Restrict order quantity edits to pending orders

Reviewed-on: #12

CONTRIBUTING.md

@@ -28,7 +28,6 @@ bun run dev:web
 Common checks:
 
 ```bash
-bun run check
 bun run test
 bun run build:web
 ```

apps/api/src/orders/order-quantity-assignment-3.test.ts

@@ -0,0 +1,91 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import type { AppWithContext } from "../app";
+import { buildApp } from "../app";
+import { createUser } from "../users/user-repository";
+
+let app: AppWithContext;
+let employeeCookie = "";
+
+function firstHeader(value: string | string[] | undefined) {
+  return Array.isArray(value) ? value[0] : value ?? "";
+}
+
+async function login(username: string) {
+  const response = await app.inject({ method: "POST", url: "/api/login", payload: { username } });
+  return firstHeader(response.headers["set-cookie"]);
+}
+
+beforeEach(async () => {
+  app = await buildApp(":memory:");
+
+  await createUser(app.dbContext, {
+    username: "dev-employee",
+    name: "Dev Employee",
+    email: "dev.employee@example.com",
+    role: "employee"
+  });
+
+  employeeCookie = await login("dev-employee");
+});
+
+afterEach(async () => {
+  await app.close();
+});
+
+describe("assignment 3 quantity validation", () => {
+  test("allows quantity changes for pending orders", async () => {
+    const response = await app.inject({
+      method: "POST",
+      url: "/api/orders/order_1/items/item_1/quantity",
+      headers: { cookie: employeeCookie },
+      payload: { quantity: 5 }
+    });
+
+    expect(response.statusCode).toBe(200);
+    expect(response.json().items.find((item: { id: string }) => item.id === "item_1")?.quantity).toBe(5);
+  });
+
+  test("rejects quantity changes for processing orders", async () => {
+    const response = await app.inject({
+      method: "POST",
+      url: "/api/orders/order_2/items/item_3/quantity",
+      headers: { cookie: employeeCookie },
+      payload: { quantity: 2 }
+    });
+
+    expect(response.statusCode).toBe(400);
+  });
+
+  test("rejects quantity changes for shipped orders", async () => {
+    const response = await app.inject({
+      method: "POST",
+      url: "/api/orders/order_3/items/item_4/quantity",
+      headers: { cookie: employeeCookie },
+      payload: { quantity: 1 }
+    });
+
+    expect(response.statusCode).toBe(400);
+  });
+
+  test("rejects quantity outside the allowed range", async () => {
+    const response = await app.inject({
+      method: "POST",
+      url: "/api/orders/order_1/items/item_1/quantity",
+      headers: { cookie: employeeCookie },
+      payload: { quantity: 0 }
+    });
+
+    expect(response.statusCode).toBe(400);
+  });
+
+  test("rejects quantity above effective inventory", async () => {
+    const response = await app.inject({
+      method: "POST",
+      url: "/api/orders/order_1/items/item_1/quantity",
+      headers: { cookie: employeeCookie },
+      payload: { quantity: 9 }
+    });
+
+    expect(response.statusCode).toBe(400);
+  });
+});

apps/api/src/orders/order-status.ts

@@ -1,8 +1,6 @@
 import type { OrderStatus } from "@orderops/shared/order-status";
 
-export function canEditOrderItems(status: OrderStatus) {
-  return status === "pending" || status === "processing";
-}
+export { canEditOrderItems } from "@orderops/shared/order-status";
 
 export function canEditShippingAddress(status: OrderStatus) {
   return status === "pending" || status === "processing";

apps/web/src/orders/order-items-panel.tsx

@@ -1,5 +1,6 @@
 import { useState } from "react";
 import type { OrderDetail } from "@orderops/shared";
+import { canEditOrderItems } from "@orderops/shared/order-status";
 
 interface OrderItemsPanelProps {
   order: OrderDetail;
@@ -39,9 +40,14 @@ function QuantityForm({
 }
 
 export function OrderItemsPanel({ order, onUpdateQuantity }: OrderItemsPanelProps) {
+  const canEditQuantity = canEditOrderItems(order.status);
+
   return (
     <section className="rounded-xl border border-slate-200 bg-white p-4 shadow-sm">
       <h3 className="mb-3 text-sm font-semibold text-slate-700">Items</h3>
+      {!canEditQuantity ? (
+        <p className="mb-3 text-sm text-slate-600">Item quantities can only be changed while an order is pending.</p>
+      ) : null}
       <div className="space-y-3">
         {order.items.map((item) => (
           <div key={item.id} className="rounded-lg border border-slate-200 p-3">
@@ -51,7 +57,11 @@ export function OrderItemsPanel({ order, onUpdateQuantity }: OrderItemsPanelProp
                 <div className="text-sm text-slate-600">{item.sku}</div>
                 <div className="text-sm text-slate-500">Available: {item.availableQuantity}</div>
               </div>
-              <QuantityForm itemId={item.id} quantity={item.quantity} onSave={onUpdateQuantity} />
+              {canEditQuantity ? (
+                <QuantityForm itemId={item.id} quantity={item.quantity} onSave={onUpdateQuantity} />
+              ) : (
+                <div className="text-sm text-slate-700">Quantity: {item.quantity}</div>
+              )}
             </div>
           </div>
         ))}

packages/shared/src/order-status.ts

@@ -1,3 +1,7 @@
 export const orderStatuses = ["pending", "processing", "shipped", "cancelled", "refunded"] as const;
 
 export type OrderStatus = (typeof orderStatuses)[number];
+
+export function canEditOrderItems(status: OrderStatus) {
+  return status === "pending";
+}