x

apps/backend/src/routes/settings.footer-layout-route.test.ts

@@ -0,0 +1,36 @@
+import { describe, expect, test } from 'bun:test'
+import { settingsRoute } from './settings'
+
+function jsonRequest(path: string, method: string, body: unknown) {
+  return new Request(`http://localhost${path}`, {
+    method,
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify(body),
+  })
+}
+
+describe('footer layout route boundaries', () => {
+  for (const method of ['PUT', 'POST']) {
+    test(`${method} /settings rejects footerLayout writes`, async () => {
+      const response = await settingsRoute.handle(jsonRequest('/settings', method, {
+        footerLayout: { columns: ['brand'] },
+      }))
+
+      expect(response.status).toBe(400)
+      expect(await response.json()).toEqual({
+        error: 'Use PATCH /settings/footer-layout to update footer layout',
+      })
+    })
+  }
+
+  test('PATCH /settings/footer-layout requires admin authentication', async () => {
+    const response = await settingsRoute.handle(jsonRequest('/settings/footer-layout', 'PATCH', {
+      dryRun: true,
+    }))
+
+    expect(response.status).toBe(401)
+    expect(await response.json()).toEqual({
+      error: 'Unauthorized: Missing or invalid token format',
+    })
+  })
+})