Back-End II — Endpoints de leitura e escrita

import { Router } from 'express';
import { UserController } from '../controllers/UserController';
import { asyncHandler } from '../helpers/asyncHandler';

const router = Router();
const ctrl = new UserController();

router.get('/',        asyncHandler(ctrl.list));
router.get('/:id',     asyncHandler(ctrl.show));
router.post('/',       asyncHandler(ctrl.create));
router.put('/:id',     asyncHandler(ctrl.replace));
router.patch('/:id',   asyncHandler(ctrl.update));
router.delete('/:id',  asyncHandler(ctrl.remove));

export default router;

import { Router } from 'express';
import userRoutes    from './userRoutes';
import orderRoutes   from './orderRoutes';
import productRoutes from './productRoutes';

const api = Router();
api.use('/users',    userRoutes);
api.use('/orders',   orderRoutes);
api.use('/products', productRoutes);

export default api;

import express from 'express';
import api from './routes';
import { errorHandler } from './middlewares/errorHandler';

const app = express();
app.use(express.json());
app.use('/api', api);
app.use(errorHandler); // SEMPRE por último

export default app;

create = async (req: Request, res: Response): Promise<void> => {
  const input = createUserSchema.parse(req.body);
  const user  = await this.userService.create(input);
  res
    .status(201)
    .location(`/api/users/${user.id}`)
    .json(user);
};

import { z } from 'zod';

export const createUserSchema = z.object({
  email: z.string().email('email inválido'),
  name:  z.string().min(2, 'nome muito curto'),
  age:   z.number().int().positive().optional()
});

// Para PATCH: todos os campos opcionais
export const updateUserSchema = createUserSchema.partial();

// O TIPO sai inferido — uma fonte da verdade
export type CreateUserInput = z.infer<typeof createUserSchema>;
export type UpdateUserInput = z.infer<typeof updateUserSchema>;

create = async (req: Request, res: Response) => {
  const parsed = createUserSchema.safeParse(req.body);
  if (!parsed.success) {
    throw new ValidationError(
      parsed.error.issues.map(i => `${i.path.join('.')}: ${i.message}`).join('; ')
    );
  }
  const user = await this.userService.create(parsed.data);
  res.status(201).location(`/api/users/${user.id}`).json(user);
};

// Helpers puros — entrada → saída, nada mais

const EMAIL_RX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;

export function validateEmail(email: string): boolean {
  return EMAIL_RX.test(email);
}

export function parsePositiveInt(raw: string | undefined): number | null {
  if (!raw) return null;
  const n = Number(raw);
  if (!Number.isInteger(n) || n <= 0) return null;
  return n;
}

export function slugify(input: string): string {
  return input
    .toLowerCase()
    .normalize('NFD')
    .replace(/[\u0300-\u036f]/g, '')
    .replace(/[^a-z0-9]+/g, '-')
    .replace(/^-+|-+$/g, '');
}

import { parsePositiveInt, validateEmail } from '../../src/helpers/validation';

describe('parsePositiveInt', () => {
  it('aceita inteiro positivo',    () => expect(parsePositiveInt('42')).toBe(42));
  it('rejeita zero',                () => expect(parsePositiveInt('0')).toBeNull());
  it('rejeita negativo',            () => expect(parsePositiveInt('-1')).toBeNull());
  it('rejeita não-numérico',        () => expect(parsePositiveInt('abc')).toBeNull());
  it('rejeita undefined',           () => expect(parsePositiveInt(undefined)).toBeNull());
});

import { OrderRepository }   from '../repositories/OrderRepository';
import { ProductRepository } from '../repositories/ProductRepository';
import { NotFoundError, ValidationError } from '../errors/AppError';
import type { Order, CreateOrderInput } from '../models/order';

export class OrderService {
  constructor(
    private orders:   OrderRepository,
    private products: ProductRepository
  ) {}

  async create(input: CreateOrderInput): Promise<Order> {
    // 1. valida estoque para cada item
    let total = 0;
    for (const it of input.items) {
      const p = await this.products.findById(it.productId);
      if (!p) throw new NotFoundError(`produto ${it.productId}`);
      if (p.stock < it.quantity) {
        throw new ValidationError(
          `estoque insuficiente para ${p.name}`
        );
      }
      total += p.price * it.quantity;
    }

    // 2. delega persistência atômica ao repository
    return this.orders.createWithItems({ ...input, total });
  }
}

import { pool } from '../db/pool';
import type { Order, CreateOrderInput } from '../models/order';

export class OrderRepository {

  async findById(id: number): Promise<Order | null> {
    const { rows } = await pool.query<Order>(
      'SELECT * FROM orders WHERE id = $1', [id]
    );
    return rows[0] ?? null;
  }

  async createWithItems(input: CreateOrderInput & { total: number }): Promise<Order> {
    const client = await pool.connect();
    try {
      await client.query('BEGIN');

      const orderRes = await client.query<Order>(
        `INSERT INTO orders(user_id, total)
         VALUES ($1, $2) RETURNING *`,
        [input.userId, input.total]
      );
      const order = orderRes.rows[0];

      for (const it of input.items) {
        await client.query(
          `INSERT INTO order_items(order_id, product_id, qty)
           VALUES ($1, $2, $3)`,
          [order.id, it.productId, it.quantity]
        );
      }

      await client.query('COMMIT');
      return order;
    } catch (e) {
      await client.query('ROLLBACK');
      throw e;
    } finally {
      client.release();
    }
  }
}

async create(input: CreateUserInput): Promise<User> {
  try {
    const { rows } = await pool.query<User>(
      `INSERT INTO users(email, name) VALUES ($1, $2) RETURNING *`,
      [input.email, input.name]
    );
    return rows[0];
  } catch (e: any) {
    if (e.code === '23505') throw new ConflictError('email já cadastrado');
    throw e;
  }
}

export class AppError extends Error {
  constructor(public status: number, message: string) {
    super(message);
    this.name = this.constructor.name;
  }
}

export class NotFoundError extends AppError {
  constructor(resource = 'recurso') {
    super(404, `${resource} não encontrado`);
  }
}

export class ConflictError extends AppError {
  constructor(message: string) {
    super(409, message);
  }
}

export class ValidationError extends AppError {
  constructor(message: string) {
    super(422, message);
  }
}

export class BadRequestError extends AppError {
  constructor(message = 'requisição inválida') {
    super(400, message);
  }
}

import type { ErrorRequestHandler } from 'express';
import { AppError } from '../errors/AppError';
import { logger }   from '../helpers/logger';

export const errorHandler: ErrorRequestHandler = (err, req, res, _next) => {
  const status = err instanceof AppError ? err.status : 500;

  // log estruturado SERVER-side com contexto
  logger.error({
    status,
    msg:    err.message,
    stack:  err.stack,
    method: req.method,
    path:   req.path,
    ip:     req.ip
  });

  // resposta ENXUTA para o cliente — sem stack, sem detalhes do banco
  const publicMessage = status === 500
    ? 'erro interno do servidor'
    : err.message;

  res.status(status).json({ error: publicMessage });
};

app.use('/api', api);

// 404 explícito para tudo que não casou
app.use((_req, _res, next) => next(new NotFoundError('rota')));

// SEMPRE por último
app.use(errorHandler);

import type { Request, Response, NextFunction, RequestHandler } from 'express';

type AsyncFn = (req: Request, res: Response, next: NextFunction) => Promise<unknown>;

export const asyncHandler = (fn: AsyncFn): RequestHandler =>
  (req, res, next) => {
    Promise.resolve(fn(req, res, next)).catch(next);
  };

router.post('/users', async (req, res, next) => {
  try {
    const u = await userService.create(req.body);
    res.status(201).json(u);
  } catch (e) {
    next(e);
  }
});

router.post('/users', asyncHandler(async (req, res) => {
  const u = await userService.create(req.body);
  res.status(201).location(`/api/users/${u.id}`).json(u);
}));

export interface Order {
  id: number;
  userId: number;
  total: number;
  createdAt: Date;
}

export interface OrderItemInput {
  productId: number;
  quantity:  number;
}

export interface CreateOrderInput {
  userId: number;
  items:  OrderItemInput[];
}

import { z } from 'zod';

export const createOrderSchema = z.object({
  userId: z.number().int().positive(),
  items:  z.array(z.object({
    productId: z.number().int().positive(),
    quantity:  z.number().int().positive()
  })).min(1, 'pedido precisa de ao menos 1 item')
});

import type { Request, Response } from 'express';
import { OrderService } from '../services/OrderService';
import { createOrderSchema } from '../schemas/order';
import { ValidationError } from '../errors/AppError';

export class OrderController {
  constructor(private orderService: OrderService) {}

  create = async (req: Request, res: Response): Promise<void> => {
    const parsed = createOrderSchema.safeParse(req.body);
    if (!parsed.success) {
      throw new ValidationError(
        parsed.error.issues.map(i => i.message).join('; ')
      );
    }

    const order = await this.orderService.create(parsed.data);

    res
      .status(201)
      .location(`/api/orders/${order.id}`)
      .json(order);
  };
}

import morgan from 'morgan';

if (process.env.NODE_ENV !== 'production') {
  app.use(morgan('dev'));   // colorido, conciso
} else {
  app.use(morgan('combined'));  // formato Apache padrão
}

# GET — listar usuários
curl http://localhost:3000/api/users

# GET — buscar um
curl http://localhost:3000/api/users/42

# POST — criar (com -i para ver headers)
curl -i -X POST http://localhost:3000/api/users \
  -H "Content-Type: application/json" \
  -d '{"email":"ana@inteli.edu","name":"Ana"}'

# PUT — substituir
curl -X PUT http://localhost:3000/api/users/42 \
  -H "Content-Type: application/json" \
  -d '{"email":"ana.lima@inteli.edu","name":"Ana Lima"}'

# DELETE
curl -i -X DELETE http://localhost:3000/api/users/42

### Listar usuários
GET http://localhost:3000/api/users

### Criar usuário
POST http://localhost:3000/api/users
Content-Type: application/json

{
  "email": "ana@inteli.edu",
  "name": "Ana"
}

### Criar pedido (e2e)
POST http://localhost:3000/api/orders
Content-Type: application/json

{
  "userId": 1,
  "items": [
    { "productId": 10, "quantity": 2 },
    { "productId": 11, "quantity": 1 }
  ]
}

npm install -D jest ts-jest @types/jest supertest @types/supertest
npx ts-jest config:init

import type { Config } from 'jest';

const config: Config = {
  preset: 'ts-jest',
  testEnvironment: 'node',
  testMatch: ['**/tests/**/*.spec.ts'],
  setupFilesAfterEnv: ['<rootDir>/tests/setup.ts'],
  testTimeout: 10000,           // E2E pode passar de 1s — não use 5s default
  forceExit: true,             // força sair se algum handler ficou pendurado
  detectOpenHandles: true,     // avisa se conexão de banco não foi fechada
};
export default config;

import express from 'express';
import { router } from './routes';
import { errorHandler } from './middlewares/error';

export function createApp() {
  const app = express();
  app.use(express.json());
  app.use('/api', router);
  app.use(errorHandler);
  return app;
}

// src/index.ts — bootstrap separado, NÃO importado pelos testes
// import { createApp } from './app';
// createApp().listen(process.env.PORT ?? 3000);

import request from 'supertest';
import { createApp } from '../src/app';
import { resetDb, seedClient } from './helpers/db';

const app = createApp();

describe('POST /api/orders', () => {
  beforeEach(async () => {
    await resetDb();         // TRUNCATE em todas as tabelas
  });

  it('cria pedido válido e devolve 201 com Location header', async () => {
    const client = await seedClient({ email: 'ana@inteli.edu' });

    const res = await request(app)
      .post('/api/orders')
      .send({ clientId: client.id, items: [{ productId: 1, qty: 2 }] })
      .set('Content-Type', 'application/json');

    expect(res.status).toBe(201);
    expect(res.headers.location).toMatch(/^\/api\/orders\/\d+$/);
    expect(res.body).toMatchObject({ clientId: client.id, status: 'PENDING' });
  });

  it('devolve 422 quando items é vazio', async () => {
    const res = await request(app)
      .post('/api/orders')
      .send({ clientId: 1, items: [] });
    expect(res.status).toBe(422);
    expect(res.body.error).toBe('ValidationError');
  });
});

npm init playwright@latest -- --quiet --browser=chromium
# Já temos Playwright Test + fixtures + config gerados

import { defineConfig } from '@playwright/test';

export default defineConfig({
  testDir: './tests/e2e',
  timeout: 15000,
  fullyParallel: true,
  reporter: [['list'], ['html', { open: 'never' }]],

  // Sobe o servidor antes dos testes; mata depois.
  webServer: {
    command: 'npm run dev',
    url: 'http://localhost:3000/api/health',
    timeout: 30000,
    reuseExistingServer: !process.env.CI,
  },

  use: {
    baseURL: 'http://localhost:3000',
    extraHTTPHeaders: { 'Content-Type': 'application/json' },
  },
});

import { test, expect } from '@playwright/test';
import { resetDb, seedClient } from './helpers/db';

test.beforeEach(async () => { await resetDb(); });

test('POST /api/orders cria pedido e devolve 201', async ({ request }) => {
  const client = await seedClient({ email: 'ana@inteli.edu' });

  const res = await request.post('/api/orders', {
    data: { clientId: client.id, items: [{ productId: 1, qty: 2 }] },
  });

  expect(res.status()).toBe(201);
  expect(res.headers()['location']).toMatch(/^\/api\/orders\/\d+$/);
  const body = await res.json();
  expect(body).toMatchObject({ clientId: client.id, status: 'PENDING' });
});

test('POST /api/orders sem itens devolve 422', async ({ request }) => {
  const res = await request.post('/api/orders', {
    data: { clientId: 1, items: [] },
  });
  expect(res.status()).toBe(422);
});

// tests/helpers/db.ts
import { Pool } from 'pg';

export const testPool = new Pool({
  connectionString: process.env.DATABASE_URL_TEST,
});

export async function resetDb() {
  await testPool.query(`
    TRUNCATE TABLE orders, order_items, clients, products
    RESTART IDENTITY CASCADE;
  `);
  await seedFixtures();      // re-popula dados de referência (produtos, etc.)
}

// Cada teste roda dentro de uma transação que faz ROLLBACK no final.
// Ganho: ~10x mais rápido que TRUNCATE. Limite: o app precisa aceitar
// uma conexão pré-aberta — exige injeção de dependência.
let tx: PoolClient;

beforeEach(async () => {
  tx = await testPool.connect();
  await tx.query('BEGIN');
  setRequestScopedClient(tx);  // app usa este client em vez do pool
});

afterEach(async () => {
  await tx.query('ROLLBACK');
  tx.release();
});

import { PostgreSqlContainer } from '@testcontainers/postgresql';

let container: StartedPostgreSqlContainer;

beforeAll(async () => {
  container = await new PostgreSqlContainer('postgres:16-alpine').start();
  process.env.DATABASE_URL = container.getConnectionUri();
  await runMigrations();          // aplica seu schema
}, 60_000);

afterAll(async () => { await container.stop(); });

const url = process.env.DATABASE_URL_TEST ?? '';
if (!url.endsWith('_test') && !url.includes('localhost')) {
  throw new Error('DATABASE_URL_TEST inválida — recusando subir testes contra prod/staging');
}

describe('POST /api/orders — kit mínimo', () => {

  // 1. HAPPY PATH — o caminho que deve funcionar
  it('201 Created com Location e body coerente', async () => {
    const client = await seedClient();
    const res = await request(app).post('/api/orders')
      .send({ clientId: client.id, items: [{ productId: 1, qty: 1 }] });
    expect(res.status).toBe(201);
    expect(res.headers.location).toMatch(/\/api\/orders\/\d+/);
  });

  // 2. VALIDAÇÃO DE PAYLOAD — schema falha
  it('422 quando clientId está ausente', async () => {
    const res = await request(app).post('/api/orders').send({ items: [] });
    expect(res.status).toBe(422);
    expect(res.body.error).toBe('ValidationError');
    expect(res.body.details).toContainEqual(
      expect.objectContaining({ path: ['clientId'] })
    );
  });

  // 3. ENTIDADE NÃO ENCONTRADA — FK aponta para nada
  it('404 quando clientId não existe', async () => {
    const res = await request(app).post('/api/orders')
      .send({ clientId: 99999, items: [{ productId: 1, qty: 1 }] });
    expect(res.status).toBe(404);
  });

  // 4. CONFLITO DE NEGÓCIO — regra é violada
  it('409 quando produto está sem estoque', async () => {
    const client = await seedClient();
    const prod = await seedProduct({ stock: 0 });
    const res = await request(app).post('/api/orders')
      .send({ clientId: client.id, items: [{ productId: prod.id, qty: 1 }] });
    expect(res.status).toBe(409);
    expect(res.body.error).toBe('ConflictError');
  });

  // 5. EFEITO COLATERAL NO BANCO — verifica o estado depois
  it('persiste pedido + itens e decrementa estoque', async () => {
    const client = await seedClient();
    const prod = await seedProduct({ stock: 10 });

    await request(app).post('/api/orders')
      .send({ clientId: client.id, items: [{ productId: prod.id, qty: 3 }] });

    const { rows: orders } = await testPool.query(
      'SELECT * FROM orders WHERE client_id = $1', [client.id]
    );
    const { rows: stock } = await testPool.query(
      'SELECT stock FROM products WHERE id = $1', [prod.id]
    );
    expect(orders).toHaveLength(1);
    expect(stock[0].stock).toBe(7);  // 10 - 3
  });

  // 6. ROLLBACK — falha no meio da transação não persiste nada
  it('rollback: pedido inválido não persiste itens já inseridos', async () => {
    const client = await seedClient();
    const p1 = await seedProduct({ stock: 5 });
    const p2 = await seedProduct({ stock: 0 }); // vai falhar no segundo item

    const res = await request(app).post('/api/orders').send({
      clientId: client.id,
      items: [{ productId: p1.id, qty: 1 }, { productId: p2.id, qty: 1 }],
    });

    expect(res.status).toBe(409);
    const { rows } = await testPool.query('SELECT count(*) FROM orders');
    expect(rows[0].count).toBe('0');  // nada persistiu — ROLLBACK funcionou
  });
});

it('PUT /api/clients/:id é idempotente', async () => {
  const client = await seedClient({ name: 'Antigo' });
  const payload = { name: 'Novo', email: client.email };

  const r1 = await request(app).put(`/api/clients/${client.id}`).send(payload);
  const r2 = await request(app).put(`/api/clients/${client.id}`).send(payload);

  expect(r1.status).toBe(200);
  expect(r2.status).toBe(200);
  expect(r1.body).toEqual(r2.body);  // estado final idêntico
});

it('DELETE /api/clients/:id devolve 204 na primeira e 404 na segunda', async () => {
  const client = await seedClient();
  const r1 = await request(app).delete(`/api/clients/${client.id}`);
  const r2 = await request(app).delete(`/api/clients/${client.id}`);
  expect(r1.status).toBe(204);
  expect(r2.status).toBe(404);  // alternativa válida: 204 — escolha uma e mantenha
});

name: CI

on: [push, pull_request]

jobs:
  test:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_USER: test
          POSTGRES_PASSWORD: test
          POSTGRES_DB: app_test
        ports: ['5432:5432']
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    env:
      DATABASE_URL_TEST: postgres://test:test@localhost:5432/app_test
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: '20', cache: 'npm' }
      - run: npm ci
      - run: npm run db:migrate    # aplica schema no banco do CI
      - run: npm test               # roda Jest E2E
      - run: npx playwright test    # roda Playwright (se houver)