feat(ADM-018): completed feature

legacy/specs-old/F-003-http-foundation/TESTS.md

@@ -0,0 +1,21 @@
+# TESTS — F-003 HTTP foundation and request context
+
+## Unit — src/shared/tests/http-input.test.ts
+1. parseJson returns parsed value for valid input
+2. parseJson throws AppError 400 VALIDATION_ERROR with field issues for invalid input
+3. parseJson rejects non-object input when schema expects object
+
+## Composition — src/app/tests/http-foundation.test.ts
+(app built with logger writing to an in-memory stream)
+
+1. GET /health responds 200 with x-request-id header (UUID shape)
+2. Valid incoming x-request-id is propagated: same value in response header and in the request log line
+3. Malicious x-request-id (bad charset / >128 chars) is replaced by generated UUID; log line carries the generated id
+4. Unknown route -> 404 envelope { error: { statusCode: 404, code: NOT_FOUND, message }, requestId } + x-request-id header
+5. Invalid JSON body on test route -> 400, envelope shape stable, requestId present
+6. Schema-invalid body on test route -> 400 code VALIDATION_ERROR, issues mention field path only
+7. Handler throwing Error('secret internal detail') -> 500 generic message, response body contains neither the message nor a stack; error log line contains requestId and stack
+8. Every request produces exactly one 'request completed' log line carrying the requestId
+
+## Manual / QA
+- verify.sh green; live curl shows x-request-id header and JSON envelope on unknown route.