mirror of
https://github.com/Tria-plc/edr-platform.git
synced 2026-08-26 18:42:49 +00:00
38 lines
1.5 KiB
TypeScript
38 lines
1.5 KiB
TypeScript
import { test, expect } from "@playwright/test";
|
|
import { PrismaClient } from "@prisma/client";
|
|
import { bookTrip } from "../../fixtures/booking-flow";
|
|
|
|
const prisma = new PrismaClient();
|
|
test.afterAll(async () => {
|
|
await prisma.$disconnect();
|
|
});
|
|
|
|
/**
|
|
* UA-14 ✅ — a GUEST (unauthenticated) booking with forged per-passenger seat fares (ISSUES C-1),
|
|
* guarded. We intercept POST /bookings/guest and rewrite every seatFareMinor (and reviewedTotalMinor)
|
|
* to 0. The server must recompute the authoritative fare and REJECT the underpayment with a 4xx —
|
|
* no free ride, nothing persisted.
|
|
*/
|
|
test("UA-14: server rejects a guest booking with forged seatFareMinor=0 (C-1)", async ({ page }) => {
|
|
const r = await bookTrip(page, {
|
|
paymentMethod: "WALLET",
|
|
tolerateBookingError: true,
|
|
mutateBookingBody: (body) => ({
|
|
...body,
|
|
reviewedTotalMinor: 0,
|
|
passengers: (body.passengers ?? []).map((p: any) => ({ ...p, seatFareMinor: 0 })),
|
|
}),
|
|
});
|
|
|
|
expect(r.guest).toBe(true); // proves the /bookings/guest path was used
|
|
expect(r.cardBaseFareMinor).toBeGreaterThan(1000);
|
|
|
|
// The server must REFUSE the forged 0-fare booking with a 4xx…
|
|
expect(r.bookingStatus).toBeGreaterThanOrEqual(400);
|
|
expect(r.bookingStatus).toBeLessThan(500);
|
|
// …return no booking id and persist no free (0-minor) booking.
|
|
expect(r.bookingId).toBeFalsy();
|
|
const forged = await prisma.booking.findFirst({ where: { totalMinor: 0 } });
|
|
expect(forged).toBeNull();
|
|
});
|