test(slice-3): INV-1 whole-flow bootstrap test — empty DB to admin answer (§6.8)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend/tests/test_bootstrap.py

@@ -0,0 +1,42 @@
+"""INV-1's enforcement (SD-0001 §6.8): from an empty database, one test walks the whole
+flow — request-code -> verify -> create-storefront -> /me — asserting no step needed
+seeded state. Migration idempotence (the second INV-1 test) lives in test_migrations.py."""
+import re
+
+from fastapi.testclient import TestClient
+
+from app.main import create_app
+
+
+def test_inv_1_bootstrap_whole_flow_from_empty(fresh_db_url):
+    # fresh_db_url is a brand-new empty database; create_app() self-migrates (INV-7).
+    with TestClient(create_app(database_url=fresh_db_url)) as client:
+        # a fresh deployment serves healthz green before any row exists
+        assert client.get("/healthz").json() == {"status": "ok"}
+
+        # PUC-2: first visitor requests a code; it reaches them via the dev channel
+        assert client.post(
+            "/api/auth/request-code", json={"email": "first@example.com"}
+        ).status_code == 204
+        code = re.search(r"\b(\d{6})\b", client.app.state.mailer.outbox[-1].body).group(1)
+
+        # verify creates account #1 — the first row, through the product alone
+        verified = client.post(
+            "/api/auth/verify", json={"email": "first@example.com", "code": code}
+        )
+        assert verified.status_code == 200
+        assert verified.json()["created"] is True
+        assert verified.json()["storefront"] is None  # -> create-storefront (PUC-5)
+
+        # PUC-4: create the storefront (blank name -> generated default)
+        created = client.post("/api/storefronts", json={})
+        assert created.status_code == 201
+        assert created.json()["name"] == "first's storefront"
+
+        # PUC-6/PUC-8: the admin answer — storefront + email from /me alone
+        me = client.get("/api/auth/me")
+        assert me.status_code == 200
+        assert me.json() == {
+            "account": {"email": "first@example.com"},
+            "storefront": created.json(),
+        }