feat(cms): improve catalog, editorial recovery and operations

src/app/api/admin/studio/import-jobs/route.test.ts

@@ -7,6 +7,7 @@ const mocks = vi.hoisted(() => ({
 	guard: vi.fn(),
 	create: vi.fn(),
 	list: vi.fn(),
+	cancel: vi.fn(),
 	after: vi.fn(),
 	ping: vi.fn(),
 	source: vi.fn(),
@@ -25,15 +26,17 @@ vi.mock("@/lib/redis", () => ({ redis: { ping: mocks.ping } }));
 vi.mock("@/lib/services/furni-job-worker", () => ({
 	drainFurnitureImports: vi.fn(),
 }));
-vi.mock("@/lib/services/furni-job-store", () => ({
+vi.mock("@/lib/services/furni-job-store", async (original) => ({
+	...(await original<typeof import("@/lib/services/furni-job-store")>()),
 	ImportJobStore: class {
 		create = mocks.create;
 		list = mocks.list;
+		requestCancellation = mocks.cancel;
 	},
 }));
 vi.mock("@/lib/services/clone-sources", () => ({ getSource: mocks.source }));
 
-import { GET, POST } from "./route";
+import { GET, PATCH, POST } from "./route";
 
 const item = {
 	id: 1,
@@ -106,11 +109,23 @@ it("rejects a missing configured source", async () => {
 		).status,
 	).toBe(404);
 });
-it("only returns the current operators history", async () => {
-	mocks.list.mockResolvedValue([
-		{ id: "a", userId: 7 },
-		{ id: "b", userId: 9 },
-	]);
+it("requests bounded owner-scoped history from the store", async () => {
+	mocks.list.mockResolvedValue([{ id: "a", userId: 7 }]);
 	const response = await GET(request({}), ctx);
+	expect(mocks.list).toHaveBeenCalledWith({ userId: 7, limit: 30 });
 	expect((await response.json()).jobs).toEqual([{ id: "a", userId: 7 }]);
 });
+it("requests cancellation with the authenticated owner", async () => {
+	const id = randomUUID();
+	mocks.cancel.mockResolvedValue({ id, cancelRequested: true });
+	const response = await PATCH(request({ id }), ctx);
+	expect(response.status).toBe(200);
+	expect(mocks.cancel).toHaveBeenCalledWith(id, 7);
+});
+it("does not reveal other owners' jobs", async () => {
+	mocks.cancel.mockResolvedValue(null);
+	expect((await PATCH(request({ id: randomUUID() }), ctx)).status).toBe(404);
+});
+it("rejects unsafe cancellation IDs", async () => {
+	expect((await PATCH(request({ id: "../other" }), ctx)).status).toBe(400);
+});