Merge branch 'refactor2'

server/package.json

@@ -13,7 +13,9 @@
     "db:seed:test": "node --env-file=.dev_env prisma/seed.js",
     "db:reset:test": "node --env-file=.dev_env ./node_modules/prisma/build/index.js migrate reset --force",
     "db:studio": "prisma studio",
-    "db:studio:test": "node --env-file=.dev_env ./node_modules/prisma/build/index.js studio"
+    "db:studio:test": "node --env-file=.dev_env ./node_modules/prisma/build/index.js studio",
+    "test": "vitest run",
+    "test:watch": "vitest"
   },
   "prisma": {
     "seed": "node prisma/seed.js"
@@ -29,6 +31,7 @@
     "nodemailer": "^8.0.7"
   },
   "devDependencies": {
-    "prisma": "5.22.0"
+    "prisma": "5.22.0",
+    "vitest": "^3.2.4"
   }
 }

server/src/lib/__tests__/escape-html.test.js

@@ -0,0 +1,23 @@
+import { describe, expect, it } from 'vitest'
+import { escapeHtml } from '../escape-html.js'
+
+describe('escapeHtml', () => {
+  it('escapes & < > "', () => {
+    expect(escapeHtml('&<>"')).toBe('&amp;&lt;&gt;&quot;')
+  })
+
+  it('returns empty string for null/undefined', () => {
+    expect(escapeHtml(null)).toBe('')
+    expect(escapeHtml(undefined)).toBe('')
+  })
+
+  it('passes safe text through', () => {
+    expect(escapeHtml('hello world')).toBe('hello world')
+  })
+
+  it('escapes mixed content', () => {
+    expect(escapeHtml('<script>alert("xss")</script>')).toBe(
+      '&lt;script&gt;alert(&quot;xss&quot;)&lt;/script&gt;',
+    )
+  })
+})

server/src/lib/__tests__/order-status.test.js

@@ -0,0 +1,44 @@
+import { describe, expect, it } from 'vitest'
+import { canTransitionAdminOrderStatus } from '../order-status.js'
+
+describe('canTransitionAdminOrderStatus', () => {
+  const delivery = { deliveryType: 'delivery' }
+  const pickup = { deliveryType: 'pickup' }
+
+  it('DRAFT → PENDING_PAYMENT', () => {
+    expect(canTransitionAdminOrderStatus({ status: 'DRAFT', ...delivery }, 'PENDING_PAYMENT')).toBe(true)
+  })
+
+  it('DRAFT → CANCELLED', () => {
+    expect(canTransitionAdminOrderStatus({ status: 'DRAFT', ...delivery }, 'CANCELLED')).toBe(true)
+  })
+
+  it('DRAFT cannot skip to PAID', () => {
+    expect(canTransitionAdminOrderStatus({ status: 'DRAFT', ...delivery }, 'PAID')).toBe(false)
+  })
+
+  it('PAID → IN_PROGRESS', () => {
+    expect(canTransitionAdminOrderStatus({ status: 'PAID', ...delivery }, 'IN_PROGRESS')).toBe(true)
+  })
+
+  it('IN_PROGRESS (delivery) → SHIPPED', () => {
+    expect(canTransitionAdminOrderStatus({ status: 'IN_PROGRESS', ...delivery }, 'SHIPPED')).toBe(true)
+  })
+
+  it('IN_PROGRESS (pickup) → READY_FOR_PICKUP', () => {
+    expect(canTransitionAdminOrderStatus({ status: 'IN_PROGRESS', ...pickup }, 'READY_FOR_PICKUP')).toBe(true)
+  })
+
+  it('IN_PROGRESS (delivery) cannot go to READY_FOR_PICKUP', () => {
+    expect(canTransitionAdminOrderStatus({ status: 'IN_PROGRESS', ...delivery }, 'READY_FOR_PICKUP')).toBe(false)
+  })
+
+  it('DONE allows no transitions', () => {
+    expect(canTransitionAdminOrderStatus({ status: 'DONE', ...delivery }, 'CANCELLED')).toBe(false)
+    expect(canTransitionAdminOrderStatus({ status: 'DONE', ...delivery }, 'PAID')).toBe(false)
+  })
+
+  it('same status returns true', () => {
+    expect(canTransitionAdminOrderStatus({ status: 'DRAFT', ...delivery }, 'DRAFT')).toBe(true)
+  })
+})

server/vitest.config.ts

@@ -0,0 +1,7 @@
+import { defineConfig } from 'vitest/config'
+
+export default defineConfig({
+  test: {
+    globals: true,
+  },
+})