base commit

server/src/routes/auth.js

@@ -393,10 +393,15 @@ export async function registerAuthRoutes(fastify) {
       const product = await prisma.product.findFirst({ where: { id: productId, published: true } })
       if (!product) return reply.code(404).send({ error: 'Товар не найден' })
 
+      const available = product.inStock ? product.quantity : 1
+      const existing = await prisma.cartItem.findUnique({ where: { userId_productId: { userId, productId } } })
+      const nextQty = (existing?.qty ?? 0) + Math.floor(qty)
+      if (nextQty > available) return reply.code(409).send({ error: `Доступно: ${available} шт.` })
+
       const item = await prisma.cartItem.upsert({
         where: { userId_productId: { userId, productId } },
-        update: { qty: { increment: Math.floor(qty) } },
-        create: { userId, productId, qty: Math.floor(qty) },
+        update: { qty: nextQty },
+        create: { userId, productId, qty: nextQty },
       })
       return reply.code(201).send({ item })
     },
@@ -412,7 +417,7 @@ export async function registerAuthRoutes(fastify) {
       const qty = Number(qtyRaw)
       if (!Number.isFinite(qty) || qty < 0) return reply.code(400).send({ error: 'qty должен быть ≥ 0' })
 
-      const existing = await prisma.cartItem.findFirst({ where: { id, userId } })
+      const existing = await prisma.cartItem.findFirst({ where: { id, userId }, include: { product: true } })
       if (!existing) return reply.code(404).send({ error: 'Позиция корзины не найдена' })
 
       if (qty === 0) {
@@ -420,7 +425,11 @@ export async function registerAuthRoutes(fastify) {
         return reply.code(204).send()
       }
 
-      const updated = await prisma.cartItem.update({ where: { id }, data: { qty: Math.floor(qty) } })
+      const available = existing.product.inStock ? existing.product.quantity : 1
+      const nextQty = Math.floor(qty)
+      if (nextQty > available) return reply.code(409).send({ error: `Доступно: ${available} шт.` })
+
+      const updated = await prisma.cartItem.update({ where: { id }, data: { qty: nextQty } })
       return { item: updated }
     },
   )
@@ -460,6 +469,13 @@ export async function registerAuthRoutes(fastify) {
       })
       if (cartItems.length === 0) return reply.code(400).send({ error: 'Корзина пуста' })
 
+      for (const ci of cartItems) {
+        const available = ci.product.inStock ? ci.product.quantity : 1
+        if (ci.qty > available) {
+          return reply.code(409).send({ error: `Недостаточно товара: "${ci.product.title}". Доступно: ${available} шт.` })
+        }
+      }
+
       const itemsPayload = cartItems.map((ci) => ({
         productId: ci.productId,
         qty: ci.qty,
@@ -479,28 +495,50 @@ export async function registerAuthRoutes(fastify) {
         lng: address.lng,
       })
 
-      const created = await prisma.$transaction(async (tx) => {
-        const order = await tx.order.create({
-          data: {
-            userId,
-            status: 'PENDING_PAYMENT',
-            totalCents,
-            currency: 'RUB',
-            addressSnapshotJson,
-            comment: comment && comment.length ? comment : null,
-            items: {
-              create: itemsPayload.map((i) => ({
-                productId: i.productId,
-                qty: i.qty,
-                titleSnapshot: i.titleSnapshot,
-                priceCentsSnapshot: i.priceCentsSnapshot,
-              })),
+      let created
+      try {
+        created = await prisma.$transaction(async (tx) => {
+          for (const ci of cartItems) {
+            if (!ci.product.inStock) continue
+
+            const res = await tx.product.updateMany({
+              where: { id: ci.productId, quantity: { gte: ci.qty } },
+              data: { quantity: { decrement: ci.qty } },
+            })
+            if (res.count !== 1) {
+              throw new Error(`Недостаточно товара: "${ci.product.title}"`)
+            }
+
+            const p = await tx.product.findUnique({ where: { id: ci.productId }, select: { quantity: true } })
+            if (p && p.quantity === 0) {
+              await tx.product.update({ where: { id: ci.productId }, data: { published: false } })
+            }
+          }
+
+          const order = await tx.order.create({
+            data: {
+              userId,
+              status: 'PENDING_PAYMENT',
+              totalCents,
+              currency: 'RUB',
+              addressSnapshotJson,
+              comment: comment && comment.length ? comment : null,
+              items: {
+                create: itemsPayload.map((i) => ({
+                  productId: i.productId,
+                  qty: i.qty,
+                  titleSnapshot: i.titleSnapshot,
+                  priceCentsSnapshot: i.priceCentsSnapshot,
+                })),
+              },
             },
-          },
+          })
+          await tx.cartItem.deleteMany({ where: { userId } })
+          return order
         })
-        await tx.cartItem.deleteMany({ where: { userId } })
-        return order
-      })
+      } catch (e) {
+        return reply.code(409).send({ error: (e instanceof Error && e.message) || 'Недостаточно товара' })
+      }
 
       return reply.code(201).send({ orderId: created.id })
     },