Fix: Unvalidated menu item prices on POST /restaurants allow negative-priced menu items and negative order totals

ftgo-common/src/main/java/net/chrisrichardson/ftgo/common/Money.java

@@ -68,6 +68,10 @@ public boolean isGreaterThanOrEqual(Money other) {
     return amount.compareTo(other.amount) >= 0;
   }
 
+  public boolean isPositive() {
+    return amount.signum() > 0;
+  }
+
   public String asString() {
     return amount.toPlainString();
   }

ftgo-domain/src/main/java/net/chrisrichardson/ftgo/domain/MenuItem.java

@@ -23,11 +23,24 @@ private MenuItem() {
   }
 
   public MenuItem(String id, String name, Money price) {
+    if (id == null || id.trim().isEmpty()) {
+      throw new IllegalArgumentException("Menu item id must not be blank");
+    }
+    if (name == null || name.trim().isEmpty()) {
+      throw new IllegalArgumentException("Menu item name must not be blank: " + id);
+    }
+    requirePositivePrice(id, price);
     this.id = id;
     this.name = name;
     this.price = price;
   }
 
+  static void requirePositivePrice(String id, Money price) {
+    if (price == null || !price.isPositive()) {
+      throw new IllegalArgumentException("Menu item price must be greater than zero: " + id);
+    }
+  }
+
   @Override
   public boolean equals(Object o) {
     return EqualsBuilder.reflectionEquals(this, o);
@@ -64,6 +77,7 @@ public Money getPrice() {
   }
 
   public void setPrice(Money price) {
+    requirePositivePrice(id, price);
     this.price = price;
   }
 }

ftgo-domain/src/test/java/net/chrisrichardson/ftgo/domain/MenuItemPriceTest.java

@@ -0,0 +1,40 @@
+package net.chrisrichardson.ftgo.domain;
+
+import net.chrisrichardson.ftgo.common.Money;
+import org.junit.Test;
+
+import static org.junit.Assert.assertEquals;
+
+public class MenuItemPriceTest {
+
+  @Test
+  public void shouldAcceptPositivePrice() {
+    MenuItem item = new MenuItem("1", "Chicken Vindaloo", new Money("12.34"));
+    assertEquals(new Money("12.34"), item.getPrice());
+  }
+
+  @Test(expected = IllegalArgumentException.class)
+  public void shouldRejectNegativePrice() {
+    new MenuItem("1", "Refund", new Money("-500.00"));
+  }
+
+  @Test(expected = IllegalArgumentException.class)
+  public void shouldRejectZeroPrice() {
+    new MenuItem("1", "Free", Money.ZERO);
+  }
+
+  @Test(expected = IllegalArgumentException.class)
+  public void shouldRejectNullPrice() {
+    new MenuItem("1", "Missing", null);
+  }
+
+  @Test(expected = IllegalArgumentException.class)
+  public void shouldRejectBlankId() {
+    new MenuItem(" ", "Chicken Vindaloo", new Money("12.34"));
+  }
+
+  @Test(expected = IllegalArgumentException.class)
+  public void shouldRejectNegativePriceOnUpdate() {
+    new MenuItem("1", "Chicken Vindaloo", new Money("12.34")).setPrice(new Money("-1"));
+  }
+}

ftgo-restaurant-service/src/main/java/net/chrisrichardson/ftgo/restaurantservice/domain/RestaurantService.java

@@ -25,6 +25,10 @@ public Restaurant create(CreateRestaurantRequest request) {
   }
 
   private RestaurantMenu makeRestaurantMenu(RestaurantMenuDTO menu) {
+    if (menu == null || menu.getMenuItemDTOs() == null || menu.getMenuItemDTOs().isEmpty()
+            || menu.getMenuItemDTOs().stream().anyMatch(mi -> mi == null)) {
+      throw new IllegalArgumentException("Restaurant menu must contain at least one valid item");
+    }
     return new RestaurantMenu(menu.getMenuItemDTOs().stream().map(mi -> new MenuItem(mi.getId(), mi.getName(), mi.getPrice())).collect(Collectors.toList()));
   }