PART 02 — 内部API仕様書
RESTエンドポイント設計・リクエスト/レスポンス・認証・エラー設計で定義すべきこと

openapi: "3.0.3"
info:
  title: "受注管理システム API"
  version: "1.0.0"

paths:
  /api/v1/products/:
    post:
      summary: "商品登録"
      operationId: "createProduct"
      tags: ["商品管理"]
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ProductCreate"
      responses:
        "201":
          description: "登録成功"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ProductDetail"
        "400":
          $ref: "#/components/responses/ValidationError"
        "401":
          $ref: "#/components/responses/Unauthorized"
        "403":
          $ref: "#/components/responses/Forbidden"

components:
  schemas:
    ProductCreate:
      type: object
      required:
        - product_code
        - product_name
        - category_id
        - unit_price
        - tax_type
      properties:
        product_code:
          type: string
          maxLength: 20
          pattern: "^[A-Za-z0-9\\-]+$"
          example: "PROD-001"
        product_name:
          type: string
          maxLength: 100
          example: "サンプル商品"
        category_id:
          type: integer
          example: 1
        unit_price:
          type: number
          format: decimal
          minimum: 0
          maximum: 9999999.99
          example: 1980.00
        tax_type:
          type: integer
          enum: [0, 8, 10]
          example: 10
        description:
          type: string
          maxLength: 2000
          nullable: true

    ProductDetail:
      allOf:
        - $ref: "#/components/schemas/ProductCreate"
        - type: object
          properties:
            product_id:
              type: integer
              example: 42
            created_at:
              type: string
              format: date-time
            updated_at:
              type: string
              format: date-time

  responses:
    ValidationError:
      description: "バリデーションエラー"
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/ErrorResponse"
          example:
            error_code: "VALIDATION_ERROR"
            message: "入力値が不正です"
            details:
              - field: "unit_price"
                message: "0以上の数値を入力してください"

  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT

"""
APIエンドポイントの基本的な自動テスト。
pip install requests pytest
"""
import requests
import pytest

BASE_URL = "http://localhost:8000/api/v1"
ADMIN_CREDS = {"email": "admin@example.com", "password": "testpass123"}


@pytest.fixture(scope="session")
def auth_token() -> str:
    """JWTアクセストークンを取得するフィクスチャ"""
    resp = requests.post(f"{BASE_URL}/auth/login/", json=ADMIN_CREDS)
    assert resp.status_code == 200, f"ログイン失敗: {resp.json()}"
    return resp.json()["access_token"]


@pytest.fixture
def auth_headers(auth_token: str) -> dict:
    return {"Authorization": f"Bearer {auth_token}"}


class TestProductAPI:

    def test_list_products(self, auth_headers):
        """商品一覧取得 - 正常系"""
        resp = requests.get(f"{BASE_URL}/products/", headers=auth_headers)
        assert resp.status_code == 200
        data = resp.json()
        assert "results" in data      # ページネーション形式
        assert "count" in data

    def test_create_product_success(self, auth_headers):
        """商品登録 - 正常系"""
        payload = {
            "product_code": "TEST-001",
            "product_name": "テスト商品",
            "category_id": 1,
            "unit_price": 1500,
            "tax_type": 10,
        }
        resp = requests.post(f"{BASE_URL}/products/", json=payload, headers=auth_headers)
        assert resp.status_code == 201
        data = resp.json()
        assert data["product_code"] == "TEST-001"
        assert "product_id" in data

    def test_create_product_validation_error(self, auth_headers):
        """商品登録 - バリデーションエラー（価格が負）"""
        payload = {
            "product_code": "TEST-ERR",
            "product_name": "エラーテスト",
            "category_id": 1,
            "unit_price": -100,   # ← バリデーションエラー
            "tax_type": 10,
        }
        resp = requests.post(f"{BASE_URL}/products/", json=payload, headers=auth_headers)
        assert resp.status_code == 400
        data = resp.json()
        assert data["error_code"] == "VALIDATION_ERROR"

    def test_get_product_not_found(self, auth_headers):
        """商品詳細取得 - 存在しないID"""
        resp = requests.get(f"{BASE_URL}/products/99999/", headers=auth_headers)
        assert resp.status_code == 404
        assert resp.json()["error_code"] == "NOT_FOUND"

    def test_unauthorized_without_token(self):
        """認証なしアクセス - 401エラー"""
        resp = requests.get(f"{BASE_URL}/products/")
        assert resp.status_code == 401