FROM order_bookings WHERE id = ' . (int)$booking['id'] . ' LIMIT 1');

    expect($result)->not->toBeFalse();
    $row = $result->fetch_assoc();
    expect($row)->toBeArray();
    expect((int)($row['order_id'] ?? 0))->toBe($order['id']);
});

it('accepts numeric safety seal strings when completing a linked POS order booking', function (): void {
    $customer = api_fixtures()->createUser(['display_name' => 'Linked Booking String Seal Customer']);
    $department = api_fixtures()->createDepartment();
    $cashier = api_fixtures()->createUser(['display_name' => 'Linked Booking String Seal Cashier']);
    $order = api_fixtures()->createOrder([
        'customer_id' => $customer['customer_number'],
        'cashier_id' => $cashier['id'],
        'department_id' => $department['id'],
        'safety_seal' => null,
    ]);
    $booking = api_fixtures()->createOrderBooking([
        'customer_number' => $customer['customer_number'],
        'department' => $department['id'],
        'order_id' => $order['id'],
    ]);
    $session = api_fixtures()->createUserSession([
        'complete_bookings',
        'department_access_' . $department['id'],
    ]);

    $response = api_client()->post('/order-bookings/complete', [
        'id' => $booking['id'],
        'safety_seal' => '123456',
    ], $session['headers']);

    $response
        ->assertStatus(200)
        ->assertEnvelope()
        ->assertSuccess();

    expect($response->data()['id'] ?? null)->toBe($booking['id']);
    expect($response->data()['order_id'] ?? null)->toBe($order['id']);
});

it('disables the legacy complete wash without certificate route', function (): void {
    $response = api_client()->post('/admin/bookings/completeWashWithoutWashCertificate', [
        'id' => 123,
    ]);

    $response
        ->assertStatus(410)
        ->assertEnvelope()
        ->assertSuccess(false)
        ->assertMessage('Booking completion must be completed through POS desktop or mobile steps.');
});