// Skillstore first task: review and repair this fictional invoice endpoint.
// Save this file as invoice-task.mjs. Run: node --test invoice-task.mjs
// Some checks fail initially. Fix getInvoice, then rerun the same checks.
// No network, packages, credentials or customer data are needed.
// Assume the server has authenticated session.userId, validated session.orgId
// against current membership, and stored a valid orgId on every invoice.
// Keep successful responses limited to id and total. Missing and inaccessible
// invoices must return the same response. Leave these requirements and tests intact.
import assert from "node:assert/strict";
import test from "node:test";

export function getInvoice({ invoiceId, session }, invoices) {
  if (!session?.userId) return { status: 401 };
  const invoice = invoices.get(invoiceId);
  if (!invoice) return { status: 404 };
  return { status: 200, body: { id: invoice.id, total: invoice.total } };
}

const invoices = new Map([
  ["inv_a", { id: "inv_a", orgId: "org_a", total: 10, internalNote: "Not part of the response" }],
  ["inv_b", { id: "inv_b", orgId: "org_b", total: 20 }],
]);
const alice = { userId: "alice", orgId: "org_a" };
const bob = { userId: "bob", orgId: "org_b" };

test("a member can read their organization's invoice", () => {
  assert.deepEqual(getInvoice({ invoiceId: "inv_a", session: alice }, invoices),
    { status: 200, body: { id: "inv_a", total: 10 } });
});
test("another member of the same organization can read the invoice", () => {
  assert.equal(getInvoice({ invoiceId: "inv_a", session: { userId: "ann", orgId: "org_a" } }, invoices).status, 200);
});
test("a member cannot read another organization's invoice", () => {
  assert.deepEqual(getInvoice({ invoiceId: "inv_a", session: bob }, invoices), { status: 404 });
  assert.deepEqual(getInvoice({ invoiceId: "inv_b", session: alice }, invoices), { status: 404 });
});
test("an organization supplied in the request cannot override the verified session", () => {
  assert.deepEqual(getInvoice({ invoiceId: "inv_a", session: bob, orgId: "org_a" }, invoices), { status: 404 });
});
test("a missing invoice returns no invoice data", () => {
  assert.deepEqual(getInvoice({ invoiceId: "missing", session: alice }, invoices), { status: 404 });
});
test("missing and inaccessible invoices have indistinguishable responses", () => {
  assert.deepEqual(getInvoice({ invoiceId: "inv_a", session: bob }, invoices),
    getInvoice({ invoiceId: "missing", session: bob }, invoices));
});
test("a request without an authenticated user is rejected before reading invoices", () => {
  const unreadable = { get() { throw new Error("Unauthenticated request read invoice data"); } };
  for (const session of [null, undefined, {}, { orgId: "org_a" }]) {
    assert.deepEqual(getInvoice({ invoiceId: "inv_a", session }, unreadable), { status: 401 });
  }
});
test("successful responses expose only the intended public fields", () => {
  assert.deepEqual(Object.keys(getInvoice({ invoiceId: "inv_a", session: alice }, invoices).body).sort(), ["id", "total"]);
});