Feat(BE-36,37,38,39): finish master data management api

test/integration/master_data/bank_test.go

@@ -0,0 +1,127 @@
+package test
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"testing"
+
+	"github.com/gofiber/fiber/v2"
+	"gorm.io/gorm"
+
+	"gitlab.com/mbugroup/lti-api.git/internal/entities"
+)
+
+func TestBankIntegration(t *testing.T) {
+	app, db := setupIntegrationApp(t)
+
+	const bankAlias = "BNI"
+	const bankName = "Bank Negara Indonesia"
+	const bankOwner = "John Doe"
+	const bankAccountNumber = "1234567890"
+	var bankID uint
+
+	t.Run("creating bank succeeds", func(t *testing.T) {
+		bankID = createBank(t, app, bankName, bankAlias, bankAccountNumber, bankOwner)
+		bank := fetchBank(t, db, bankID)
+		if bank.Alias != bankAlias {
+			t.Fatalf("expected alias %q, got %q", bankAlias, bank.Alias)
+		}
+		if bank.AccountNumber != bankAccountNumber {
+			t.Fatalf("expected account number %q, got %q", bankAccountNumber, bank.AccountNumber)
+		}
+	})
+
+	t.Run("creating bank with duplicate name fails", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPost, "/api/master-data/banks", map[string]any{
+			"name":           bankName,
+			"alias":          "NEWALIAS",
+			"owner":          "Owner Name",
+			"account_number": "1122334455",
+		})
+		if resp.StatusCode != fiber.StatusConflict {
+			t.Fatalf("expected 409 when creating duplicate bank name, got %d: %s", resp.StatusCode, string(body))
+		}
+	})
+
+	t.Run("getting existing bank succeeds", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodGet, fmt.Sprintf("/api/master-data/banks/%d", bankID), nil)
+		if resp.StatusCode != fiber.StatusOK {
+			t.Fatalf("expected 200 when fetching bank, got %d: %s", resp.StatusCode, string(body))
+		}
+		var payload struct {
+			Data struct {
+				Id            uint   `json:"id"`
+				Name          string `json:"name"`
+				Alias         string `json:"alias"`
+				AccountNumber string `json:"account_number"`
+			} `json:"data"`
+		}
+		if err := json.Unmarshal(body, &payload); err != nil {
+			t.Fatalf("failed to parse response: %v", err)
+		}
+		if payload.Data.Id != bankID {
+			t.Fatalf("expected id %d, got %d", bankID, payload.Data.Id)
+		}
+		if payload.Data.Alias != bankAlias {
+			t.Fatalf("expected alias %q, got %q", bankAlias, payload.Data.Alias)
+		}
+		if payload.Data.AccountNumber != bankAccountNumber {
+			t.Fatalf("expected account number %q, got %q", bankAccountNumber, payload.Data.AccountNumber)
+		}
+	})
+
+	const updatedName = "BNI Updated"
+
+	t.Run("updating bank name succeeds", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPatch, fmt.Sprintf("/api/master-data/banks/%d", bankID), map[string]any{
+			"name": updatedName,
+		})
+		if resp.StatusCode != fiber.StatusOK {
+			t.Fatalf("expected 200 when updating bank, got %d: %s", resp.StatusCode, string(body))
+		}
+		var payload struct {
+			Data struct {
+				Name string `json:"name"`
+			} `json:"data"`
+		}
+		if err := json.Unmarshal(body, &payload); err != nil {
+			t.Fatalf("failed to parse response: %v", err)
+		}
+		if payload.Data.Name != updatedName {
+			t.Fatalf("expected updated name %q, got %q", updatedName, payload.Data.Name)
+		}
+		bank := fetchBank(t, db, bankID)
+		if bank.Name != updatedName {
+			t.Fatalf("expected persisted name %q, got %q", updatedName, bank.Name)
+		}
+	})
+
+	t.Run("updating non existent bank returns 404", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPatch, "/api/master-data/banks/9999", map[string]any{
+			"name": "Does Not Matter",
+		})
+		if resp.StatusCode != fiber.StatusNotFound {
+			t.Fatalf("expected 404 when updating missing bank, got %d: %s", resp.StatusCode, string(body))
+		}
+	})
+
+	t.Run("deleting bank succeeds", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodDelete, fmt.Sprintf("/api/master-data/banks/%d", bankID), nil)
+		if resp.StatusCode != fiber.StatusOK {
+			t.Fatalf("expected 200 when deleting bank, got %d: %s", resp.StatusCode, string(body))
+		}
+		var bank entities.Bank
+		if err := db.First(&bank, bankID).Error; !errors.Is(err, gorm.ErrRecordNotFound) {
+			t.Fatalf("expected bank to be deleted, got error %v", err)
+		}
+	})
+
+	t.Run("deleting non existent bank returns 404", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodDelete, fmt.Sprintf("/api/master-data/banks/%d", bankID), nil)
+		if resp.StatusCode != fiber.StatusNotFound {
+			t.Fatalf("expected 404 when deleting missing bank, got %d: %s", resp.StatusCode, string(body))
+		}
+	})
+}

test/integration/master_data/customer_test.go

@@ -24,7 +24,7 @@ func TestCustomerIntegration(t *testing.T) {
 			"type":           utils.CustomerSupplierTypeBisnis,
 			"address":        "Somewhere",
 			"phone":          "0800000000",
-			"email":          "invalid@example.com",
+			"email":          "Invalid@example.com",
 			"account_number": "ACC-INVALID",
 		})
 		if resp.StatusCode != fiber.StatusNotFound {
@@ -32,18 +32,18 @@ func TestCustomerIntegration(t *testing.T) {
 		}
 	})
 
-	t.Run("creating customer with invalid type fails", func(t *testing.T) {
+	t.Run("creating customer with Invalid type fails", func(t *testing.T) {
 		resp, body := doJSONRequest(t, app, http.MethodPost, "/api/master-data/customers", map[string]any{
 			"name":           "Invalid Type",
 			"pic_id":         1,
 			"type":           "UNKNOWN",
 			"address":        "Somewhere",
 			"phone":          "081234567891",
-			"email":          "invalid-type@example.com",
+			"email":          "Invalid-type@example.com",
 			"account_number": "ACC-INVALID-TYPE",
 		})
 		if resp.StatusCode != fiber.StatusBadRequest {
-			t.Fatalf("expected 400 when type is invalid, got %d: %s", resp.StatusCode, string(body))
+			t.Fatalf("expected 400 when type is Invalid, got %d: %s", resp.StatusCode, string(body))
 		}
 	})
 
@@ -140,16 +140,16 @@ func TestCustomerIntegration(t *testing.T) {
 		}
 	})
 
-	t.Run("updating customer with invalid type fails", func(t *testing.T) {
+	t.Run("updating customer with Invalid type fails", func(t *testing.T) {
 		resp, body := doJSONRequest(t, app, http.MethodPatch, fmt.Sprintf("/api/master-data/customers/%d", customerID), map[string]any{
 			"type": "random-type",
 		})
 		if resp.StatusCode != fiber.StatusBadRequest {
-			t.Fatalf("expected 400 when updating with invalid type, got %d: %s", resp.StatusCode, string(body))
+			t.Fatalf("expected 400 when updating with Invalid type, got %d: %s", resp.StatusCode, string(body))
 		}
 		customer := fetchCustomer(t, db, customerID)
 		if customer.Type != string(utils.CustomerSupplierTypeIndividual) {
-			t.Fatalf("expected type to remain %q after invalid update, got %q", utils.CustomerSupplierTypeIndividual, customer.Type)
+			t.Fatalf("expected type to remain %q after Invalid update, got %q", utils.CustomerSupplierTypeIndividual, customer.Type)
 		}
 	})
 

test/integration/master_data/fcr_test.go

@@ -0,0 +1,218 @@
+package test
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"testing"
+
+	"github.com/gofiber/fiber/v2"
+	"gorm.io/gorm"
+
+	"gitlab.com/mbugroup/lti-api.git/internal/entities"
+)
+
+func TestFcrIntegration(t *testing.T) {
+	app, db := setupIntegrationApp(t)
+
+	t.Run("creating fcr without standards fails", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPost, "/api/master-data/fcrs", map[string]any{
+			"name": "FCR Alpha",
+		})
+		if resp.StatusCode != fiber.StatusBadRequest {
+			t.Fatalf("expected 400 when standards missing, got %d: %s", resp.StatusCode, string(body))
+		}
+	})
+
+	initialStandards := []map[string]any{
+		{
+			"weight":     7.2,
+			"fcr_number": 400.0,
+			"mortality":  12.0,
+		},
+		{
+			"weight":     7.4,
+			"fcr_number": 410.0,
+			"mortality":  11.5,
+		},
+	}
+
+	var fcrID uint
+
+	t.Run("creating fcr succeeds", func(t *testing.T) {
+		fcrID = createFcr(t, app, "FCR Layer", initialStandards)
+		fcr := fetchFcr(t, db, fcrID)
+		if fcr.Name != "FCR Layer" {
+			t.Fatalf("expected name FCR Layer, got %q", fcr.Name)
+		}
+		if len(fcr.Standards) != len(initialStandards) {
+			t.Fatalf("expected %d standards, got %d", len(initialStandards), len(fcr.Standards))
+		}
+		if fcr.CreatedBy != 1 {
+			t.Fatalf("expected created_by 1, got %d", fcr.CreatedBy)
+		}
+	})
+
+	t.Run("creating duplicate fcr name fails", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPost, "/api/master-data/fcrs", map[string]any{
+			"name":          "FCR Layer",
+			"fcr_standards": initialStandards,
+		})
+		if resp.StatusCode != fiber.StatusConflict {
+			t.Fatalf("expected 409 when creating duplicate, got %d: %s", resp.StatusCode, string(body))
+		}
+	})
+
+	t.Run("getting fcr detail succeeds", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodGet, fmt.Sprintf("/api/master-data/fcrs/%d", fcrID), nil)
+		if resp.StatusCode != fiber.StatusOK {
+			t.Fatalf("expected 200 when fetching fcr, got %d: %s", resp.StatusCode, string(body))
+		}
+		var payload struct {
+			Data struct {
+				Id           uint             `json:"id"`
+				Name         string           `json:"name"`
+				FcrStandards []map[string]any `json:"fcr_standards"`
+			} `json:"data"`
+		}
+		if err := json.Unmarshal(body, &payload); err != nil {
+			t.Fatalf("failed to parse fcr detail: %v", err)
+		}
+		if payload.Data.Id != fcrID {
+			t.Fatalf("expected id %d, got %d", fcrID, payload.Data.Id)
+		}
+		if len(payload.Data.FcrStandards) != len(initialStandards) {
+			t.Fatalf("expected %d standards in response, got %d", len(initialStandards), len(payload.Data.FcrStandards))
+		}
+	})
+
+	updatedStandards := []map[string]any{
+		{
+			"weight":     7.2,
+			"fcr_number": 395.0,
+			"mortality":  10.0,
+		},
+		{
+			"weight":     7.5,
+			"fcr_number": 420.0,
+			"mortality":  13.0,
+		},
+	}
+
+	t.Run("updating fcr name and standards succeeds", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPatch, fmt.Sprintf("/api/master-data/fcrs/%d", fcrID), map[string]any{
+			"name":          "FCR Layer Updated",
+			"fcr_standards": updatedStandards,
+		})
+		if resp.StatusCode != fiber.StatusOK {
+			t.Fatalf("expected 200 when updating fcr, got %d: %s", resp.StatusCode, string(body))
+		}
+		var payload struct {
+			Data struct {
+				Name         string           `json:"name"`
+				FcrStandards []map[string]any `json:"fcr_standards"`
+			} `json:"data"`
+		}
+		if err := json.Unmarshal(body, &payload); err != nil {
+			t.Fatalf("failed to parse update response: %v", err)
+		}
+		if payload.Data.Name != "FCR Layer Updated" {
+			t.Fatalf("expected updated name, got %q", payload.Data.Name)
+		}
+		if len(payload.Data.FcrStandards) != len(updatedStandards) {
+			t.Fatalf("expected %d standards after update, got %d", len(updatedStandards), len(payload.Data.FcrStandards))
+		}
+		fcr := fetchFcr(t, db, fcrID)
+		if fcr.Name != "FCR Layer Updated" {
+			t.Fatalf("expected persisted name FCR Layer Updated, got %q", fcr.Name)
+		}
+		if len(fcr.Standards) != len(updatedStandards) {
+			t.Fatalf("expected %d persisted standards, got %d", len(updatedStandards), len(fcr.Standards))
+		}
+		if fcr.Standards[0].FcrNumber != 395.0 {
+			t.Fatalf("expected first standard fcr_number 395, got %f", fcr.Standards[0].FcrNumber)
+		}
+	})
+
+	var otherFcrID uint
+	t.Run("creating another fcr for duplicate update", func(t *testing.T) {
+		otherFcrID = createFcr(t, app, "FCR Grower", []map[string]any{
+			{
+				"weight":     8.0,
+				"fcr_number": 430.0,
+				"mortality":  9.0,
+			},
+		})
+		if otherFcrID == 0 {
+			t.Fatal("expected other fcr id to be non zero")
+		}
+	})
+
+	t.Run("updating fcr with duplicate name fails", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPatch, fmt.Sprintf("/api/master-data/fcrs/%d", fcrID), map[string]any{
+			"name": "FCR Grower",
+		})
+		if resp.StatusCode != fiber.StatusConflict {
+			t.Fatalf("expected 409 when renaming to existing fcr, got %d: %s", resp.StatusCode, string(body))
+		}
+		fcr := fetchFcr(t, db, fcrID)
+		if fcr.Name != "FCR Layer Updated" {
+			t.Fatalf("expected name unchanged after failed update, got %q", fcr.Name)
+		}
+	})
+
+	t.Run("updating fcr with invalid standards fails", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPatch, fmt.Sprintf("/api/master-data/fcrs/%d", fcrID), map[string]any{
+			"fcr_standards": []map[string]any{
+				{
+					"weight":     -1,
+					"fcr_number": 300,
+					"mortality":  5,
+				},
+			},
+		})
+		if resp.StatusCode != fiber.StatusBadRequest {
+			t.Fatalf("expected 400 when updating with invalid standard, got %d: %s", resp.StatusCode, string(body))
+		}
+	})
+
+	t.Run("deleting fcr succeeds", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodDelete, fmt.Sprintf("/api/master-data/fcrs/%d", fcrID), nil)
+		if resp.StatusCode != fiber.StatusOK {
+			t.Fatalf("expected 200 when deleting fcr, got %d: %s", resp.StatusCode, string(body))
+		}
+		var fcr entities.Fcr
+		if err := db.First(&fcr, fcrID).Error; !errors.Is(err, gorm.ErrRecordNotFound) {
+			t.Fatalf("expected fcr to be deleted, got error %v", err)
+		}
+		var standardsCount int64
+		if err := db.Model(&entities.FcrStandard{}).Where("fcr_id = ?", fcrID).Count(&standardsCount).Error; err != nil {
+			t.Fatalf("failed counting standards: %v", err)
+		}
+		if standardsCount != 0 {
+			t.Fatalf("expected standards removed, found %d", standardsCount)
+		}
+	})
+
+	t.Run("deleting fcr again returns 404", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodDelete, fmt.Sprintf("/api/master-data/fcrs/%d", fcrID), nil)
+		if resp.StatusCode != fiber.StatusNotFound {
+			t.Fatalf("expected 404 when deleting missing fcr, got %d: %s", resp.StatusCode, string(body))
+		}
+	})
+
+	t.Run("getting deleted fcr returns 404", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodGet, fmt.Sprintf("/api/master-data/fcrs/%d", fcrID), nil)
+		if resp.StatusCode != fiber.StatusNotFound {
+			t.Fatalf("expected 404 when fetching deleted fcr, got %d: %s", resp.StatusCode, string(body))
+		}
+	})
+
+	t.Run("cleanup other fcr", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodDelete, fmt.Sprintf("/api/master-data/fcrs/%d", otherFcrID), nil)
+		if resp.StatusCode != fiber.StatusOK {
+			t.Fatalf("expected 200 when deleting other fcr, got %d: %s", resp.StatusCode, string(body))
+		}
+	})
+}

test/integration/master_data/master_data.go

@@ -44,6 +44,16 @@ func setupIntegrationApp(t *testing.T) (*fiber.App, *gorm.DB) {
 		&entities.Warehouse{},
 		&entities.Uom{},
 		&entities.Customer{},
+		&entities.Supplier{},
+		&entities.Flag{},
+		&entities.ProductCategory{},
+		&entities.Nonstock{},
+		&entities.NonstockSupplier{},
+		&entities.Product{},
+		&entities.ProductSupplier{},
+		&entities.Fcr{},
+		&entities.FcrStandard{},
+		&entities.Bank{},
 	); err != nil {
 		t.Fatalf("auto migrate failed: %v", err)
 	}
@@ -60,7 +70,7 @@ func setupIntegrationApp(t *testing.T) (*fiber.App, *gorm.DB) {
 		t.Fatalf("failed to seed user: %v", err)
 	}
 
-	app := fiber.New()
+	app := fiber.New(fiber.Config{ErrorHandler: utils.ErrorHandler})
 	route.Routes(app, db)
 	return app, db
 }
@@ -129,6 +139,15 @@ func createLocation(t *testing.T, app *fiber.App, name, address string, areaID u
 	return parseID(t, body)
 }
 
+func createUom(t *testing.T, app *fiber.App, name string) uint {
+	t.Helper()
+	resp, body := doJSONRequest(t, app, http.MethodPost, "/api/master-data/uoms", map[string]any{"name": name})
+	if resp.StatusCode != fiber.StatusCreated {
+		t.Fatalf("expected 201 when creating uom, got %d: %s", resp.StatusCode, string(body))
+	}
+	return parseID(t, body)
+}
+
 func createKandang(t *testing.T, app *fiber.App, name string, locationID, picID uint) uint {
 	t.Helper()
 	resp, body := doJSONRequest(t, app, http.MethodPost, "/api/master-data/kandangs", map[string]any{
@@ -169,6 +188,152 @@ func fetchCustomer(t *testing.T, db *gorm.DB, id uint) entities.Customer {
 	return customer
 }
 
+func createSupplier(t *testing.T, app *fiber.App, name, alias, category string) uint {
+	t.Helper()
+	identifier := strings.ToLower(strings.ReplaceAll(name, " ", "_"))
+	resp, body := doJSONRequest(t, app, http.MethodPost, "/api/master-data/suppliers", map[string]any{
+		"name":           name,
+		"alias":          alias,
+		"pic":            "John Doe",
+		"type":           utils.CustomerSupplierTypeBisnis,
+		"category":       category,
+		"hatchery":       "Hatchery A",
+		"phone":          "081234567890",
+		"email":          fmt.Sprintf("%s@supplier.com", identifier),
+		"address":        "Supplier address",
+		"npwp":           "NPWP-123",
+		"account_number": "ACC-SUPPLIER",
+		"due_date":       30,
+	})
+	if resp.StatusCode != fiber.StatusCreated {
+		t.Fatalf("expected 201 when creating supplier, got %d: %s", resp.StatusCode, string(body))
+	}
+	return parseID(t, body)
+}
+
+func createProductCategory(t *testing.T, app *fiber.App, name, code string) uint {
+	t.Helper()
+	resp, body := doJSONRequest(t, app, http.MethodPost, "/api/master-data/product-categories", map[string]any{
+		"name": name,
+		"code": code,
+	})
+	if resp.StatusCode != fiber.StatusCreated {
+		t.Fatalf("expected 201 when creating product category, got %d: %s", resp.StatusCode, string(body))
+	}
+	return parseID(t, body)
+}
+
+func fetchProductCategory(t *testing.T, db *gorm.DB, id uint) entities.ProductCategory {
+	t.Helper()
+	var pc entities.ProductCategory
+	if err := db.Preload("CreatedUser").First(&pc, id).Error; err != nil {
+		t.Fatalf("failed to fetch product category: %v", err)
+	}
+	return pc
+}
+
+func createProduct(t *testing.T, app *fiber.App, name, brand string, sku *string, uomID, categoryID uint, productPrice float64, supplierIDs []uint, flags []string) uint {
+	t.Helper()
+	payload := map[string]any{
+		"name":                name,
+		"brand":               brand,
+		"uom_id":              uomID,
+		"product_category_id": categoryID,
+		"product_price":       productPrice,
+		"supplier_ids":        supplierIDs,
+	}
+	if sku != nil {
+		payload["sku"] = *sku
+	}
+	if len(flags) > 0 {
+		payload["flags"] = flags
+	}
+	resp, body := doJSONRequest(t, app, http.MethodPost, "/api/master-data/products", payload)
+	if resp.StatusCode != fiber.StatusCreated {
+		t.Fatalf("expected 201 when creating product, got %d: %s", resp.StatusCode, string(body))
+	}
+	return parseID(t, body)
+}
+
+func fetchProduct(t *testing.T, db *gorm.DB, id uint) entities.Product {
+	t.Helper()
+	var product entities.Product
+	if err := db.Preload("CreatedUser").
+		Preload("Uom").
+		Preload("ProductCategory").
+		Preload("Suppliers", func(tx *gorm.DB) *gorm.DB { return tx.Order("suppliers.name ASC") }).
+		Preload("Flags", func(tx *gorm.DB) *gorm.DB { return tx.Order("flags.name ASC") }).
+		First(&product, id).Error; err != nil {
+		t.Fatalf("failed to fetch product: %v", err)
+	}
+	return product
+}
+
+func fetchSupplier(t *testing.T, db *gorm.DB, id uint) entities.Supplier {
+	t.Helper()
+	var supplier entities.Supplier
+	if err := db.Preload("CreatedUser").First(&supplier, id).Error; err != nil {
+		t.Fatalf("failed to fetch supplier: %v", err)
+	}
+	return supplier
+}
+
+func createFcr(t *testing.T, app *fiber.App, name string, standards []map[string]any) uint {
+	t.Helper()
+	payload := map[string]any{
+		"name":          name,
+		"fcr_standards": standards,
+	}
+	resp, body := doJSONRequest(t, app, http.MethodPost, "/api/master-data/fcrs", payload)
+	if resp.StatusCode != fiber.StatusCreated {
+		t.Fatalf("expected 201 when creating fcr, got %d: %s", resp.StatusCode, string(body))
+	}
+	return parseID(t, body)
+}
+
+func fetchFcr(t *testing.T, db *gorm.DB, id uint) entities.Fcr {
+	t.Helper()
+	var fcr entities.Fcr
+	if err := db.Preload("CreatedUser").
+		Preload("Standards", func(tx *gorm.DB) *gorm.DB {
+			return tx.Order("weight ASC")
+		}).
+		First(&fcr, id).Error; err != nil {
+		t.Fatalf("failed to fetch fcr: %v", err)
+	}
+	return fcr
+}
+
+func createNonstock(t *testing.T, app *fiber.App, name string, uomID uint, supplierIDs []uint, flags []string) uint {
+	t.Helper()
+	payload := map[string]any{
+		"name":         name,
+		"uom_id":       uomID,
+		"supplier_ids": supplierIDs,
+	}
+	if len(flags) > 0 {
+		payload["flags"] = flags
+	}
+	resp, body := doJSONRequest(t, app, http.MethodPost, "/api/master-data/nonstocks", payload)
+	if resp.StatusCode != fiber.StatusCreated {
+		t.Fatalf("expected 201 when creating nonstock, got %d: %s", resp.StatusCode, string(body))
+	}
+	return parseID(t, body)
+}
+
+func fetchNonstock(t *testing.T, db *gorm.DB, id uint) entities.Nonstock {
+	t.Helper()
+	var nonstock entities.Nonstock
+	if err := db.Preload("CreatedUser").
+		Preload("Uom").
+		Preload("Suppliers", func(tx *gorm.DB) *gorm.DB { return tx.Order("suppliers.name ASC") }).
+		Preload("Flags", func(tx *gorm.DB) *gorm.DB { return tx.Order("flags.name ASC") }).
+		First(&nonstock, id).Error; err != nil {
+		t.Fatalf("failed to fetch nonstock: %v", err)
+	}
+	return nonstock
+}
+
 func fetchAreaName(t *testing.T, db *gorm.DB, id uint) string {
 	t.Helper()
 	var area entities.Area
@@ -186,3 +351,27 @@ func fetchWarehouse(t *testing.T, db *gorm.DB, id uint) entities.Warehouse {
 	}
 	return wh
 }
+
+func createBank(t *testing.T, app *fiber.App, name, alias, accountNumber string, owner any) uint {
+	t.Helper()
+	payload := map[string]any{
+		"name":           name,
+		"alias":          alias,
+		"account_number": accountNumber,
+		"owner":          owner,
+	}
+	resp, body := doJSONRequest(t, app, http.MethodPost, "/api/master-data/banks", payload)
+	if resp.StatusCode != fiber.StatusCreated {
+		t.Fatalf("expected 201 when creating bank, got %d: %s", resp.StatusCode, string(body))
+	}
+	return parseID(t, body)
+}
+
+func fetchBank(t *testing.T, db *gorm.DB, id uint) entities.Bank {
+	t.Helper()
+	var bank entities.Bank
+	if err := db.Preload("CreatedUser").First(&bank, id).Error; err != nil {
+		t.Fatalf("failed to fetch bank: %v", err)
+	}
+	return bank
+}

test/integration/master_data/nonstock_test.go

@@ -0,0 +1,309 @@
+package test
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/gofiber/fiber/v2"
+	"gorm.io/gorm"
+
+	"gitlab.com/mbugroup/lti-api.git/internal/entities"
+	"gitlab.com/mbugroup/lti-api.git/internal/utils"
+)
+
+func TestNonstockIntegration(t *testing.T) {
+	app, db := setupIntegrationApp(t)
+
+	uomID := createUom(t, app, "Unit Piece")
+	altUomID := createUom(t, app, "Unit Box")
+
+	supplierID1 := createSupplier(t, app, "Nonstock Supplier One", "ns1", string(utils.SupplierCategoryBOP))
+	supplierID2 := createSupplier(t, app, "Nonstock Supplier Two", "ns2", string(utils.SupplierCategoryBOP))
+	supplierID3 := createSupplier(t, app, "Nonstock Supplier Three", "ns3", string(utils.SupplierCategoryBOP))
+	sapronakSupplierID := createSupplier(t, app, "SAPRONAK Supplier", "sap1", string(utils.SupplierCategorySapronak))
+
+	nonstockFlags := []string{string(utils.FlagEkspedisi)}
+
+	t.Run("create nonstock without suppliers succeeds with empty relations", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPost, "/api/master-data/nonstocks", map[string]any{
+			"name":   "Supplierless Nonstock",
+			"uom_id": uomID,
+		})
+		if resp.StatusCode != fiber.StatusCreated {
+			t.Fatalf("expected 201 when suppliers omitted, got %d: %s", resp.StatusCode, string(body))
+		}
+		id := parseID(t, body)
+		ns := fetchNonstock(t, db, id)
+		if len(ns.Suppliers) != 0 {
+			t.Fatalf("expected no suppliers persisted, found %d", len(ns.Suppliers))
+		}
+		if len(ns.Flags) != 0 {
+			t.Fatalf("expected no flags persisted, found %d", len(ns.Flags))
+		}
+		resp, _ = doJSONRequest(t, app, http.MethodDelete, fmt.Sprintf("/api/master-data/nonstocks/%d", id), nil)
+		if resp.StatusCode != fiber.StatusOK {
+			t.Fatalf("expected cleanup delete to succeed, got %d", resp.StatusCode)
+		}
+	})
+
+	t.Run("create nonstock with unknown supplier fails", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPost, "/api/master-data/nonstocks", map[string]any{
+			"name":         "Unknown Supplier Nonstock",
+			"uom_id":       uomID,
+			"supplier_ids": []uint{99999},
+		})
+		if resp.StatusCode != fiber.StatusNotFound {
+			t.Fatalf("expected 404 when supplier missing, got %d: %s", resp.StatusCode, string(body))
+		}
+	})
+
+	t.Run("create nonstock with sapronak supplier fails", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPost, "/api/master-data/nonstocks", map[string]any{
+			"name":         "Invalid Category Nonstock",
+			"uom_id":       uomID,
+			"supplier_ids": []uint{sapronakSupplierID},
+		})
+		if resp.StatusCode != fiber.StatusBadRequest {
+			t.Fatalf("expected 400 when supplier category is not BOP, got %d: %s", resp.StatusCode, string(body))
+		}
+	})
+
+	t.Run("create nonstock with invalid flags fails", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPost, "/api/master-data/nonstocks", map[string]any{
+			"name":         "Invalid Flag Nonstock",
+			"uom_id":       uomID,
+			"supplier_ids": []uint{supplierID1},
+			"flags":        []string{"UNKNOWN"},
+		})
+		if resp.StatusCode != fiber.StatusBadRequest {
+			t.Fatalf("expected 400 when flags invalid, got %d: %s", resp.StatusCode, string(body))
+		}
+	})
+
+	var nonstockID uint
+
+	t.Run("create nonstock succeeds", func(t *testing.T) {
+		nonstockID = createNonstock(t, app, "Layer Feed", uomID, []uint{supplierID1, supplierID2, supplierID1}, nonstockFlags)
+		if nonstockID == 0 {
+			t.Fatal("expected nonstock id to be non zero")
+		}
+		ns := fetchNonstock(t, db, nonstockID)
+		if ns.Name != "Layer Feed" {
+			t.Fatalf("expected name Layer Feed, got %q", ns.Name)
+		}
+		if ns.UomId != uomID {
+			t.Fatalf("expected uom_id %d, got %d", uomID, ns.UomId)
+		}
+		if ns.CreatedBy != 1 {
+			t.Fatalf("expected created_by 1, got %d", ns.CreatedBy)
+		}
+		if len(ns.Suppliers) != 2 {
+			t.Fatalf("expected 2 unique suppliers, got %d", len(ns.Suppliers))
+		}
+		if len(ns.Flags) != len(nonstockFlags) {
+			t.Fatalf("expected %d flags, got %d", len(nonstockFlags), len(ns.Flags))
+		}
+		expectedFlags := make(map[string]struct{}, len(nonstockFlags))
+		for _, flag := range nonstockFlags {
+			expectedFlags[strings.ToUpper(flag)] = struct{}{}
+		}
+		for _, flag := range ns.Flags {
+			upper := strings.ToUpper(flag.Name)
+			if _, ok := expectedFlags[upper]; !ok {
+				t.Fatalf("unexpected flag stored: %s", upper)
+			}
+			delete(expectedFlags, upper)
+		}
+		if len(expectedFlags) != 0 {
+			t.Fatalf("missing flags after create: %v", expectedFlags)
+		}
+	})
+
+	t.Run("get nonstock detail includes suppliers", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodGet, fmt.Sprintf("/api/master-data/nonstocks/%d", nonstockID), nil)
+		if resp.StatusCode != fiber.StatusOK {
+			t.Fatalf("expected 200 when fetching nonstock, got %d: %s", resp.StatusCode, string(body))
+		}
+		var payload struct {
+			Data struct {
+				Id        uint             `json:"id"`
+				Name      string           `json:"name"`
+				UomID     uint             `json:"uom_id"`
+				Suppliers []map[string]any `json:"suppliers"`
+				Flags     []string         `json:"flags"`
+			} `json:"data"`
+		}
+		if err := json.Unmarshal(body, &payload); err != nil {
+			t.Fatalf("failed to parse nonstock detail: %v", err)
+		}
+		if payload.Data.Id != nonstockID {
+			t.Fatalf("expected id %d, got %d", nonstockID, payload.Data.Id)
+		}
+		if payload.Data.UomID != uomID {
+			t.Fatalf("expected response uom_id %d, got %d", uomID, payload.Data.UomID)
+		}
+		if len(payload.Data.Suppliers) != 2 {
+			t.Fatalf("expected 2 suppliers in response, got %d", len(payload.Data.Suppliers))
+		}
+		if len(payload.Data.Flags) != len(nonstockFlags) {
+			t.Fatalf("expected %d flags in response, got %d", len(nonstockFlags), len(payload.Data.Flags))
+		}
+		expected := make(map[string]struct{}, len(nonstockFlags))
+		for _, flag := range nonstockFlags {
+			expected[strings.ToUpper(flag)] = struct{}{}
+		}
+		for _, flag := range payload.Data.Flags {
+			flag = strings.ToUpper(flag)
+			if _, ok := expected[flag]; !ok {
+				t.Fatalf("unexpected flag %s returned", flag)
+			}
+			delete(expected, flag)
+		}
+		if len(expected) != 0 {
+			t.Fatalf("missing flags in response: %v", expected)
+		}
+	})
+
+	t.Run("update nonstock with invalid uom fails", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPatch, fmt.Sprintf("/api/master-data/nonstocks/%d", nonstockID), map[string]any{
+			"uom_id": 99999,
+		})
+		if resp.StatusCode != fiber.StatusNotFound {
+			t.Fatalf("expected 404 when updating with invalid uom, got %d: %s", resp.StatusCode, string(body))
+		}
+	})
+
+	t.Run("update nonstock with invalid supplier fails", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPatch, fmt.Sprintf("/api/master-data/nonstocks/%d", nonstockID), map[string]any{
+			"supplier_ids": []uint{supplierID1, 99999},
+		})
+		if resp.StatusCode != fiber.StatusNotFound {
+			t.Fatalf("expected 404 when updating with invalid supplier, got %d: %s", resp.StatusCode, string(body))
+		}
+	})
+
+	t.Run("update nonstock with sapronak supplier fails", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPatch, fmt.Sprintf("/api/master-data/nonstocks/%d", nonstockID), map[string]any{
+			"supplier_ids": []uint{sapronakSupplierID},
+		})
+		if resp.StatusCode != fiber.StatusBadRequest {
+			t.Fatalf("expected 400 when updating with non-BOP supplier, got %d: %s", resp.StatusCode, string(body))
+		}
+	})
+
+	t.Run("update nonstock with invalid flags fails", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPatch, fmt.Sprintf("/api/master-data/nonstocks/%d", nonstockID), map[string]any{
+			"flags": []string{"BAD"},
+		})
+		if resp.StatusCode != fiber.StatusBadRequest {
+			t.Fatalf("expected 400 when updating flags invalid, got %d: %s", resp.StatusCode, string(body))
+		}
+	})
+
+	t.Run("update nonstock name uom and suppliers succeeds", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPatch, fmt.Sprintf("/api/master-data/nonstocks/%d", nonstockID), map[string]any{
+			"name":         "Layer Feed Premium",
+			"uom_id":       altUomID,
+			"supplier_ids": []uint{supplierID3},
+			"flags":        nonstockFlags,
+		})
+		if resp.StatusCode != fiber.StatusOK {
+			t.Fatalf("expected 200 when updating nonstock, got %d: %s", resp.StatusCode, string(body))
+		}
+		ns := fetchNonstock(t, db, nonstockID)
+		if ns.Name != "Layer Feed Premium" {
+			t.Fatalf("expected name Layer Feed Premium, got %q", ns.Name)
+		}
+		if ns.UomId != altUomID {
+			t.Fatalf("expected uom_id %d, got %d", altUomID, ns.UomId)
+		}
+		if len(ns.Suppliers) != 1 || ns.Suppliers[0].Id != supplierID3 {
+			t.Fatalf("expected suppliers to contain only %d", supplierID3)
+		}
+		if len(ns.Flags) != len(nonstockFlags) {
+			t.Fatalf("expected flags retained, got %d", len(ns.Flags))
+		}
+	})
+
+	t.Run("clear suppliers succeeds", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPatch, fmt.Sprintf("/api/master-data/nonstocks/%d", nonstockID), map[string]any{
+			"supplier_ids": []uint{},
+		})
+		if resp.StatusCode != fiber.StatusOK {
+			t.Fatalf("expected 200 when clearing suppliers, got %d: %s", resp.StatusCode, string(body))
+		}
+		ns := fetchNonstock(t, db, nonstockID)
+		if len(ns.Suppliers) != 0 {
+			t.Fatalf("expected suppliers to be cleared, got %d entries", len(ns.Suppliers))
+		}
+		if len(ns.Flags) != len(nonstockFlags) {
+			t.Fatalf("expected flags unaffected, got %d", len(ns.Flags))
+		}
+	})
+
+	t.Run("clear nonstock flags succeeds", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPatch, fmt.Sprintf("/api/master-data/nonstocks/%d", nonstockID), map[string]any{
+			"flags": []string{},
+		})
+		if resp.StatusCode != fiber.StatusOK {
+			t.Fatalf("expected 200 when clearing nonstock flags, got %d: %s", resp.StatusCode, string(body))
+		}
+		ns := fetchNonstock(t, db, nonstockID)
+		if len(ns.Flags) != 0 {
+			t.Fatalf("expected flags cleared, got %d", len(ns.Flags))
+		}
+	})
+
+	t.Run("delete nonstock succeeds", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodDelete, fmt.Sprintf("/api/master-data/nonstocks/%d", nonstockID), nil)
+		if resp.StatusCode != fiber.StatusOK {
+			t.Fatalf("expected 200 when deleting nonstock, got %d: %s", resp.StatusCode, string(body))
+		}
+		var ns entities.Nonstock
+		if err := db.First(&ns, nonstockID).Error; !errors.Is(err, gorm.ErrRecordNotFound) {
+			t.Fatalf("expected nonstock to be deleted, got error %v", err)
+		}
+		var links int64
+		if err := db.Model(&entities.NonstockSupplier{}).Where("nonstock_id = ?", nonstockID).Count(&links).Error; err != nil {
+			t.Fatalf("failed counting nonstock suppliers: %v", err)
+		}
+		if links != 0 {
+			t.Fatalf("expected link table cleared, found %d rows", links)
+		}
+		var flagCount int64
+		if err := db.Model(&entities.Flag{}).
+			Where("flagable_id = ? AND flagable_type = ?", nonstockID, entities.FlagableTypeNonstock).
+			Count(&flagCount).Error; err != nil {
+			t.Fatalf("failed counting nonstock flags: %v", err)
+		}
+		if flagCount != 0 {
+			t.Fatalf("expected flags removed, found %d", flagCount)
+		}
+	})
+
+	t.Run("deleting nonstock twice returns 404", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodDelete, fmt.Sprintf("/api/master-data/nonstocks/%d", nonstockID), nil)
+		if resp.StatusCode != fiber.StatusNotFound {
+			t.Fatalf("expected 404 when deleting missing nonstock, got %d: %s", resp.StatusCode, string(body))
+		}
+	})
+
+	t.Run("fetching deleted nonstock returns 404", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodGet, fmt.Sprintf("/api/master-data/nonstocks/%d", nonstockID), nil)
+		if resp.StatusCode != fiber.StatusNotFound {
+			t.Fatalf("expected 404 when fetching deleted nonstock, got %d: %s", resp.StatusCode, string(body))
+		}
+	})
+
+	t.Run("cleanup additional supplier references", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodDelete, fmt.Sprintf("/api/master-data/suppliers/%d", supplierID3), nil)
+		if resp.StatusCode != fiber.StatusOK {
+			t.Fatalf("expected 200 when deleting supplier, got %d: %s", resp.StatusCode, string(body))
+		}
+		doJSONRequest(t, app, http.MethodDelete, fmt.Sprintf("/api/master-data/suppliers/%d", sapronakSupplierID), nil)
+	})
+}

test/integration/master_data/product_category_test.go

@@ -0,0 +1,150 @@
+package test
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"testing"
+
+	"github.com/gofiber/fiber/v2"
+	"gorm.io/gorm"
+
+	"gitlab.com/mbugroup/lti-api.git/internal/entities"
+)
+
+func TestProductCategoryIntegration(t *testing.T) {
+	app, db := setupIntegrationApp(t)
+
+	t.Run("create product category missing code fails", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPost, "/api/master-data/product-categories", map[string]any{
+			"name": "Layer Feed",
+		})
+		if resp.StatusCode != fiber.StatusBadRequest {
+			t.Fatalf("expected 400 when code missing, got %d: %s", resp.StatusCode, string(body))
+		}
+	})
+
+	var categoryID uint
+
+	t.Run("create product category succeeds", func(t *testing.T) {
+		categoryID = createProductCategory(t, app, "Layer Feed", "LFD")
+		pc := fetchProductCategory(t, db, categoryID)
+		if pc.Name != "Layer Feed" {
+			t.Fatalf("expected name Layer Feed, got %q", pc.Name)
+		}
+		if pc.Code != "LFD" {
+			t.Fatalf("expected code LFD, got %q", pc.Code)
+		}
+		if pc.CreatedBy != 1 {
+			t.Fatalf("expected created_by 1, got %d", pc.CreatedBy)
+		}
+	})
+
+	t.Run("creating duplicate name fails", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPost, "/api/master-data/product-categories", map[string]any{
+			"name": "Layer Feed",
+			"code": "LF2",
+		})
+		if resp.StatusCode != fiber.StatusConflict {
+			t.Fatalf("expected 409 when creating duplicate name, got %d: %s", resp.StatusCode, string(body))
+		}
+	})
+
+	t.Run("creating duplicate code fails", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPost, "/api/master-data/product-categories", map[string]any{
+			"name": "Layer Feed Premium",
+			"code": "LFD",
+		})
+		if resp.StatusCode != fiber.StatusConflict {
+			t.Fatalf("expected 409 when creating duplicate code, got %d: %s", resp.StatusCode, string(body))
+		}
+	})
+
+	t.Run("get product category detail", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodGet, fmt.Sprintf("/api/master-data/product-categories/%d", categoryID), nil)
+		if resp.StatusCode != fiber.StatusOK {
+			t.Fatalf("expected 200 when fetching product category, got %d: %s", resp.StatusCode, string(body))
+		}
+		var payload struct {
+			Data struct {
+				Id   uint   `json:"id"`
+				Name string `json:"name"`
+				Code string `json:"code"`
+			} `json:"data"`
+		}
+		if err := json.Unmarshal(body, &payload); err != nil {
+			t.Fatalf("failed to parse response: %v", err)
+		}
+		if payload.Data.Id != categoryID {
+			t.Fatalf("expected id %d, got %d", categoryID, payload.Data.Id)
+		}
+		if payload.Data.Code != "LFD" {
+			t.Fatalf("expected code LFD, got %q", payload.Data.Code)
+		}
+	})
+
+	t.Run("update product category with duplicate name fails", func(t *testing.T) {
+		otherID := createProductCategory(t, app, "Layer Feed Alt", "LFA")
+		resp, body := doJSONRequest(t, app, http.MethodPatch, fmt.Sprintf("/api/master-data/product-categories/%d", otherID), map[string]any{
+			"name": "Layer Feed",
+		})
+		if resp.StatusCode != fiber.StatusConflict {
+			t.Fatalf("expected 409 when updating with duplicate name, got %d: %s", resp.StatusCode, string(body))
+		}
+	})
+
+	t.Run("update product category succeeds", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPatch, fmt.Sprintf("/api/master-data/product-categories/%d", categoryID), map[string]any{
+			"name": "Layer Feed Updated",
+			"code": "LFU",
+		})
+		if resp.StatusCode != fiber.StatusOK {
+			t.Fatalf("expected 200 when updating product category, got %d: %s", resp.StatusCode, string(body))
+		}
+		var payload struct {
+			Data struct {
+				Name string `json:"name"`
+				Code string `json:"code"`
+			} `json:"data"`
+		}
+		if err := json.Unmarshal(body, &payload); err != nil {
+			t.Fatalf("failed to parse update response: %v", err)
+		}
+		if payload.Data.Name != "Layer Feed Updated" {
+			t.Fatalf("expected updated name, got %q", payload.Data.Name)
+		}
+		if payload.Data.Code != "LFU" {
+			t.Fatalf("expected code LFU, got %q", payload.Data.Code)
+		}
+		pc := fetchProductCategory(t, db, categoryID)
+		if pc.Code != "LFU" {
+			t.Fatalf("expected persisted code LFU, got %q", pc.Code)
+		}
+	})
+
+	t.Run("delete product category", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodDelete, fmt.Sprintf("/api/master-data/product-categories/%d", categoryID), nil)
+		if resp.StatusCode != fiber.StatusOK {
+			t.Fatalf("expected 200 when deleting product category, got %d: %s", resp.StatusCode, string(body))
+		}
+		var pc entities.ProductCategory
+		if err := db.First(&pc, categoryID).Error; !errors.Is(err, gorm.ErrRecordNotFound) {
+			t.Fatalf("expected product category deleted, got error %v", err)
+		}
+	})
+
+	t.Run("delete non existing product category returns 404", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodDelete, fmt.Sprintf("/api/master-data/product-categories/%d", categoryID), nil)
+		if resp.StatusCode != fiber.StatusNotFound {
+			t.Fatalf("expected 404 when deleting missing product category, got %d: %s", resp.StatusCode, string(body))
+		}
+	})
+
+	t.Run("get deleted product category returns 404", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodGet, fmt.Sprintf("/api/master-data/product-categories/%d", categoryID), nil)
+		if resp.StatusCode != fiber.StatusNotFound {
+			t.Fatalf("expected 404 when fetching deleted product category, got %d: %s", resp.StatusCode, string(body))
+		}
+	})
+}

test/integration/master_data/product_test.go

@@ -0,0 +1,410 @@
+package test
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/gofiber/fiber/v2"
+	"gorm.io/gorm"
+
+	"gitlab.com/mbugroup/lti-api.git/internal/entities"
+	"gitlab.com/mbugroup/lti-api.git/internal/utils"
+)
+
+func TestProductIntegration(t *testing.T) {
+	app, db := setupIntegrationApp(t)
+
+	uomID := createUom(t, app, "Kilogram")
+	categoryID := createProductCategory(t, app, "Feed", "FED")
+
+	sapSupplier1 := createSupplier(t, app, "Feed Supplier One", "fs1", string(utils.SupplierCategorySapronak))
+	sapSupplier2 := createSupplier(t, app, "Feed Supplier Two", "fs2", string(utils.SupplierCategorySapronak))
+	bopSupplier := createSupplier(t, app, "BOP Supplier", "bop1", string(utils.SupplierCategoryBOP))
+
+	productFlags := []string{string(utils.FlagDOC), string(utils.FlagPakan)}
+	updatedProductFlags := []string{string(utils.FlagFinisher), string(utils.FlagObat)}
+
+	t.Run("create product without suppliers succeeds with empty relations", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPost, "/api/master-data/products", map[string]any{
+			"name":                "Supplierless Product",
+			"brand":               "Brand A",
+			"uom_id":              uomID,
+			"product_category_id": categoryID,
+			"product_price":       12000,
+		})
+		if resp.StatusCode != fiber.StatusCreated {
+			t.Fatalf("expected 201 when suppliers omitted, got %d: %s", resp.StatusCode, string(body))
+		}
+		id := parseID(t, body)
+		product := fetchProduct(t, db, id)
+		if len(product.Suppliers) != 0 {
+			t.Fatalf("expected no suppliers persisted, found %d", len(product.Suppliers))
+		}
+		if len(product.Flags) != 0 {
+			t.Fatalf("expected no flags persisted, found %d", len(product.Flags))
+		}
+		resp, _ = doJSONRequest(t, app, http.MethodDelete, fmt.Sprintf("/api/master-data/products/%d", id), nil)
+		if resp.StatusCode != fiber.StatusOK {
+			t.Fatalf("expected cleanup delete to succeed, got %d", resp.StatusCode)
+		}
+	})
+
+	t.Run("create product with invalid uom fails", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPost, "/api/master-data/products", map[string]any{
+			"name":                "Layer Feed Invalid UOM",
+			"brand":               "Brand A",
+			"uom_id":              9999,
+			"product_category_id": categoryID,
+			"product_price":       12000,
+			"supplier_ids":        []uint{sapSupplier1},
+		})
+		if resp.StatusCode != fiber.StatusNotFound {
+			t.Fatalf("expected 404 when uom missing, got %d: %s", resp.StatusCode, string(body))
+		}
+	})
+
+	t.Run("create product with invalid category fails", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPost, "/api/master-data/products", map[string]any{
+			"name":                "Layer Feed Invalid Category",
+			"brand":               "Brand A",
+			"uom_id":              uomID,
+			"product_category_id": 9999,
+			"product_price":       12000,
+			"supplier_ids":        []uint{sapSupplier1},
+		})
+		if resp.StatusCode != fiber.StatusNotFound {
+			t.Fatalf("expected 404 when category missing, got %d: %s", resp.StatusCode, string(body))
+		}
+	})
+
+	t.Run("create product with invalid supplier fails", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPost, "/api/master-data/products", map[string]any{
+			"name":                "Layer Feed Missing Supplier",
+			"brand":               "Brand A",
+			"uom_id":              uomID,
+			"product_category_id": categoryID,
+			"product_price":       12000,
+			"supplier_ids":        []uint{99999},
+		})
+		if resp.StatusCode != fiber.StatusNotFound {
+			t.Fatalf("expected 404 when supplier missing, got %d: %s", resp.StatusCode, string(body))
+		}
+	})
+
+	t.Run("create product with BOP supplier fails", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPost, "/api/master-data/products", map[string]any{
+			"name":                "Layer Feed Wrong Supplier",
+			"brand":               "Brand A",
+			"uom_id":              uomID,
+			"product_category_id": categoryID,
+			"product_price":       12000,
+			"supplier_ids":        []uint{bopSupplier},
+		})
+		if resp.StatusCode != fiber.StatusBadRequest {
+			t.Fatalf("expected 400 when supplier category invalid, got %d: %s", resp.StatusCode, string(body))
+		}
+	})
+
+	t.Run("create product with invalid flags fails", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPost, "/api/master-data/products", map[string]any{
+			"name":                "Layer Feed Invalid Flags",
+			"brand":               "Brand A",
+			"uom_id":              uomID,
+			"product_category_id": categoryID,
+			"product_price":       12000,
+			"supplier_ids":        []uint{sapSupplier1},
+			"flags":               []string{"INVALID"},
+		})
+		if resp.StatusCode != fiber.StatusBadRequest {
+			t.Fatalf("expected 400 when flags invalid, got %d: %s", resp.StatusCode, string(body))
+		}
+	})
+
+	var productID uint
+
+	t.Run("create product succeeds", func(t *testing.T) {
+		sku := "lfd-001"
+		productID = createProduct(t, app, "Layer Feed", "Brand A", &sku, uomID, categoryID, 15000, []uint{sapSupplier1, sapSupplier2}, productFlags)
+		product := fetchProduct(t, db, productID)
+		if product.Name != "Layer Feed" {
+			t.Fatalf("expected name Layer Feed, got %q", product.Name)
+		}
+		if product.Brand != "Brand A" {
+			t.Fatalf("expected brand Brand A, got %q", product.Brand)
+		}
+		if product.Sku == nil || *product.Sku != strings.ToUpper(sku) {
+			t.Fatalf("expected sku %q, got %+v", strings.ToUpper(sku), product.Sku)
+		}
+		if product.UomId != uomID {
+			t.Fatalf("expected uom_id %d, got %d", uomID, product.UomId)
+		}
+		if product.ProductCategoryId != categoryID {
+			t.Fatalf("expected product_category_id %d, got %d", categoryID, product.ProductCategoryId)
+		}
+		if product.CreatedBy != 1 {
+			t.Fatalf("expected created_by 1, got %d", product.CreatedBy)
+		}
+		if len(product.Suppliers) != 2 {
+			t.Fatalf("expected 2 suppliers, got %d", len(product.Suppliers))
+		}
+		if len(product.Flags) != len(productFlags) {
+			t.Fatalf("expected %d flags, got %d", len(productFlags), len(product.Flags))
+		}
+		expectedFlags := make(map[string]struct{}, len(productFlags))
+		for _, flag := range productFlags {
+			expectedFlags[strings.ToUpper(flag)] = struct{}{}
+		}
+		for _, flag := range product.Flags {
+			if _, ok := expectedFlags[strings.ToUpper(flag.Name)]; !ok {
+				t.Fatalf("unexpected flag %s present", flag.Name)
+			}
+			delete(expectedFlags, strings.ToUpper(flag.Name))
+		}
+		if len(expectedFlags) != 0 {
+			t.Fatalf("missing expected flags: %v", expectedFlags)
+		}
+	})
+
+	t.Run("creating duplicate name fails", func(t *testing.T) {
+		sku := "lfd-002"
+		resp, body := doJSONRequest(t, app, http.MethodPost, "/api/master-data/products", map[string]any{
+			"name":                "Layer Feed",
+			"brand":               "Brand B",
+			"sku":                 sku,
+			"uom_id":              uomID,
+			"product_category_id": categoryID,
+			"product_price":       16000,
+			"supplier_ids":        []uint{sapSupplier1},
+		})
+		if resp.StatusCode != fiber.StatusConflict {
+			t.Fatalf("expected 409 when creating duplicate name, got %d: %s", resp.StatusCode, string(body))
+		}
+	})
+
+	t.Run("creating duplicate sku fails", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPost, "/api/master-data/products", map[string]any{
+			"name":                "Layer Feed Premium",
+			"brand":               "Brand B",
+			"sku":                 "LFD-001",
+			"uom_id":              uomID,
+			"product_category_id": categoryID,
+			"product_price":       17000,
+			"supplier_ids":        []uint{sapSupplier1},
+		})
+		if resp.StatusCode != fiber.StatusConflict {
+			t.Fatalf("expected 409 when creating duplicate sku, got %d: %s", resp.StatusCode, string(body))
+		}
+	})
+
+	t.Run("get product detail returns nested data", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodGet, fmt.Sprintf("/api/master-data/products/%d", productID), nil)
+		if resp.StatusCode != fiber.StatusOK {
+			t.Fatalf("expected 200 when fetching product, got %d: %s", resp.StatusCode, string(body))
+		}
+		var payload struct {
+			Data struct {
+				Id    uint   `json:"id"`
+				Name  string `json:"name"`
+				Brand string `json:"brand"`
+				Uom   *struct {
+					Id uint `json:"id"`
+				} `json:"uom"`
+				Suppliers []map[string]any `json:"suppliers"`
+				Flags     []string         `json:"flags"`
+			} `json:"data"`
+		}
+		if err := json.Unmarshal(body, &payload); err != nil {
+			t.Fatalf("failed to parse product detail: %v", err)
+		}
+		if payload.Data.Id != productID {
+			t.Fatalf("expected id %d, got %d", productID, payload.Data.Id)
+		}
+		if payload.Data.Uom == nil || payload.Data.Uom.Id != uomID {
+			t.Fatalf("expected uom id %d, got %+v", uomID, payload.Data.Uom)
+		}
+		if len(payload.Data.Suppliers) != 2 {
+			t.Fatalf("expected 2 suppliers in response, got %d", len(payload.Data.Suppliers))
+		}
+		if len(payload.Data.Flags) != len(productFlags) {
+			t.Fatalf("expected %d flags in response, got %d", len(productFlags), len(payload.Data.Flags))
+		}
+		expected := make(map[string]struct{}, len(productFlags))
+		for _, flag := range productFlags {
+			expected[strings.ToUpper(flag)] = struct{}{}
+		}
+		for _, flag := range payload.Data.Flags {
+			flag = strings.ToUpper(flag)
+			if _, ok := expected[flag]; !ok {
+				t.Fatalf("unexpected flag %s returned", flag)
+			}
+			delete(expected, flag)
+		}
+		if len(expected) != 0 {
+			t.Fatalf("missing expected flags in response: %v", expected)
+		}
+	})
+
+	t.Run("update product with invalid supplier category fails", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPatch, fmt.Sprintf("/api/master-data/products/%d", productID), map[string]any{
+			"supplier_ids": []uint{bopSupplier},
+		})
+		if resp.StatusCode != fiber.StatusBadRequest {
+			t.Fatalf("expected 400 when updating with non SAPRONAK supplier, got %d: %s", resp.StatusCode, string(body))
+		}
+	})
+
+	t.Run("update product with invalid flags fails", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPatch, fmt.Sprintf("/api/master-data/products/%d", productID), map[string]any{
+			"flags": []string{"UNKNOWN"},
+		})
+		if resp.StatusCode != fiber.StatusBadRequest {
+			t.Fatalf("expected 400 when updating with invalid flags, got %d: %s", resp.StatusCode, string(body))
+		}
+	})
+
+	t.Run("update product succeeds", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPatch, fmt.Sprintf("/api/master-data/products/%d", productID), map[string]any{
+			"name":          "Layer Feed Updated",
+			"brand":         "Brand C",
+			"sku":           "lfd-100",
+			"product_price": 18000,
+			"selling_price": 19000,
+			"tax":           1000,
+			"expiry_period": 30,
+			"supplier_ids":  []uint{sapSupplier1},
+			"flags":         updatedProductFlags,
+		})
+		if resp.StatusCode != fiber.StatusOK {
+			t.Fatalf("expected 200 when updating product, got %d: %s", resp.StatusCode, string(body))
+		}
+		var payload struct {
+			Data struct {
+				Name         string           `json:"name"`
+				Brand        string           `json:"brand"`
+				Sku          *string          `json:"sku"`
+				ProductPrice float64          `json:"product_price"`
+				SupplierIds  []map[string]any `json:"suppliers"`
+				Flags        []string         `json:"flags"`
+			} `json:"data"`
+		}
+		if err := json.Unmarshal(body, &payload); err != nil {
+			t.Fatalf("failed to parse update response: %v", err)
+		}
+		if payload.Data.Name != "Layer Feed Updated" {
+			t.Fatalf("expected updated name, got %q", payload.Data.Name)
+		}
+		if len(payload.Data.Flags) != len(updatedProductFlags) {
+			t.Fatalf("expected %d flags in response, got %d", len(updatedProductFlags), len(payload.Data.Flags))
+		}
+		respFlags := make(map[string]struct{}, len(payload.Data.Flags))
+		for _, flag := range payload.Data.Flags {
+			respFlags[strings.ToUpper(flag)] = struct{}{}
+		}
+		for _, flag := range updatedProductFlags {
+			if _, ok := respFlags[strings.ToUpper(flag)]; !ok {
+				t.Fatalf("missing flag %s in response", flag)
+			}
+		}
+		product := fetchProduct(t, db, productID)
+		if product.Brand != "Brand C" {
+			t.Fatalf("expected persisted brand Brand C, got %q", product.Brand)
+		}
+		if product.Sku == nil || *product.Sku != "LFD-100" {
+			t.Fatalf("expected persisted sku LFD-100, got %+v", product.Sku)
+		}
+		if len(product.Suppliers) != 1 || product.Suppliers[0].Id != sapSupplier1 {
+			t.Fatalf("expected supplier to be %d", sapSupplier1)
+		}
+		if len(product.Flags) != len(updatedProductFlags) {
+			t.Fatalf("expected %d flags after update, got %d", len(updatedProductFlags), len(product.Flags))
+		}
+		expectedFlags := make(map[string]struct{}, len(updatedProductFlags))
+		for _, flag := range updatedProductFlags {
+			expectedFlags[strings.ToUpper(flag)] = struct{}{}
+		}
+		for _, flag := range product.Flags {
+			upper := strings.ToUpper(flag.Name)
+			if _, ok := expectedFlags[upper]; !ok {
+				t.Fatalf("unexpected flag after update: %s", upper)
+			}
+			delete(expectedFlags, upper)
+		}
+		if len(expectedFlags) != 0 {
+			t.Fatalf("missing flags after update: %v", expectedFlags)
+		}
+	})
+
+	t.Run("clear suppliers succeeds", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPatch, fmt.Sprintf("/api/master-data/products/%d", productID), map[string]any{
+			"supplier_ids": []uint{},
+		})
+		if resp.StatusCode != fiber.StatusOK {
+			t.Fatalf("expected 200 when clearing suppliers, got %d: %s", resp.StatusCode, string(body))
+		}
+		product := fetchProduct(t, db, productID)
+		if len(product.Suppliers) != 0 {
+			t.Fatalf("expected no suppliers after clearing, got %d", len(product.Suppliers))
+		}
+		if len(product.Flags) != len(updatedProductFlags) {
+			t.Fatalf("expected flags untouched after clearing suppliers, got %d", len(product.Flags))
+		}
+	})
+
+	t.Run("clear flags succeeds", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPatch, fmt.Sprintf("/api/master-data/products/%d", productID), map[string]any{
+			"flags": []string{},
+		})
+		if resp.StatusCode != fiber.StatusOK {
+			t.Fatalf("expected 200 when clearing flags, got %d: %s", resp.StatusCode, string(body))
+		}
+		product := fetchProduct(t, db, productID)
+		if len(product.Flags) != 0 {
+			t.Fatalf("expected all flags cleared, got %d", len(product.Flags))
+		}
+	})
+
+	t.Run("delete product succeeds", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodDelete, fmt.Sprintf("/api/master-data/products/%d", productID), nil)
+		if resp.StatusCode != fiber.StatusOK {
+			t.Fatalf("expected 200 when deleting product, got %d: %s", resp.StatusCode, string(body))
+		}
+		var product entities.Product
+		if err := db.First(&product, productID).Error; !errors.Is(err, gorm.ErrRecordNotFound) {
+			t.Fatalf("expected product deleted, got error %v", err)
+		}
+		var links int64
+		if err := db.Model(&entities.ProductSupplier{}).Where("product_id = ?", productID).Count(&links).Error; err != nil {
+			t.Fatalf("failed counting product suppliers: %v", err)
+		}
+		if links != 0 {
+			t.Fatalf("expected pivot cleared, found %d rows", links)
+		}
+		var flagCount int64
+		if err := db.Model(&entities.Flag{}).
+			Where("flagable_id = ? AND flagable_type = ?", productID, entities.FlagableTypeProduct).
+			Count(&flagCount).Error; err != nil {
+			t.Fatalf("failed counting product flags: %v", err)
+		}
+		if flagCount != 0 {
+			t.Fatalf("expected flags removed, found %d", flagCount)
+		}
+	})
+
+	t.Run("delete missing product returns 404", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodDelete, fmt.Sprintf("/api/master-data/products/%d", productID), nil)
+		if resp.StatusCode != fiber.StatusNotFound {
+			t.Fatalf("expected 404 when deleting missing product, got %d: %s", resp.StatusCode, string(body))
+		}
+	})
+
+	t.Run("get deleted product returns 404", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodGet, fmt.Sprintf("/api/master-data/products/%d", productID), nil)
+		if resp.StatusCode != fiber.StatusNotFound {
+			t.Fatalf("expected 404 when fetching deleted product, got %d: %s", resp.StatusCode, string(body))
+		}
+	})
+}

test/integration/master_data/supplier_test.go

@@ -0,0 +1,238 @@
+package test
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/gofiber/fiber/v2"
+	"gorm.io/gorm"
+
+	"gitlab.com/mbugroup/lti-api.git/internal/entities"
+	"gitlab.com/mbugroup/lti-api.git/internal/utils"
+)
+
+func TestSupplierIntegration(t *testing.T) {
+	app, db := setupIntegrationApp(t)
+
+	t.Run("creating supplier with invalid type fails", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPost, "/api/master-data/suppliers", map[string]any{
+			"name":           "Invalid Supplier",
+			"alias":          "inv01",
+			"pic":            "Jane Doe",
+			"type":           "random-type",
+			"category":       utils.SupplierCategoryBOP,
+			"hatchery":       "Hatchery X",
+			"phone":          "081234567891",
+			"email":          "invalid@supplier.com",
+			"address":        "Somewhere",
+			"npwp":           "NPWP-INVALID",
+			"account_number": "ACC-INVALID",
+			"due_date":       30,
+		})
+		if resp.StatusCode != fiber.StatusBadRequest {
+			t.Fatalf("expected 400 when type is invalid, got %d: %s", resp.StatusCode, string(body))
+		}
+	})
+
+	t.Run("creating supplier with invalid category fails", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPost, "/api/master-data/suppliers", map[string]any{
+			"name":     "Invalid Category Supplier",
+			"alias":    "cat01",
+			"pic":      "Jane Doe",
+			"type":     utils.CustomerSupplierTypeBisnis,
+			"category": "invalid",
+			"phone":    "081234567892",
+			"email":    "invalid-category@supplier.com",
+			"address":  "Somewhere",
+			"due_date": 30,
+		})
+		if resp.StatusCode != fiber.StatusBadRequest {
+			t.Fatalf("expected 400 when category is invalid, got %d: %s", resp.StatusCode, string(body))
+		}
+	})
+
+	const supplierName = "Supplier Alpha"
+	const alias = "al001"
+	var supplierID uint
+
+	t.Run("creating supplier succeeds", func(t *testing.T) {
+		supplierID = createSupplier(t, app, supplierName, alias, string(utils.SupplierCategoryBOP))
+		supplier := fetchSupplier(t, db, supplierID)
+		if supplier.Name != supplierName {
+			t.Fatalf("expected name %q, got %q", supplierName, supplier.Name)
+		}
+		if supplier.Alias != strings.ToUpper(alias) {
+			t.Fatalf("expected alias %q, got %q", strings.ToUpper(alias), supplier.Alias)
+		}
+		if supplier.Type != string(utils.CustomerSupplierTypeBisnis) {
+			t.Fatalf("expected type %q, got %q", utils.CustomerSupplierTypeBisnis, supplier.Type)
+		}
+		if supplier.Category != string(utils.SupplierCategoryBOP) {
+			t.Fatalf("expected category %q, got %q", utils.SupplierCategoryBOP, supplier.Category)
+		}
+		if supplier.DueDate != 30 {
+			t.Fatalf("expected due date 30, got %d", supplier.DueDate)
+		}
+		if supplier.CreatedUser.Id != 1 {
+			t.Fatalf("expected created user id 1, got %d", supplier.CreatedUser.Id)
+		}
+	})
+
+	t.Run("creating supplier with duplicate name fails", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPost, "/api/master-data/suppliers", map[string]any{
+			"name":     supplierName,
+			"alias":    "dup01",
+			"pic":      "Jane Doe",
+			"type":     utils.CustomerSupplierTypeBisnis,
+			"category": utils.SupplierCategoryBOP,
+			"phone":    "0811111111",
+			"email":    "duplicate@supplier.com",
+			"address":  "Duplicate address",
+			"due_date": 15,
+		})
+		if resp.StatusCode != fiber.StatusConflict {
+			t.Fatalf("expected 409 when creating duplicate supplier, got %d: %s", resp.StatusCode, string(body))
+		}
+	})
+
+	t.Run("getting existing supplier succeeds", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodGet, fmt.Sprintf("/api/master-data/suppliers/%d", supplierID), nil)
+		if resp.StatusCode != fiber.StatusOK {
+			t.Fatalf("expected 200 when fetching supplier, got %d: %s", resp.StatusCode, string(body))
+		}
+		var payload struct {
+			Data struct {
+				Id          uint   `json:"id"`
+				Name        string `json:"name"`
+				Alias       string `json:"alias"`
+				Type        string `json:"type"`
+				Category    string `json:"category"`
+				CreatedUser *struct {
+					Id uint `json:"id"`
+				} `json:"created_user"`
+			} `json:"data"`
+		}
+		if err := json.Unmarshal(body, &payload); err != nil {
+			t.Fatalf("failed to parse supplier response: %v", err)
+		}
+		if payload.Data.Id != supplierID {
+			t.Fatalf("expected id %d, got %d", supplierID, payload.Data.Id)
+		}
+		if payload.Data.Name != supplierName {
+			t.Fatalf("expected name %q, got %q", supplierName, payload.Data.Name)
+		}
+		if payload.Data.Alias != strings.ToUpper(alias) {
+			t.Fatalf("expected alias %q, got %q", strings.ToUpper(alias), payload.Data.Alias)
+		}
+		if payload.Data.Type != string(utils.CustomerSupplierTypeBisnis) {
+			t.Fatalf("expected type %q, got %q", utils.CustomerSupplierTypeBisnis, payload.Data.Type)
+		}
+		if payload.Data.Category != string(utils.SupplierCategoryBOP) {
+			t.Fatalf("expected category %q, got %q", utils.SupplierCategoryBOP, payload.Data.Category)
+		}
+		if payload.Data.CreatedUser == nil || payload.Data.CreatedUser.Id != 1 {
+			t.Fatalf("expected created_user id 1, got %+v", payload.Data.CreatedUser)
+		}
+	})
+
+	const updatedAlias = "beta1"
+
+	t.Run("updating supplier fields succeeds", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPatch, fmt.Sprintf("/api/master-data/suppliers/%d", supplierID), map[string]any{
+			"alias":    updatedAlias,
+			"type":     utils.CustomerSupplierTypeIndividual,
+			"category": utils.SupplierCategorySapronak,
+			"due_date": 45,
+		})
+		if resp.StatusCode != fiber.StatusOK {
+			t.Fatalf("expected 200 when updating supplier, got %d: %s", resp.StatusCode, string(body))
+		}
+		var payload struct {
+			Data struct {
+				Alias    string `json:"alias"`
+				Type     string `json:"type"`
+				Category string `json:"category"`
+			} `json:"data"`
+		}
+		if err := json.Unmarshal(body, &payload); err != nil {
+			t.Fatalf("failed to parse update response: %v", err)
+		}
+		if payload.Data.Alias != strings.ToUpper(updatedAlias) {
+			t.Fatalf("expected alias %q, got %q", strings.ToUpper(updatedAlias), payload.Data.Alias)
+		}
+		if payload.Data.Type != string(utils.CustomerSupplierTypeIndividual) {
+			t.Fatalf("expected type %q, got %q", utils.CustomerSupplierTypeIndividual, payload.Data.Type)
+		}
+		if payload.Data.Category != string(utils.SupplierCategorySapronak) {
+			t.Fatalf("expected category %q, got %q", utils.SupplierCategorySapronak, payload.Data.Category)
+		}
+		supplier := fetchSupplier(t, db, supplierID)
+		if supplier.Alias != strings.ToUpper(updatedAlias) {
+			t.Fatalf("expected persisted alias %q, got %q", strings.ToUpper(updatedAlias), supplier.Alias)
+		}
+		if supplier.Type != string(utils.CustomerSupplierTypeIndividual) {
+			t.Fatalf("expected persisted type %q, got %q", utils.CustomerSupplierTypeIndividual, supplier.Type)
+		}
+		if supplier.Category != string(utils.SupplierCategorySapronak) {
+			t.Fatalf("expected persisted category %q, got %q", utils.SupplierCategorySapronak, supplier.Category)
+		}
+		if supplier.DueDate != 45 {
+			t.Fatalf("expected due date 45, got %d", supplier.DueDate)
+		}
+	})
+
+	t.Run("updating supplier with invalid type fails", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPatch, fmt.Sprintf("/api/master-data/suppliers/%d", supplierID), map[string]any{
+			"type": "invalid-type",
+		})
+		if resp.StatusCode != fiber.StatusBadRequest {
+			t.Fatalf("expected 400 when updating with invalid type, got %d: %s", resp.StatusCode, string(body))
+		}
+		supplier := fetchSupplier(t, db, supplierID)
+		if supplier.Type != string(utils.CustomerSupplierTypeIndividual) {
+			t.Fatalf("expected type to remain %q after invalid update, got %q", utils.CustomerSupplierTypeIndividual, supplier.Type)
+		}
+	})
+
+	t.Run("updating supplier with invalid category fails", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodPatch, fmt.Sprintf("/api/master-data/suppliers/%d", supplierID), map[string]any{
+			"category": "invalid",
+		})
+		if resp.StatusCode != fiber.StatusBadRequest {
+			t.Fatalf("expected 400 when updating with invalid category, got %d: %s", resp.StatusCode, string(body))
+		}
+		supplier := fetchSupplier(t, db, supplierID)
+		if supplier.Category != string(utils.SupplierCategorySapronak) {
+			t.Fatalf("expected category to remain %q after invalid update, got %q", utils.SupplierCategorySapronak, supplier.Category)
+		}
+	})
+
+	t.Run("deleting supplier succeeds", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodDelete, fmt.Sprintf("/api/master-data/suppliers/%d", supplierID), nil)
+		if resp.StatusCode != fiber.StatusOK {
+			t.Fatalf("expected 200 when deleting supplier, got %d: %s", resp.StatusCode, string(body))
+		}
+		var supplier entities.Supplier
+		if err := db.First(&supplier, supplierID).Error; !errors.Is(err, gorm.ErrRecordNotFound) {
+			t.Fatalf("expected supplier to be deleted, got error %v", err)
+		}
+	})
+
+	t.Run("deleting non existent supplier returns 404", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodDelete, fmt.Sprintf("/api/master-data/suppliers/%d", supplierID), nil)
+		if resp.StatusCode != fiber.StatusNotFound {
+			t.Fatalf("expected 404 when deleting missing supplier, got %d: %s", resp.StatusCode, string(body))
+		}
+	})
+
+	t.Run("getting deleted supplier returns 404", func(t *testing.T) {
+		resp, body := doJSONRequest(t, app, http.MethodGet, fmt.Sprintf("/api/master-data/suppliers/%d", supplierID), nil)
+		if resp.StatusCode != fiber.StatusNotFound {
+			t.Fatalf("expected 404 when fetching deleted supplier, got %d: %s", resp.StatusCode, string(body))
+		}
+	})
+}