edr-platform/integration/README.md

# Freight API integration suite

Headless, API-level tests for the freight API running against the **real**
`edr-payment-api`. Only the bank/wallet gateways are stubbed.

```
pnpm it:up      # build + start the stack (first run ~5 min)
pnpm it:test    # vitest run (auto-ups the stack if needed)
pnpm it:test -- --reporter=basic src/payment-happy.it.ts
pnpm it:logs payment-api-it
pnpm it:down    # -v, wipes the throwaway DB
```

## Stack

`docker-compose.it.yaml` is an **overlay** on `docker-compose.e2e.yaml` — same
freight API, Postgres (tmpfs), MinIO, Fayda/eTrade mocks; plus RabbitMQ, the
real payment API, and one gateway mock. It is a separate compose project
(`edr-freight-it`) on offset ports, so the Cypress e2e stack can run alongside.

```
freight-api-e2e :3111 ──HTTP──> payment-api-it :3113 ──HTTP──> gateway-mock-it :4600
        ^                              │
        └────────── RabbitMQ :5772 ─────┘   (outbox → payment.events → consumer)
```

Never `docker compose -f docker-compose.it.yaml` on its own — it needs the base
file first. Use `it.mjs`.

## Gateway mock

`gateway-mock/server.js` — one zero-dep `node:http` process serving every
provider under a path prefix, plus a control plane the tests drive:

| call | effect |
| --- | --- |
| `POST /__control/provider/:name` `{mode, times}` | `ok` / `fail` / `timeout` / `pending` / `paid` |
| `POST /__control/webhook` `{merchantOrderId, status, eventId, signature}` | fires a **correctly signed** callback at the payment API |
| `POST /__control/settle` `{merchantOrderId}` | pays at the bank with no callback (reconciliation path) |
| `GET /__control/calls` | every inbound provider call |
| `POST /__control/reset` | clear modes, orders and calls |

Signatures are real: the mock shares `CBE_SECRET_KEY` with the API, so
`verifyWebhookSignature` runs for real and `signature: "bad"` is a genuine
negative test. The suite drives **CBE Birr** end to end (plain HMAC, no key
material); other providers answer a generic stub until a scenario needs them.

Editing `server.js` needs a container restart (`docker compose … restart
gateway-mock-it`) — the code is a read-only mount, not baked into an image.

## Files

| file | covers |
| --- | --- |
| `src/payment-happy.it.ts` | initiate → webhook → outbox → broker → invoice PAID → booking advances |
| `src/payment-failure.it.ts` | provider down, decline, forged signature, reconciliation sweep, `unverifiable`, late capture |
| `src/concurrency.it.ts` | duplicate callbacks, two intents on one invoice, wagon budget, pay-window gate |
| `src/authz.it.ts` | cross-tenant isolation, login audience, service-token gates |
| `src/cbe-bill.it.ts` | inbound CBE Unified Bill: token → query (hops into freight) → payment |
| `src/bulk-import-full-train.it.ts` | six wheat bookings fill 54 wagons, then gate pass → T1 → dispatch → corridor → arrival → customs tail |
| `src/bulk-import-waiting-expiry.it.ts` | exact-fill trio selected, waiting three expire with the day |
| `src/bulk-import-split-promote.it.ts` | partial offer, split on settlement, expiry promotion, exact-remainder rebooking |
| `src/bulk-import-window-reopen.it.ts` | nobody pays → cycle 2 opens on the same train |
| `src/bulk-import-matrix.it.ts` | no-window day, sub-corridor, ride-along, whole-train giant |
| `src/bulk-export-full-train.it.ts` | FCFS accept = reservation, deadlines clamped to window close, export tail |
| `src/bulk-export-fcfs-space.it.ts` | reservations hold capacity, whole-or-nothing giant |
| `src/bulk-export-pay-or-lose.it.ts` | expiry frees space; window close expires the unpaid, no reopen |
| `src/bulk-export-matrix.it.ts` | mid-route boarding, leg occupancy, ride-along, sibling train windows |
| `src/bulk-b1-priority-expiry-refill.it.ts` | rule-engine priority band, expiry refill |
| `src/bulk-b2-per-item-floor.it.ts` | PER_ITEM wagon floor vs tonnage math |
| `src/bulk-b3-per-item-giant.it.ts` | PER_ITEM giant + line quantities (pins two defects) |
| `src/g1-s1-expiry-promotes-waitlist.it.ts` | 53-wagon built train: expiry frees exactly the waiting list's space |
| `src/g1-s2-exact-fill.it.ts` | exact 53/53 fill, every one of 68 containers mapped to a slot |
| `src/g1-s3-underfill-day-open.it.ts` | 28/53 is NOT FULL — the day still offers 25 wagons |
| `src/g1-s4-split-closes-gap.it.ts` | container split closes the last 3-wagon gap, 14-box remainder |
| `src/g1-s5-cascading-expiry.it.ts` | one settle promotes twice; expiries terminal, invoices closed |
| `src/g1-s6-s8-offers-government-tiers.it.ts` | ignored offer, government preemption, USD/customs/plain tiers |
| `src/flows.ts` | freight business steps, ported from `e2e/freight/cypress/e2e/flows/import-utils.ts` |

## Findings pinned by these tests

Where the platform's live behaviour differs from the scenario, the test asserts
what it actually does and says so in a comment, so a fix fails loudly:

- **Refill never supersedes an open partial offer** (`bulk-b1`, `g1-s5`). After
  the giant expires and frees 28 wagons, the offered booking is re-selected but
  keeps its stale 16-wagon offer; `applySplit` applies it, so the customer ships
  16 of 20 with room to spare. `g1-s5` pins the container half: an expiry frees
  8 more wagons and the 2-wagon offer beside them is never resized.
- **PER_ITEM bookings never get a partial offer** (`bulk-b3`). `sizeOffer` sizes
  bulk offers by weight off `cargoTotalWeightVgm`, which for PER_ITEM holds the
  ITEM COUNT — a 240-auto booking needing 60 wagons looks like 4, gets no offer,
  allocates nothing, and expires with the day.
- **The contract booking path drops bulk `hazardousQuantity` / `reeferQuantity`**
  (`bulk-b3`). Only `POST /api/bookings` maps and clamps them.
- **Paid intercity ride-alongs are unpinned back to the pool** (both matrices) —
  staff must place them again. The Cypress twin never sees this because its
  staff mark-paid shortcut leaves the reservation pinned.
- **Bulk priority is recomputed at doc-review** (`bulk-b1`), so writing
  `priority_score` directly is a no-op; ranking has to come from a WAGON
  priority config.
- **Freight sends a dev-shortcut amount** (1 minor unit, 10 for CAC) for every
  non-`CBE_BILL` provider, with no short-payment guard.
- **Government preemption cannot reach a FULL train** (`g1-s6-s8`). `isFillable`
  rejects a schedule whose `booking_window_status` is FULL before any budget or
  victim is considered, and `refreshWindowStatus` re-derives that flag from live
  capacity — so a genuinely full train is skipped and no commercial booking is
  ever displaced. S7 therefore commits 52 of 53 slots.
- **The CUSTOMS priority band is dead in the shipped fixture.** It applies only
  when the booking's SERVICE TYPE has `includes_customs`, and the corridor seed
  ships one service type that does not — so the two CUSTOMS bands never score.
  `seed-customs-service-type.sql` adds `RAIL_CUSTOMS` so the tier can be tested.
- **A customs SERVICE TYPE without a customs CONTRACT cannot finalize
  clearance.** `finalizeClearance` looks up `clearance_output_<op>_<freight>`,
  which the seeder deliberately leaves commented out, so `getByCode` 404s. Only
  the phased path (`customs_clearing_enabled` on the contract) avoids it — which
  is why S8's customs tenant is Path B.

## Gotchas

- **One unpaid hold per company.** `assertNoUnpaidHold` blocks a company with a
  `SELECTED_FOR_BATCH` booking from creating another. Every file starts with
  `releaseUnpaidHolds()`, which also hard-deletes retired
  `train_schedule_bookings` rows (`booking_id` is UNIQUE and the constraint
  ignores `deleted_at`, so a soft-unlinked booking can never be re-batched).
- **Arrange is slow.** Contract → booking → clearance → ops accept → batch is
  30–60s of real API work per booking, so files share one schedule day.
- Files run sequentially (one DB); concurrency is exercised inside a test with
  `Promise.all`.
- **A retired fixture keeps its shipment day at its peril.**
  `rescueStrandedPaidForDay` sweeps every unlinked booking whose
  `payment_status` is PAID and whose `scheduled_date` falls on the day being
  filled, and re-places it on the fresh train. A previous run's paid bookings
  therefore climb back aboard — 18 stowaway wagons on a 28-wagon day, until
  `releaseUnpaidHolds` / `resetCorridorDay` started nulling `scheduled_date`.
- **Only a FULL train rests at DONE.** An under-filled day CONCLUDES and
  REOPENS (`window_phase` back to OPEN, `booking_cycle_no` 2), so waiting for
  DONE there waits forever — use `pollCycleConcluded`.
- **Wagon stock is finite and shared.** Paid bookings keep their wagons, so
  `releaseUnpaidHolds()` also frees every earlier `CTR-IT-%` allocation —
  without it the fifth or sixth file on a warm stack silently gets a short
  consist.
- **One tenant per booking.** `seedTenantContracts` mints a company per booking
  because a company may hold only one unpaid reservation at a time; staff book
  and pay on their behalf, which is also the real Path B flow.
- **Group 1 rides a BUILT train, not a loco pair.** `maxWagonsPerTrain` is not a
  cap: `syncScheduleMaxWagons` recomputes it from locomotive length (54 here)
  every fill pass. A built train's coupled consist wins outright, so
  `seed-g1-train.sql`'s 53 wagons ARE the capacity — the number every G1
  scenario's arithmetic is written in. `createBuiltTrainSchedule` asserts it.
- **Customs bookings walk the phased chain** (`clearBookingPhasedCustoms`):
  transit assignee → declaration draft → accept → declaration → duty →
  transit permit → pre-clearance → delivery order. `clearance/finalize` refuses
  them outright.
- Freight sends a dev-shortcut amount (1 minor unit, 10 for CAC) for every
  non-`CBE_BILL` provider. The tests assert that as-is.