Rollen Chunk 5: Genehmigungs-Status mit Eigen-UI

src/app/api/auth-scope.test.ts

@@ -271,3 +271,90 @@ describe("Fremde Einstellungen", () => {
     expect(missing.status).toBe(404);
   });
 });
+
+describe("Anfragestatus an Routen", () => {
+  test("Benutzeranfrage ist beantragt und zählt nicht in den Saldo", async () => {
+    const { userCookie } = await setupUsers();
+    await configure(userCookie);
+    const booking = await postVacation(
+      authed("http://localhost/api/vacation", userCookie, {
+        method: "POST",
+        body: JSON.stringify({
+          startDate: "2026-07-06",
+          endDate: "2026-07-06",
+          dayFraction: "full",
+        }),
+      }),
+    );
+    expect(booking.status).toBe(201);
+    const saved = (await booking.json()) as { status: string };
+    expect(saved.status).toBe("beantragt");
+    const { GET: getOverview } = await import("./overview/route");
+    const overview = await getOverview(
+      authed("http://localhost/api/overview?year=2026", userCookie),
+    );
+    const body = (await overview.json()) as {
+      vacation: { usedUnits: number; pendingUnits: number };
+    };
+    expect(body.vacation.usedUnits).toBe(0);
+    expect(body.vacation.pendingUnits).toBe(2);
+  });
+
+  test("Teamleiterbuchung ist sofort bestätigt", async () => {
+    const { teamCookie } = await setupUsers();
+    await configure(teamCookie);
+    const booking = await postVacation(
+      authed("http://localhost/api/vacation", teamCookie, {
+        method: "POST",
+        body: JSON.stringify({
+          startDate: "2026-07-06",
+          endDate: "2026-07-06",
+          dayFraction: "full",
+        }),
+      }),
+    );
+    expect(booking.status).toBe(201);
+    expect(((await booking.json()) as { status: string }).status).toBe(
+      "bestätigt",
+    );
+  });
+
+  test("Stornierung einer Anfrage löscht spurlos, bestätigte geht in den Papierkorb", async () => {
+    const { userCookie } = await setupUsers();
+    await configure(userCookie);
+    async function book(): Promise<number> {
+      const response = await postVacation(
+        authed("http://localhost/api/vacation", userCookie, {
+          method: "POST",
+          body: JSON.stringify({
+            startDate: "2026-07-06",
+            endDate: "2026-07-06",
+            dayFraction: "full",
+          }),
+        }),
+      );
+      if (response.status !== 201) {
+        throw new Error(`Buchung: ${response.status}`);
+      }
+      return ((await response.json()) as { id: number }).id;
+    }
+    const pendingId = await book();
+    const cancelled = await deleteVacation(
+      authed(`http://localhost/api/vacation/${pendingId}`, userCookie, {
+        method: "DELETE",
+      }),
+      { params: Promise.resolve({ id: String(pendingId) }) },
+    );
+    expect(cancelled.status).toBe(200);
+    const { GET: listVacations } = await import("./vacation/route");
+    const afterCancel = (await (
+      await listVacations(
+        authed("http://localhost/api/vacation?deleted=only", userCookie),
+      )
+    ).json()) as { vacationRequests: unknown[] };
+    expect(afterCancel.vacationRequests).toEqual([]);
+    // Erneut buchen geht (kein Overlap-Geist):
+    const rebooked = await book();
+    expect(rebooked).toBeGreaterThan(0);
+  });
+});