Initial commit

server/internal/httpapi/public_test.go

@@ -0,0 +1,30 @@
+package httpapi
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+	"time"
+
+	"calllinesystem/server/internal/model"
+)
+
+func TestDisplayBatchDTOCannotSerializePersonalFields(t *testing.T) {
+	batch := model.CallBatch{BatchSequence: 7, Status: "CALLED", CalledAt: time.Unix(100, 0).UTC()}
+	view := newDisplayBatchDTO(batch, []displayTicketDTO{{
+		TicketNumber: "00042", DisplayNumber: "00042", Status: model.TicketCalled,
+	}})
+	body, err := json.Marshal(view)
+	if err != nil {
+		t.Fatal(err)
+	}
+	encoded := string(body)
+	for _, forbidden := range []string{"honorific", "phone", "phone_last4", "last_name", "ticket_id", "joined_at", "created_by"} {
+		if strings.Contains(encoded, forbidden) {
+			t.Fatalf("public display DTO leaked forbidden field %q: %s", forbidden, encoded)
+		}
+	}
+	if !strings.Contains(encoded, `"ticket_number":"00042"`) {
+		t.Fatalf("public ticket number missing: %s", encoded)
+	}
+}