From ad32d8147d45bf86bcb662483c1d1664b7d27beb Mon Sep 17 00:00:00 2001
From: Matthieu <contact@malio.fr>
Date: Thu, 4 Jun 2026 13:34:00 +0200
Subject: [PATCH] test(commercial) : POST sous-ressource sur client inexistant
 -> 404 (ERP-110)

---
 .../Api/ClientSubResourceApiTest.php          | 62 +++++++++++++++++++
 1 file changed, 62 insertions(+)

diff --git a/tests/Module/Commercial/Api/ClientSubResourceApiTest.php b/tests/Module/Commercial/Api/ClientSubResourceApiTest.php
index 321ac10..88f6921 100644
--- a/tests/Module/Commercial/Api/ClientSubResourceApiTest.php
+++ b/tests/Module/Commercial/Api/ClientSubResourceApiTest.php
@@ -140,6 +140,25 @@ final class ClientSubResourceApiTest extends AbstractCommercialApiTestCase
         self::assertSame('L\'adresse email n\'est pas valide.', $byPath['email']);
     }
 
+    /**
+     * ERP-110 : avec read:false sur le POST, un parent introuvable n'est plus
+     * intercepte au stade lecture. Le 404 est desormais porte par
+     * ClientContactProcessor::linkParent (sinon 500 au persist sur client_id
+     * NOT NULL). Le payload est valide pour atteindre le processor (apres la
+     * validation).
+     */
+    public function testPostContactOnMissingClientReturns404(): void
+    {
+        $client = $this->createAdminClient();
+
+        $client->request('POST', '/api/clients/999999/contacts', [
+            'headers' => ['Content-Type' => self::LD, 'Accept' => self::LD],
+            'json'    => ['firstName' => 'Orphan'],
+        ]);
+
+        self::assertResponseStatusCodeSame(404);
+    }
+
     public function testPatchContactNormalizes(): void
     {
         $client  = $this->createAdminClient();
@@ -276,6 +295,32 @@ final class ClientSubResourceApiTest extends AbstractCommercialApiTestCase
         self::assertResponseStatusCodeSame(201);
     }
 
+    /**
+     * ERP-110 : POST adresse sur un client inexistant -> 404 porte par
+     * ClientAddressProcessor::linkParent (read:false). Payload valide (site +
+     * categorie, RG-1.10 / RG-1.29) pour atteindre le processor.
+     */
+    public function testPostAddressOnMissingClientReturns404(): void
+    {
+        $this->skipIfSitesModuleDisabled();
+        $client   = $this->createAdminClient();
+        $siteIri  = $this->firstSiteIri();
+        $category = $this->createCategory('SECTEUR');
+
+        $client->request('POST', '/api/clients/999999/addresses', [
+            'headers' => ['Content-Type' => self::LD, 'Accept' => self::LD],
+            'json'    => [
+                'postalCode' => '75001',
+                'city'       => 'Paris',
+                'street'     => '2 rue Neuve',
+                'sites'      => [$siteIri],
+                'categories' => ['/api/categories/'.$category->getId()],
+            ],
+        ]);
+
+        self::assertResponseStatusCodeSame(404);
+    }
+
     // === RIBs ===
 
     public function testPostRibByAdminReturns201(): void
@@ -334,6 +379,23 @@ final class ClientSubResourceApiTest extends AbstractCommercialApiTestCase
         self::assertResponseStatusCodeSame(201);
     }
 
+    /**
+     * ERP-110 : POST RIB sur un client inexistant -> 404 porte par
+     * ClientRibProcessor::linkParent (read:false). L'admin porte
+     * commercial.clients.accounting.manage ; payload valide (BIC / IBAN).
+     */
+    public function testPostRibOnMissingClientReturns404(): void
+    {
+        $client = $this->createAdminClient();
+
+        $client->request('POST', '/api/clients/999999/ribs', [
+            'headers' => ['Content-Type' => self::LD, 'Accept' => self::LD],
+            'json'    => ['label' => 'Orphan', 'bic' => self::VALID_BIC, 'iban' => self::VALID_IBAN],
+        ]);
+
+        self::assertResponseStatusCodeSame(404);
+    }
+
     public function testDeleteRibNonLcrReturns204(): void
     {
         $client = $this->createAdminClient();