test: adapt the suite to the real database and restore green checks

Author: Omoboi-dev

src/admin/api-keys/api-keys.controller.ts

@@ -6,7 +6,12 @@ import {
   Patch,
   UseGuards,
 } from '@nestjs/common';
-import { ApiBearerAuth, ApiOperation, ApiResponse, ApiTags } from '@nestjs/swagger';
+import {
+  ApiBearerAuth,
+  ApiOperation,
+  ApiResponse,
+  ApiTags,
+} from '@nestjs/swagger';
 import { Throttle } from '@nestjs/throttler';
 import { JwtGuard } from '../../auth/guards/jwt.guard';
 import { AdminGuard } from '../guards/admin.guard';

src/admin/dispute/dispute.controller.ts

@@ -1,5 +1,18 @@
-import { Body, Controller, Get, Param, Patch, Query, UseGuards } from '@nestjs/common';
-import { ApiBearerAuth, ApiOperation, ApiResponse, ApiTags } from '@nestjs/swagger';
+import {
+  Body,
+  Controller,
+  Get,
+  Param,
+  Patch,
+  Query,
+  UseGuards,
+} from '@nestjs/common';
+import {
+  ApiBearerAuth,
+  ApiOperation,
+  ApiResponse,
+  ApiTags,
+} from '@nestjs/swagger';
 import { Throttle } from '@nestjs/throttler';
 import { JwtGuard } from '../../auth/guards/jwt.guard';
 import { CurrentUser } from '../../auth/decorators/current-user.decorator';

src/admin/queues/queue-dashboard.controller.ts

@@ -1,5 +1,10 @@
 import { Controller, Get, UseGuards } from '@nestjs/common';
-import { ApiBearerAuth, ApiOperation, ApiResponse, ApiTags } from '@nestjs/swagger';
+import {
+  ApiBearerAuth,
+  ApiOperation,
+  ApiResponse,
+  ApiTags,
+} from '@nestjs/swagger';
 import { Throttle } from '@nestjs/throttler';
 import { JwtGuard } from '../../auth/guards/jwt.guard';
 import { AdminGuard } from '../guards/admin.guard';

src/admin/stats/admin-stats.controller.ts

@@ -1,5 +1,10 @@
 import { Controller, Get, UseGuards } from '@nestjs/common';
-import { ApiBearerAuth, ApiOperation, ApiResponse, ApiTags } from '@nestjs/swagger';
+import {
+  ApiBearerAuth,
+  ApiOperation,
+  ApiResponse,
+  ApiTags,
+} from '@nestjs/swagger';
 import { Throttle } from '@nestjs/throttler';
 import { JwtGuard } from '../../auth/guards/jwt.guard';
 import { AdminGuard } from '../guards/admin.guard';

src/admin/stats/admin-stats.service.spec.ts

@@ -1,5 +1,6 @@
 import { AdminStatsService } from './admin-stats.service';
 import { PrismaService } from '../../prisma/prisma.service';
+import { ensureVendors } from '../../../test/prisma-helpers';
 
 describe('AdminStatsService', () => {
   let service: AdminStatsService;
@@ -8,9 +9,24 @@ describe('AdminStatsService', () => {
   beforeEach(async () => {
     prisma = new PrismaService();
     await prisma.reset();
+    // Escrow.vendorAddress is a foreign key onto VendorProfile.address (#475).
+    await ensureVendors(
+      prisma,
+      'GVENDOR1',
+      'GVENDOR2',
+      'GVENDOR_A',
+      'GVENDOR_B',
+    );
     service = new AdminStatsService(prisma);
   });
 
+  afterEach(async () => {
+    // Each `new PrismaService()` opens its own connection pool. Constructed in
+    // beforeEach across ~100 suites, undisconnected clients exhaust Postgres
+    // (`sorry, too many clients already`) partway through a full run.
+    await prisma?.$disconnect();
+  });
+
   afterEach(async () => {
     await prisma.reset();
   });
@@ -206,9 +222,23 @@ describe('AdminStatsService', () => {
       },
     });
 
+    // A third dispute needs a third escrow: Dispute.escrowId is unique, so a
+    // second dispute on `escrow` is impossible against the real schema (#475).
+    const escrow3 = await prisma.escrow.create({
+      data: {
+        itemName: 'Item 3',
+        itemRef: 'ref-stats-3',
+        amount: 50,
+        currency: 'USDC',
+        buyerAddress: 'GBUYER1',
+        vendorAddress: 'GVENDOR1',
+        state: 'COMPLETED',
+      },
+    });
+
     await prisma.dispute.create({
       data: {
-        escrowId: escrow.id,
+        escrowId: escrow3.id,
         reason: 'Already resolved',
         status: 'RESOLVED',
       },

src/common/sanitization/credential-encryption.util.spec.ts

@@ -25,10 +25,7 @@ describe('CredentialEncryption', () => {
       expect(encrypted1).not.toBe(encrypted2);
     });
 
-
-
     it('should throw when encryption key has invalid length', () => {
-
       expect(() => encryptCredential('test', 'short-key')).toThrow(
         'Encryption key must be exactly 64 hex characters',
       );
@@ -72,9 +69,9 @@ describe('CredentialEncryption', () => {
       // Create a malformed encrypted string with wrong IV length
       const malformedEncrypted = 'short-iv:tag:ciphertext';
 
-      expect(() => decryptCredential(malformedEncrypted, encryptionKey)).toThrow(
-        'Malformed encrypted credential',
-      );
+      expect(() =>
+        decryptCredential(malformedEncrypted, encryptionKey),
+      ).toThrow('Malformed encrypted credential');
     });
 
     it('should throw when decryption fails (tampered data)', () => {
@@ -89,15 +86,17 @@ describe('CredentialEncryption', () => {
         'Failed to decrypt credential',
       );
     });
-
-
   });
 
   describe('reencryptCredential', () => {
     it('should re-encrypt a credential with the same key', () => {
       const plaintext = 'my-secret-api-key-12345';
       const encrypted1 = encryptCredential(plaintext, encryptionKey);
-      const reencrypted = reencryptCredential(encrypted1, encryptionKey, encryptionKey);
+      const reencrypted = reencryptCredential(
+        encrypted1,
+        encryptionKey,
+        encryptionKey,
+      );
       const decrypted = decryptCredential(reencrypted, encryptionKey);
 
       expect(reencrypted).not.toBe(encrypted1);
@@ -107,18 +106,26 @@ describe('CredentialEncryption', () => {
     it('should produce different ciphertext on each re-encryption', () => {
       const plaintext = 'my-secret-api-key-12345';
       const encrypted = encryptCredential(plaintext, encryptionKey);
-      const reencrypted1 = reencryptCredential(encrypted, encryptionKey, encryptionKey);
-      const reencrypted2 = reencryptCredential(encrypted, encryptionKey, encryptionKey);
+      const reencrypted1 = reencryptCredential(
+        encrypted,
+        encryptionKey,
+        encryptionKey,
+      );
+      const reencrypted2 = reencryptCredential(
+        encrypted,
+        encryptionKey,
+        encryptionKey,
+      );
 
       expect(reencrypted1).not.toBe(reencrypted2);
     });
 
     it('should throw when encrypted format is invalid', () => {
       const invalidEncrypted = 'invalid-format';
 
-      expect(() => reencryptCredential(invalidEncrypted, encryptionKey, encryptionKey)).toThrow(
-        'Invalid encrypted credential format',
-      );
+      expect(() =>
+        reencryptCredential(invalidEncrypted, encryptionKey, encryptionKey),
+      ).toThrow('Invalid encrypted credential format');
     });
   });
 

src/common/sanitization/credential-encryption.util.ts

@@ -12,7 +12,10 @@ const SEPARATOR = ':';
  * A fresh IV is generated per call so encrypting the same value twice
  * produces different ciphertext — prevents correlation attacks.
  */
-export function encryptCredential(plaintext: string, encryptionKey: string): string {
+export function encryptCredential(
+  plaintext: string,
+  encryptionKey: string,
+): string {
   const key = Buffer.from(encryptionKey, 'hex');
   if (key.length !== 32) {
     throw new Error(
@@ -40,7 +43,10 @@ export function encryptCredential(plaintext: string, encryptionKey: string): str
  * Decrypts a value produced by `encryptCredential`.
  * Returns the plaintext string, or throws if the ciphertext is tampered.
  */
-export function decryptCredential(stored: string, encryptionKey: string): string {
+export function decryptCredential(
+  stored: string,
+  encryptionKey: string,
+): string {
   const key = Buffer.from(encryptionKey, 'hex');
   if (key.length !== 32) {
     throw new Error(
@@ -79,7 +85,11 @@ export function decryptCredential(stored: string, encryptionKey: string): string
  * Re-encrypts a credential with a new key.
  * This is used during key rotation operations.
  */
-export function reencryptCredential(encryptedCredential: string, oldKey: string, newKey: string): string {
+export function reencryptCredential(
+  encryptedCredential: string,
+  oldKey: string,
+  newKey: string,
+): string {
   const plaintext = decryptCredential(encryptedCredential, oldKey);
   return encryptCredential(plaintext, newKey);
 }

src/common/security/cors-origin.spec.ts

@@ -80,9 +80,7 @@ describe('CORS origin callback (disallowed origin → clean denial)', () => {
       .set('Origin', DISALLOWED_ORIGIN);
 
     expect(response.status).not.toBe(500);
-    expect(
-      response.headers['access-control-allow-origin'],
-    ).toBeUndefined();
+    expect(response.headers['access-control-allow-origin']).toBeUndefined();
   });
 
   it('allows a request with no Origin header (non-browser clients)', async () => {
@@ -99,9 +97,7 @@ describe('CORS origin callback (disallowed origin → clean denial)', () => {
       .set('Access-Control-Request-Method', 'GET');
 
     expect(response.status).toBe(204);
-    const advertised = (
-      response.headers['access-control-allow-headers'] ?? ''
-    )
+    const advertised = (response.headers['access-control-allow-headers'] ?? '')
       .split(',')
       .map((h: string) => h.trim().toLowerCase());
     expect(advertised).toContain('idempotency-key');
@@ -114,8 +110,6 @@ describe('CORS origin callback (disallowed origin → clean denial)', () => {
       .set('Access-Control-Request-Method', 'GET');
 
     expect(response.status).not.toBe(500);
-    expect(
-      response.headers['access-control-allow-origin'],
-    ).toBeUndefined();
+    expect(response.headers['access-control-allow-origin']).toBeUndefined();
   });
 });

src/dispute/dispute.repository.spec.ts

@@ -9,6 +9,10 @@ describe('DisputeRepository', () => {
 
   beforeEach(async () => {
     prisma = new PrismaService();
+    // State lives in a shared database now, not a per-instance Map, so a
+    // suite that does not clear it inherits whatever the previous file left
+    // behind — and jest's file ordering is not stable (#475).
+    await prisma.reset();
     await prisma.vendorProfile.createMany({
       data: [{ address: 'vendor', businessName: 'Test Vendor' }],
       skipDuplicates: true,
@@ -17,6 +21,13 @@ describe('DisputeRepository', () => {
     escrowRepo = new EscrowRepository(prisma);
   });
 
+  afterEach(async () => {
+    // Each `new PrismaService()` opens its own connection pool. Constructed in
+    // beforeEach across ~100 suites, undisconnected clients exhaust Postgres
+    // (`sorry, too many clients already`) partway through a full run.
+    await prisma?.$disconnect();
+  });
+
   describe('findByEscrow()', () => {
     it('returns the dispute linked to the given escrow', async () => {
       const escrow = await escrowRepo.create(

src/dlq/dlq.controller.ts

@@ -92,13 +92,27 @@ export class DlqController {
     type: Number,
     description: 'Maximum records per page (default 20, max 100)',
   })
-  @ApiOperation({ summary: 'List failed contract transactions available for review and replay' })
-  @ApiResponse({ status: 200, description: 'Failed transaction records returned.' })
+  @ApiOperation({
+    summary:
+      'List failed contract transactions available for review and replay',
+  })
+  @ApiResponse({
+    status: 200,
+    description: 'Failed transaction records returned.',
+  })
   @ApiResponse({ status: 401, description: 'Unauthorized.' })
   @ApiResponse({ status: 403, description: 'Admin access required.' })
   @ApiQuery({ name: 'status', required: false, example: 'failed' })
-  @ApiQuery({ name: 'operation', required: false, example: 'submitAutoRelease' })
-  @ApiQuery({ name: 'escrowId', required: false, example: '9d9e2e16-0c78-4a84-9c8c-0f3a5eb2d4e3' })
+  @ApiQuery({
+    name: 'operation',
+    required: false,
+    example: 'submitAutoRelease',
+  })
+  @ApiQuery({
+    name: 'escrowId',
+    required: false,
+    example: '9d9e2e16-0c78-4a84-9c8c-0f3a5eb2d4e3',
+  })
   @Throttle({ auth: { limit: 20, ttl: 60000 } })
   @Get()
   list(
@@ -118,10 +132,16 @@ export class DlqController {
   }
 
   @ApiOperation({ summary: 'Get details for a failed transaction record' })
-  @ApiResponse({ status: 200, description: 'Failed transaction record returned.' })
+  @ApiResponse({
+    status: 200,
+    description: 'Failed transaction record returned.',
+  })
   @ApiResponse({ status: 401, description: 'Unauthorized.' })
   @ApiResponse({ status: 403, description: 'Admin access required.' })
-  @ApiResponse({ status: 404, description: 'Failed transaction record not found.' })
+  @ApiResponse({
+    status: 404,
+    description: 'Failed transaction record not found.',
+  })
   @ApiParam({ name: 'id', example: 'abc123-def4-5678-90ab-cdef12345678' })
   @Throttle({ auth: { limit: 30, ttl: 60000 } })
   @Get(':id')
@@ -135,10 +155,16 @@ export class DlqController {
    * hand. Either way the record is updated on the outcome.
    */
   @ApiOperation({ summary: 'Replay a failed on-chain transaction attempt' })
-  @ApiResponse({ status: 200, description: 'Replay request accepted and replay execution started.' })
+  @ApiResponse({
+    status: 200,
+    description: 'Replay request accepted and replay execution started.',
+  })
   @ApiResponse({ status: 401, description: 'Unauthorized.' })
   @ApiResponse({ status: 403, description: 'Admin access required.' })
-  @ApiResponse({ status: 404, description: 'Failed transaction record not found.' })
+  @ApiResponse({
+    status: 404,
+    description: 'Failed transaction record not found.',
+  })
   @ApiParam({ name: 'id', example: 'abc123-def4-5678-90ab-cdef12345678' })
   @Throttle({ auth: { limit: 5, ttl: 60000 } })
   @Post(':id/replay')
@@ -157,11 +183,20 @@ export class DlqController {
     });
   }
 
-  @ApiOperation({ summary: 'Abandon a failed transaction record and prevent future replay attempts' })
-  @ApiResponse({ status: 200, description: 'Failed transaction record abandoned.' })
+  @ApiOperation({
+    summary:
+      'Abandon a failed transaction record and prevent future replay attempts',
+  })
+  @ApiResponse({
+    status: 200,
+    description: 'Failed transaction record abandoned.',
+  })
   @ApiResponse({ status: 401, description: 'Unauthorized.' })
   @ApiResponse({ status: 403, description: 'Admin access required.' })
-  @ApiResponse({ status: 404, description: 'Failed transaction record not found.' })
+  @ApiResponse({
+    status: 404,
+    description: 'Failed transaction record not found.',
+  })
   @ApiParam({ name: 'id', example: 'abc123-def4-5678-90ab-cdef12345678' })
   @Throttle({ auth: { limit: 5, ttl: 60000 } })
   @Post(':id/abandon')