diff --git a/apps/api/src/orders/order-notes-assignment-2.test.ts b/apps/api/src/orders/order-notes-assignment-2.test.ts
new file mode 100644
index 0000000..f74b795
--- /dev/null
+++ b/apps/api/src/orders/order-notes-assignment-2.test.ts
@@ -0,0 +1,106 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import type { AppWithContext } from "../app";
+import { buildApp } from "../app";
+import { createUser } from "../users/user-repository";
+
+let app: AppWithContext;
+let employeeCookie = "";
+let customerCookie = "";
+
+function firstHeader(value: string | string[] | undefined): string {
+  return Array.isArray(value) ? value[0] ?? "" : value ?? "";
+}
+
+async function login(username: string) {
+  const response = await app.inject({ method: "POST", url: "/api/login", payload: { username } });
+  return firstHeader(response.headers["set-cookie"]);
+}
+
+beforeEach(async () => {
+  app = await buildApp(":memory:");
+
+  await createUser(app.dbContext, {
+    username: "dev-employee",
+    name: "Dev Employee",
+    email: "dev.employee@example.com",
+    role: "employee"
+  });
+
+  employeeCookie = await login("dev-employee");
+  customerCookie = await login("john-smith");
+});
+
+afterEach(async () => {
+  await app.close();
+});
+
+describe("assignment 2 internal order notes", () => {
+  test("allows employee users to attach notes to an order", async () => {
+    const response = await app.inject({
+      method: "POST",
+      url: "/api/orders/order_1/notes",
+      headers: { cookie: employeeCookie },
+      payload: { notes: "Follow up with warehouse before shipping." }
+    });
+
+    const order = response.json();
+
+    expect(response.statusCode).toBe(200);
+    expect(order.orderNumber).toBe("ORD-1001");
+    expect(order.notes).toBe("Follow up with warehouse before shipping.");
+    expect(order.items).toHaveLength(2);
+  });
+
+  test("returns persisted notes when the order is viewed later", async () => {
+    const updateResponse = await app.inject({
+      method: "POST",
+      url: "/api/orders/order_1/notes",
+      headers: { cookie: employeeCookie },
+      payload: { notes: "Customer requested gift receipt." }
+    });
+
+    expect(updateResponse.statusCode).toBe(200);
+
+    const detailResponse = await app.inject({
+      method: "GET",
+      url: "/api/orders/order_1",
+      headers: { cookie: employeeCookie }
+    });
+
+    expect(detailResponse.statusCode).toBe(200);
+    expect(detailResponse.json().notes).toBe("Customer requested gift receipt.");
+  });
+
+  test("rejects customer users when attaching notes", async () => {
+    const response = await app.inject({
+      method: "POST",
+      url: "/api/orders/order_1/notes",
+      headers: { cookie: customerCookie },
+      payload: { notes: "Customer should not be able to add this." }
+    });
+
+    expect(response.statusCode).toBe(403);
+  });
+
+  test("rejects empty notes", async () => {
+    const response = await app.inject({
+      method: "POST",
+      url: "/api/orders/order_1/notes",
+      headers: { cookie: employeeCookie },
+      payload: { notes: "   " }
+    });
+
+    expect(response.statusCode).toBe(400);
+  });
+
+  test("rejects notes beyond the accepted length limit", async () => {
+    const response = await app.inject({
+      method: "POST",
+      url: "/api/orders/order_1/notes",
+      headers: { cookie: employeeCookie },
+      payload: { notes: "x".repeat(1001) }
+    });
+
+    expect(response.statusCode).toBe(400);
+  });
+});