blocker move 1

src/SbomService/StellaOps.SbomService.Tests/ProjectionEndpointTests.cs

@@ -0,0 +1,45 @@
+using System.Net;
+using System.Net.Http.Json;
+using FluentAssertions;
+using Microsoft.AspNetCore.Mvc.Testing;
+using Xunit;
+
+namespace StellaOps.SbomService.Tests;
+
+public class ProjectionEndpointTests : IClassFixture<WebApplicationFactory<Program>>
+{
+    private readonly WebApplicationFactory<Program> _factory;
+
+    public ProjectionEndpointTests(WebApplicationFactory<Program> factory)
+    {
+        _factory = factory.WithWebHostBuilder(_ => { });
+    }
+
+    [Fact]
+    public async Task Projection_requires_tenant()
+    {
+        var client = _factory.CreateClient();
+
+        var response = await client.GetAsync("/sboms/snap-001/projection");
+
+        response.StatusCode.Should().Be(HttpStatusCode.BadRequest);
+    }
+
+    [Fact]
+    public async Task Projection_returns_payload_and_hash()
+    {
+        var client = _factory.CreateClient();
+
+        var response = await client.GetAsync("/sboms/snap-001/projection?tenant=tenant-a");
+        response.EnsureSuccessStatusCode();
+
+        var json = await response.Content.ReadFromJsonAsync<ProjectionResponse>();
+        json.Should().NotBeNull();
+        json!.snapshotId.Should().Be("snap-001");
+        json.tenantId.Should().Be("tenant-a");
+        json.hash.Should().NotBeNullOrEmpty();
+        json.projection.GetProperty("purl").GetString().Should().Be("pkg:npm/lodash@4.17.21");
+    }
+
+    private sealed record ProjectionResponse(string snapshotId, string tenantId, string schemaVersion, string hash, System.Text.Json.JsonElement projection);
+}