fix: alot

apps/api/test/app.e2e-spec.ts

@@ -1,6 +1,6 @@
 import { Test, TestingModule } from '@nestjs/testing';
 import { INestApplication, ValidationPipe } from '@nestjs/common';
-import * as request from 'supertest';
+import request = require('supertest');
 import { AppModule } from '../src/app.module';
 import { PrismaService } from '../src/prisma/prisma.service';
 import { HttpExceptionFilter } from '../src/common/filters/http-exception.filter';
@@ -42,7 +42,7 @@ describe('KoolTap API (e2e)', () => {
     it('POST /api/v1/auth/login with invalid credentials should return 401', () => {
       return request(app.getHttpServer())
         .post('/api/v1/auth/login')
-        .send({ email: 'nonexistent@test.com', password: 'wrong' })
+        .send({ email: 'nonexistent@test.com', password: 'wrong-password' })
         .expect(401);
     });
 
@@ -50,8 +50,9 @@ describe('KoolTap API (e2e)', () => {
       // First create a user via seed or directly
       const bcrypt = require('bcrypt');
       const hash = await bcrypt.hash('Test123!', 10);
-      const uuid = require('uuid').v4();
-      const venueId = uuid;
+      const { v4: uuid } = require('uuid');
+      const venueId = uuid();
+      const email = `test-${venueId}@test.com`;
 
       await prisma.venue.create({
         data: { id: venueId, name: 'Test Venue' },
@@ -59,9 +60,9 @@ describe('KoolTap API (e2e)', () => {
 
       await prisma.clientUser.create({
         data: {
-          id: uuid,
+          id: uuid(),
           venueId,
-          email: 'test@test.com',
+          email,
           passwordHash: hash,
           name: 'Test User',
           role: 'admin',
@@ -70,12 +71,12 @@ describe('KoolTap API (e2e)', () => {
 
       return request(app.getHttpServer())
         .post('/api/v1/auth/login')
-        .send({ email: 'test@test.com', password: 'Test123!' })
+        .send({ email, password: 'Test123!' })
         .expect(200)
         .expect((res) => {
           expect(res.body.accessToken).toBeDefined();
           expect(res.body.refreshToken).toBeDefined();
-          expect(res.body.user.email).toBe('test@test.com');
+          expect(res.body.user.email).toBe(email);
         });
     });
   });
@@ -83,21 +84,20 @@ describe('KoolTap API (e2e)', () => {
   describe('Venue isolation', () => {
     it('should not allow cross-venue access', async () => {
       const bcrypt = require('bcrypt');
-      const uuid = require('uuid').v4();
-      const venueAId = uuid;
-      const venueBId = uuid;
+      const { v4: uuid } = require('uuid');
+      const venueAId = uuid();
+      const venueBId = uuid();
+      const email = `venuea-${venueAId}@test.com`;
 
       await prisma.venue.create({ data: { id: venueAId, name: 'Venue A' } });
       await prisma.venue.create({ data: { id: venueBId, name: 'Venue B' } });
 
       const hash = await bcrypt.hash('Pass123!', 10);
-      const userId = uuid;
-
       await prisma.clientUser.create({
         data: {
-          id: userId,
+          id: uuid(),
           venueId: venueAId,
-          email: 'venuea@test.com',
+          email,
           passwordHash: hash,
           name: 'Venue A User',
           role: 'admin',
@@ -107,7 +107,7 @@ describe('KoolTap API (e2e)', () => {
       // Login as Venue A user
       const loginRes = await request(app.getHttpServer())
         .post('/api/v1/auth/login')
-        .send({ email: 'venuea@test.com', password: 'Pass123!' })
+        .send({ email, password: 'Pass123!' })
         .expect(200);
 
       const token = loginRes.body.accessToken;
@@ -116,11 +116,9 @@ describe('KoolTap API (e2e)', () => {
       await request(app.getHttpServer())
         .get(`/api/v1/venues/${venueBId}/tabs`)
         .set('Authorization', `Bearer ${token}`)
-        .expect(200) // Should return empty - venue scoping is by user venueId, not by URL param
+        .expect(403)
         .expect((res) => {
-          // The endpoint uses the user's venueId from JWT
-          // But for cross-venue tests we need the endpoint to verify
-          expect(Array.isArray(res.body.tabs)).toBe(true);
+          expect(res.body.error.code).toBe('venue_forbidden');
         });
     });
   });

apps/api/test/jest-e2e.json

@@ -2,6 +2,9 @@
   "moduleFileExtensions": ["js", "json", "ts"],
   "rootDir": ".",
   "testEnvironment": "node",
+  "moduleNameMapper": {
+    "^@kooltap/shared$": "<rootDir>/../../../packages/shared/src"
+  },
   "testRegex": ".e2e-spec.ts$",
   "transform": {
     "^.+\\.(t|j)s$": "ts-jest"