test(modules): verify company-scoped list endpoint filtering #300

Merged

vas2000-work merged 1 commit from test/PMS-401-company-scoped-list-filtering into main

2026-06-18 00:53:24 +02:00

David commented

2026-06-17 17:52:18 +02:00

Owner

Add an integration suite that is the executable form of the PMS-401 audit and a regression guard for the company-scoped list filtering the frontend company context cards (MAPPS-249) depend on.

For each of the five global list endpoints (tickets, contracts, projects, assets, invoices) the suite seeds two companies with a known per-company row count and proves at the service layer that a ?company_id= filter returns only that company's rows, that the paginated total reflects the company-filtered count (the COUNT query applies the same condition as the data query), and that an unknown company_id yields an empty list with total 0 rather than silently falling back to the unfiltered all-companies list.

A separate HTTP-layer test exercises all five endpoints to confirm a malformed company_id fails Query deserialization with 400 rather than dropping the filter.

The audit found no backend gap: every endpoint already applies company_id to both its data and count queries, no new endpoints are needed, and the c2 View All work is purely client-side routing.

#PMS-401

Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com

Add an integration suite that is the executable form of the PMS-401 audit and a regression guard for the company-scoped list filtering the frontend company context cards (MAPPS-249) depend on. For each of the five global list endpoints (tickets, contracts, projects, assets, invoices) the suite seeds two companies with a known per-company row count and proves at the service layer that a `?company_id=` filter returns only that company's rows, that the paginated total reflects the company-filtered count (the COUNT query applies the same condition as the data query), and that an unknown company_id yields an empty list with total 0 rather than silently falling back to the unfiltered all-companies list. A separate HTTP-layer test exercises all five endpoints to confirm a malformed company_id fails Query deserialization with 400 rather than dropping the filter. The audit found no backend gap: every endpoint already applies company_id to both its data and count queries, no new endpoints are needed, and the c2 View All work is purely client-side routing. #PMS-401 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

David added 1 commit

2026-06-17 17:52:18 +02:00

test(modules): verify company-scoped list endpoint filtering

E2E / Playwright against staging (pull_request) Successful in 33s

Details

Check / fmt + clippy + compile + unit/doc tests (pull_request) Successful in 2m1s

Details

Integration / integration tests (pull_request) Successful in 9m27s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

9d6b08352a

Add an integration suite that is the executable form of the PMS-401 audit and a regression guard for the company-scoped list filtering the frontend company context cards (MAPPS-249) depend on.

For each of the five global list endpoints (tickets, contracts, projects, assets, invoices) the suite seeds two companies with a known per-company row count and proves at the service layer that a `?company_id=` filter returns only that company's rows, that the paginated total reflects the company-filtered count (the COUNT query applies the same condition as the data query), and that an unknown company_id yields an empty list with total 0 rather than silently falling back to the unfiltered all-companies list.

A separate HTTP-layer test exercises all five endpoints to confirm a malformed company_id fails Query deserialization with 400 rather than dropping the filter.

The audit found no backend gap: every endpoint already applies company_id to both its data and count queries, no new endpoints are needed, and the c2 View All work is purely client-side routing.

#PMS-401

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>