Add comprehensive unit tests for invoice management endpoints (JIA-2)

[devin-ai-integration]

Add comprehensive unit tests for invoice management endpoints (JIA-2)

Summary

This PR adds comprehensive unit tests for all 5 invoice management endpoints (GET, POST, PUT, DELETE) that were previously untested. The test suite includes 35 test cases covering authentication, authorization, business logic, validation, and error handling scenarios.

Key additions:

• New test file: src/backend/tests/test_invoices.py (732 lines)
• Tests for all invoice CRUD operations with positive and negative scenarios
• JWT authentication and user isolation testing
• Business logic validation (invoice number generation, financial calculations)
• Data validation (required fields, date formats, item structures)
• Integration with existing test runner - now runs 42 total tests (35 new + 7 existing)

Test coverage includes:

• GET /invoices: Success with data, empty list, unauthorized access, user isolation
• POST /invoices: Success cases, validation errors, unauthorized access, invoice number uniqueness
• GET /invoices/{id}: Success, not found, user isolation, unauthorized access
• PUT /invoices/{id}: Partial/full updates, totals recalculation, validation errors
• DELETE /invoices/{id}: Success, cascade deletion, user isolation, unauthorized access
• Business logic: Financial calculations, invoice number generation patterns
• Validation: Required fields, date formats, item structures, status enums

Review & Testing Checklist for Human

🔴 High Priority (3 items)

• Verify financial calculation accuracy - Check that test expected values match business logic:
  • Invoice with 2 items (qty: 2×$50, qty: 1×$100) + 10% tax = $220 total
  • Precision calculations with decimals (3.33 × $33.33 × 1.0875 tax)
  • Tax calculations and rounding behavior
• Test user isolation manually - Critical security feature:
  • Create invoices with different users via API
  • Attempt cross-user access to verify 404 responses (not 403)
  • Test all endpoints: GET, PUT, DELETE with wrong user tokens
• Run full test suite - Ensure all tests pass and no regressions:

  cd src/backend && python3 tests/run_tests.py

Notes

• Tests use in-memory SQLite database with complete isolation between test cases
• Follows exact patterns from existing test_jwt.py for consistency
• All 35 tests currently pass (verified in development)
• Integrates seamlessly with existing test discovery and runner

Link to Devin run: https://app.devin.ai/sessions/84a3ed57db804060b3ace9c8f2e76612
Requested by: @JRWu (jia.wu@codeium.com)

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[sonarqubecloud]

Quality Gate failed

Failed conditions
2 Security Hotspots

See analysis details on SonarQube Cloud