open-safetylog-ehs/server/routes/incidents.test.ts

import { eq } from 'drizzle-orm'
import { afterAll, beforeAll, describe, expect, it } from 'vitest'
import { auditLog } from '../db/schema.ts'
import { createTestContext, hoursAgo } from '../test/helpers.ts'

let ctx: Awaited<ReturnType<typeof createTestContext>>
let site: { id: string }
let area: { id: string }
let reporter: Awaited<ReturnType<typeof ctx.createUser>>
let supervisor: Awaited<ReturnType<typeof ctx.createUser>>

const report = (overrides: Record<string, unknown> = {}) => ({
  title: 'Forklift reversed into pallet stack',
  type: 'near_miss',
  severity: 'high',
  occurredAt: hoursAgo(2),
  siteId: site.id,
  ...overrides,
})

beforeAll(async () => {
  ctx = await createTestContext()
  site = await ctx.createSite('North Campus')
  area = (await ctx.admin.post(`/api/sites/${site.id}/areas`, { name: 'Loading bay C' })).body.area
  reporter = await ctx.createUser('reporter')
  supervisor = await ctx.createUser('supervisor')
})
afterAll(() => ctx.close())

describe('reporting', () => {
  it('creates an incident with a sequential reference and the reporter recorded', async () => {
    const res = await reporter.post('/api/incidents', report({ areaId: area.id, locationDetail: 'Dock door 3' }))
    expect(res.status).toBe(201)
    expect(res.body.incident).toMatchObject({
      number: 1,
      reference: 'INC-0001',
      status: 'reported',
      site: { id: site.id, name: 'North Campus' },
      area: { id: area.id, name: 'Loading bay C' },
      reporter: { id: reporter.user.id, name: 'reporter user' },
    })
  })

  it('assigns distinct numbers to simultaneous reports', async () => {
    const results = await Promise.all(Array.from({ length: 8 }, (_, i) => reporter.post('/api/incidents', report({ title: `Concurrent ${i}` }))))
    const numbers = results.map((r) => r.body.incident.number)
    expect(new Set(numbers).size).toBe(8)
  })

  it('keeps anonymous reports anonymous', async () => {
    const res = await reporter.post('/api/incidents', report({ title: 'Blocked fire exit', anonymous: true }))
    expect(res.body.incident).toMatchObject({ anonymous: true, reporter: null })
  })

  it('validates location and time', async () => {
    const otherSite = await ctx.createSite('South Campus')
    expect((await reporter.post('/api/incidents', report({ siteId: otherSite.id, areaId: area.id }))).status).toBe(400)
    expect((await reporter.post('/api/incidents', report({ occurredAt: new Date(Date.now() + 86_400_000).toISOString() }))).status).toBe(400)
    expect((await reporter.post('/api/incidents', report({ type: 'explosion' }))).status).toBe(400)
  })

  it('writes an audit entry', async () => {
    const res = await reporter.post('/api/incidents', report({ title: 'Audited' }))
    const entries = await ctx.db.select().from(auditLog).where(eq(auditLog.entityId, res.body.incident.id))
    expect(entries).toHaveLength(1)
    expect(entries[0]).toMatchObject({ action: 'create', actorId: reporter.user.id })
  })
})

describe('visibility', () => {
  it('shows reporters only their own incidents', async () => {
    const other = await ctx.createUser('reporter', 'other-reporter@example.com')
    const mine = await other.post('/api/incidents', report({ title: 'Only mine' }))
    const list = await other.get('/api/incidents')
    expect(list.body.items.map((i: { title: string }) => i.title)).toEqual(['Only mine'])
    expect((await reporter.get(`/api/incidents/${mine.body.incident.number}`)).status).toBe(404)
  })

  it('shows supervisors every incident', async () => {
    const list = await supervisor.get('/api/incidents?pageSize=100')
    expect(list.body.total).toBeGreaterThan(10)
  })
})

describe('listing', () => {
  it('paginates newest first', async () => {
    const page1 = await supervisor.get('/api/incidents?pageSize=3&page=1')
    const page2 = await supervisor.get('/api/incidents?pageSize=3&page=2')
    expect(page1.body.items).toHaveLength(3)
    expect(page1.body.items[0].id).not.toBe(page2.body.items[0].id)
    const times = page1.body.items.map((i: { occurredAt: string }) => i.occurredAt)
    expect([...times].sort().reverse()).toEqual(times)
  })

  it('searches title and reference, treating % and _ literally', async () => {
    await reporter.post('/api/incidents', report({ title: 'Oil leak under press 4', type: 'hazard', severity: 'medium' }))
    expect((await supervisor.get('/api/incidents?q=press')).body.items[0].title).toBe('Oil leak under press 4')
    expect((await supervisor.get('/api/incidents?q=INC-0001')).body.items[0].number).toBe(1)
    expect((await supervisor.get('/api/incidents?q=%25')).body.total).toBe(0)
  })

  it('filters by type, severity and status', async () => {
    const hazards = await supervisor.get('/api/incidents?type=hazard&severity=medium')
    expect(hazards.body.items.every((i: { type: string; severity: string }) => i.type === 'hazard' && i.severity === 'medium')).toBe(true)
    expect((await supervisor.get('/api/incidents?status=closed')).body.total).toBe(0)
    expect((await supervisor.get('/api/incidents?status=bogus')).status).toBe(400)
  })
})

describe('updating', () => {
  it('lets supervisors update and close incidents, recording what changed', async () => {
    const created = await reporter.post('/api/incidents', report({ title: 'Wet floor' }))
    const number = created.body.incident.number
    expect((await reporter.patch(`/api/incidents/${number}`, { status: 'closed' })).status).toBe(403)

    const closed = await supervisor.patch(`/api/incidents/${number}`, { status: 'closed', severity: 'low' })
    expect(closed.status).toBe(200)
    expect(closed.body.incident.status).toBe('closed')
    expect(closed.body.incident.closedAt).not.toBeNull()

    const [entry] = await ctx.db.select().from(auditLog).where(eq(auditLog.action, 'update'))
    expect(entry.changes).toMatchObject({ status: ['reported', 'closed'], severity: ['high', 'low'] })

    const reopened = await supervisor.patch(`/api/incidents/${number}`, { status: 'investigation' })
    expect(reopened.body.incident.closedAt).toBeNull()
  })

  it('clears the area when moving an incident to another site', async () => {
    const created = await reporter.post('/api/incidents', report({ areaId: area.id }))
    const south = await ctx.createSite('West Campus')
    const moved = await supervisor.patch(`/api/incidents/${created.body.incident.number}`, { siteId: south.id })
    expect(moved.body.incident).toMatchObject({ site: { id: south.id }, area: null })
  })
})