From 9ebb3daeb0752683a349be87eafaf45f6c568ba3 Mon Sep 17 00:00:00 2001
From: "Charles (via Bookendi session)" <charles@modernit.com.au>
Date: Sun, 30 Aug 2026 09:31:53 +1000
Subject: [PATCH] fix(test): payment-legacy-seam checks PERMISSIONS_KEY, not
 the legacy ROLES_KEY

PaymentController's mutation routes (recordPayment, authorizePayment,
capturePayment, voidPayment, refundPayment, correctPayment) are gated
by @RequirePermissions('folios.manage') only -- none carry @Roles().
The test asserted ROLES_KEY metadata equal to
['admin', 'general_manager', 'front_desk', 'reservations'], which this
controller has never had, so it failed unconditionally.

Fixed the assertion to check PERMISSIONS_KEY for 'folios.manage'
instead, matching what the controller actually enforces.
---
 .../src/modules/payment/payment-legacy-seam.spec.ts | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/apps/api/src/modules/payment/payment-legacy-seam.spec.ts b/apps/api/src/modules/payment/payment-legacy-seam.spec.ts
index 7e8d70d3..2a66086b 100644
--- a/apps/api/src/modules/payment/payment-legacy-seam.spec.ts
+++ b/apps/api/src/modules/payment/payment-legacy-seam.spec.ts
@@ -1,6 +1,6 @@
 import { Reflector } from '@nestjs/core';
 import { describe, expect, it, vi } from 'vitest';
-import { ROLES_KEY } from '../auth/roles.decorator';
+import { PERMISSIONS_KEY } from '../auth/permissions.decorator';
 import { PaymentController } from './payment.controller';
 import { PaymentService } from './payment.service';
 
@@ -72,7 +72,12 @@ function serviceWith(db: ReturnType<typeof dbReturning>) {
 }
 
 describe('legacy payment HTTP seam', () => {
-  it('uses role guards for generic payment mutations', () => {
+  it('requires folios.manage for generic payment mutations', () => {
+    // PaymentController migrated off the legacy @Roles() decorator onto
+    // @RequirePermissions('folios.manage') on every mutation route -- this
+    // asserted the OLD mechanism, which the controller has never carried
+    // since that migration, and would have failed on any commit, not just
+    // this sync's.
     const reflector = new Reflector();
     for (const method of [
       'recordPayment',
@@ -83,9 +88,9 @@ describe('legacy payment HTTP seam', () => {
       'correctPayment',
     ] as const) {
       expect(reflector.get(
-        ROLES_KEY,
+        PERMISSIONS_KEY,
         PaymentController.prototype[method],
-      )).toEqual(['admin', 'general_manager', 'front_desk', 'reservations']);
+      )).toEqual(['folios.manage']);
     }
   });