- New nullable purchase_url column on components
- Store/update validators accept an optional purchaseUrl (must be a valid
absolute URL with a protocol when provided)
- components/create.vue: NewPartSearch import now also fills purchaseUrl
from the scraped part's source URL (pc-builder.io product page); the
field remains manually editable for second-hand parts entered by hand
- components/edit.vue: purchaseUrl is editable after creation
- components/show.vue: displays the purchase site as a clickable link
when present
- 4 new functional tests: create with/without a purchase URL, invalid URL
rejected (asserts the Inertia inputErrorsBag flash, not a raw 422 -
content negotiation only returns JSON for XHR/API-style requests), and
updating an existing component's purchase URL
- Add @japa/api-client devDependency (was missing despite being required
for the 'client' fixture used in functional tests)
- Wire up sessionApiClient/authApiClient/shieldApiClient plugins in
tests/bootstrap.ts so tests can authenticate (loginAs) and pass CSRF
validation (withCsrfToken)
- Wrap each functional test in a global DB transaction (withGlobalTransaction)
for isolation and rollback
- Add .env.test with SESSION_DRIVER=memory: the cookie session driver used
in dev/prod is incompatible with Japa's session test client, which needs
a store it can read/write by session id
- tests/functional/computers.spec.ts: covers owner can update; a user
cannot update/delete another user's computer (404); a user cannot
attach another user's component via componentsId (404); two components
of the same unique type cannot be attached (422); deleting a computer
detaches its components instead of destroying them
- tests/functional/components.spec.ts: covers owner can update; a user
cannot update/delete another user's component (404); an unauthenticated
request cannot delete a component (redirects to /auth/login)
All 10 tests pass, exercising the security fixes from commit 3cc189c.
Kevin L'Hereec