Adding all the tests and fixes to the passengers app

e2e-ui/specs/guest/search.smoke.spec.ts

@@ -0,0 +1,24 @@
+import { test, expect } from "@playwright/test";
+import { resultsUrl, SCHEDULE_ID } from "../../fixtures/data";
+
+/**
+ * Portal smoke (Track A foundation): deep-link to results → POST /search fires → a priced result
+ * card for the seeded trip renders. Proves stack + seed + search + currency formatting are wired.
+ */
+test("portal: seeded trip appears in search results with a price", async ({ page }) => {
+  const searchResponse = page.waitForResponse(
+    (r) => r.url().includes("/search") && r.request().method() === "POST",
+  );
+
+  await page.goto(resultsUrl());
+
+  const res = await searchResponse;
+  expect([200, 201]).toContain(res.status());
+  const body = await res.json();
+  const outbound = body?.data?.outbound ?? [];
+  expect(outbound.some((t: any) => t.scheduleId === SCHEDULE_ID)).toBe(true);
+
+  // The seeded train + a formatted ETB price render in the DOM.
+  await expect(page.getByText("UI Test Express").first()).toBeVisible({ timeout: 20_000 });
+  await expect(page.getByText(/ETB\s*[\d,]+/).first()).toBeVisible();
+});

e2e-ui/specs/guest/ua14-forged-seat-fare.spec.ts

@@ -0,0 +1,37 @@
+import { test, expect } from "@playwright/test";
+import { PrismaClient } from "@prisma/client";
+import { bookTrip } from "../../fixtures/booking-flow";
+
+const prisma = new PrismaClient();
+test.afterAll(async () => {
+  await prisma.$disconnect();
+});
+
+/**
+ * UA-14 ✅ — a GUEST (unauthenticated) booking with forged per-passenger seat fares (ISSUES C-1),
+ * guarded. We intercept POST /bookings/guest and rewrite every seatFareMinor (and reviewedTotalMinor)
+ * to 0. The server must recompute the authoritative fare and REJECT the underpayment with a 4xx —
+ * no free ride, nothing persisted.
+ */
+test("UA-14: server rejects a guest booking with forged seatFareMinor=0 (C-1)", async ({ page }) => {
+  const r = await bookTrip(page, {
+    paymentMethod: "WALLET",
+    tolerateBookingError: true,
+    mutateBookingBody: (body) => ({
+      ...body,
+      reviewedTotalMinor: 0,
+      passengers: (body.passengers ?? []).map((p: any) => ({ ...p, seatFareMinor: 0 })),
+    }),
+  });
+
+  expect(r.guest).toBe(true); // proves the /bookings/guest path was used
+  expect(r.cardBaseFareMinor).toBeGreaterThan(1000);
+
+  // The server must REFUSE the forged 0-fare booking with a 4xx…
+  expect(r.bookingStatus).toBeGreaterThanOrEqual(400);
+  expect(r.bookingStatus).toBeLessThan(500);
+  // …return no booking id and persist no free (0-minor) booking.
+  expect(r.bookingId).toBeFalsy();
+  const forged = await prisma.booking.findFirst({ where: { totalMinor: 0 } });
+  expect(forged).toBeNull();
+});