1 files changed, 52 insertions, 0 deletions
diff --git a/internal/admin/casino_validate_test.go b/internal/admin/casino_validate_test.go
new file mode 100644
index 0000000..a0f4451
--- /dev/null
+++ b/internal/admin/casino_validate_test.go
@@ -0,0 +1,52 @@
+package admin
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"thehouseoficarus/internal/world"
+)
+
+func TestRoomUpdateRejectsInvalidCasinoBeforeWriting(t *testing.T) {
+	dir := t.TempDir()
+	rooms := filepath.Join(dir, "rooms")
+	if err := os.MkdirAll(rooms, 0755); err != nil {
+		t.Fatal(err)
+	}
+	path := filepath.Join(rooms, "1.yaml")
+	original := "name: Original\n"
+	if err := os.WriteFile(path, []byte(original), 0644); err != nil {
+		t.Fatal(err)
+	}
+	s := &AdminServer{dataDir: dir, world: world.New(dir), undoStack: NewUndoStack(dir)}
+	for _, cfg := range []string{
+		`{"id":"slots","game":"slots","payout":-1}`,
+		`{"id":"slots","game":"slots","spin_tickz":2}`,
+	} {
+		r := httptest.NewRequest(http.MethodPut, "/api/rooms/1", strings.NewReader(`{"casino_machines":[`+cfg+`]}`))
+		w := httptest.NewRecorder()
+		s.handleRoomByID(w, r)
+		if w.Code != http.StatusBadRequest {
+			t.Fatalf("status %d: %s", w.Code, w.Body.String())
+		}
+		data, err := os.ReadFile(path)
+		if err != nil || string(data) != original || s.undoStack.Info().CanUndo {
+			t.Fatal("invalid update changed room or undo history")
+		}
+	}
+}
+
+func TestRoomCreateValidatesBeforeAllocatingOrLinking(t *testing.T) {
+	// No world/config needed: rejection must precede all mutation work.
+	s := &AdminServer{}
+	r := httptest.NewRequest(http.MethodPost, "/api/rooms", strings.NewReader(`{"casino_tables":[{"id":"cards","game":"typo"}],"link_from":1,"link_dir":"n"}`))
+	w := httptest.NewRecorder()
+	s.handleRooms(w, r)
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("status %d: %s", w.Code, w.Body.String())
+	}
+}