feat: add dynamic hospital database registry

internal/http/database_settings_test.go

@@ -0,0 +1,59 @@
+package http
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"primaya-api/cpone-middleware/internal/databaseconfig"
+)
+
+type fakeDatabaseSettingsStore struct {
+	setting databaseconfig.Setting
+}
+
+func (f *fakeDatabaseSettingsStore) List() []databaseconfig.PublicSetting { return nil }
+func (f *fakeDatabaseSettingsStore) Get(string) (databaseconfig.PublicSetting, bool) {
+	return databaseconfig.PublicSetting{}, false
+}
+func (f *fakeDatabaseSettingsStore) Upsert(_ context.Context, setting databaseconfig.Setting) (databaseconfig.PublicSetting, bool, error) {
+	f.setting = setting
+	return databaseconfig.PublicSetting{
+		RSCode: setting.RSCode, Host: setting.Host, Port: setting.Port,
+		Database: setting.Database, Username: setting.Username, HasPassword: setting.Password != "",
+	}, true, nil
+}
+
+func TestStoreDatabaseSettingDoesNotExposePassword(t *testing.T) {
+	store := &fakeDatabaseSettingsStore{}
+	handler := NewDatabaseSettingsHandler(store)
+	body := `{"kode_rs":"RS_BEKASI","nama":"RS Bekasi","host":"10.0.0.2","port":"3306","database":"his","username":"cpone","password":"top-secret"}`
+	request := httptest.NewRequest(http.MethodPost, "/api/cpone/database-settings", strings.NewReader(body))
+	recorder := httptest.NewRecorder()
+	handler.Store(recorder, request)
+
+	if recorder.Code != http.StatusCreated {
+		t.Fatalf("status = %d, body=%s", recorder.Code, recorder.Body.String())
+	}
+	if store.setting.Password != "top-secret" {
+		t.Fatal("password was not passed to store")
+	}
+	if strings.Contains(recorder.Body.String(), "top-secret") || strings.Contains(recorder.Body.String(), `"password"`) {
+		t.Fatalf("response exposes password: %s", recorder.Body.String())
+	}
+	if !strings.Contains(recorder.Body.String(), `"has_password":true`) {
+		t.Fatalf("response missing has_password: %s", recorder.Body.String())
+	}
+}
+
+func TestStoreDatabaseSettingValidation(t *testing.T) {
+	handler := NewDatabaseSettingsHandler(&fakeDatabaseSettingsStore{})
+	request := httptest.NewRequest(http.MethodPost, "/api/cpone/database-settings", strings.NewReader(`{"kode_rs":"invalid code"}`))
+	recorder := httptest.NewRecorder()
+	handler.Store(recorder, request)
+	if recorder.Code != http.StatusUnprocessableEntity {
+		t.Fatalf("status = %d, body=%s", recorder.Code, recorder.Body.String())
+	}
+}