scaffolding hermes flow and audit logging

backend/tests/api_smoke.rs

@@ -11,10 +11,91 @@ async fn health_returns_ok() {
 
     let response = app
         .oneshot(Request::builder().uri("/health").body(Body::empty()).unwrap())
+    .await
+    .unwrap();
+
+    assert_eq!(response.status(), StatusCode::OK);
+
+    let body = to_bytes(response.into_body(), usize::MAX).await.unwrap();
+    let json: json::Value = json::from_slice(&body).unwrap();
+    assert!(json["server_time"].as_str().is_some());
+}
+
+#[tokio::test]
+async fn audit_logging_records_session_and_bet() {
+    let state = AppState::new(AppConfig::default(), None, None);
+    let app = build_router(state.clone());
+
+    let session_response = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("POST")
+                .uri("/api/v1/session/start")
+                .header("content-type", "application/json")
+                .body(Body::from("{}"))
+                .unwrap(),
+        )
         .await
         .unwrap();
 
-    assert_eq!(response.status(), StatusCode::OK);
+    let session_body = to_bytes(session_response.into_body(), usize::MAX).await.unwrap();
+    let session_json: json::Value = json::from_slice(&session_body).unwrap();
+    let session_id = session_json["session_id"].as_str().unwrap().to_string();
+
+    let event_response = app
+        .clone()
+        .oneshot(Request::builder().uri("/api/v1/feed/next").body(Body::empty()).unwrap())
+        .await
+        .unwrap();
+
+    let event_body = to_bytes(event_response.into_body(), usize::MAX).await.unwrap();
+    let event_json: json::Value = json::from_slice(&event_body).unwrap();
+    let event_id = event_json["id"].as_str().unwrap().to_string();
+
+    let markets_response = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .uri(format!("/api/v1/events/{event_id}/markets"))
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+
+    let markets_body = to_bytes(markets_response.into_body(), usize::MAX).await.unwrap();
+    let markets_json: json::Value = json::from_slice(&markets_body).unwrap();
+    let market_id = markets_json[0]["id"].as_str().unwrap().to_string();
+    let outcome_id = markets_json[0]["outcomes"][0]["id"].as_str().unwrap().to_string();
+
+    let request = json::json!({
+        "session_id": session_id,
+        "event_id": event_id,
+        "market_id": market_id,
+        "outcome_id": outcome_id,
+        "idempotency_key": "audit-bet-001",
+        "client_sent_at": Utc::now().to_rfc3339(),
+    })
+    .to_string();
+
+    let response = app
+        .oneshot(
+            Request::builder()
+                .method("POST")
+                .uri("/api/v1/bets/intent")
+                .header("content-type", "application/json")
+                .body(Body::from(request))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+
+    assert_eq!(response.status(), StatusCode::CREATED);
+
+    let (audit_events, audit_attributes) = state.audit_counts().await;
+    assert!(audit_events >= 2);
+    assert!(audit_attributes >= 10);
 }
 
 #[tokio::test]