feat(customers): add controlled CSV and XLSX customer import

validation-suite/frontend/atlas/tests/customer-import.test.mjs

@@ -0,0 +1,39 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+import test from "node:test";
+
+const page = fs.readFileSync(path.resolve("app/(app)/customers/import/page.tsx"), "utf8");
+const shell = fs.readFileSync(path.resolve("components/app-shell.tsx"), "utf8");
+const previewBff = fs.readFileSync(path.resolve("app/api/customer-imports/preview/route.ts"), "utf8");
+const confirmBff = fs.readFileSync(path.resolve("app/api/customer-imports/confirm/route.ts"), "utf8");
+
+test("customer import is admin-only and present in navigation", () => {
+  assert.match(shell, /href: "\/customers\/import"/);
+  assert.match(shell, /label: "Kunden importieren"/);
+  assert.match(shell, /adminOnly: true/);
+  assert.match(shell, /href === "\/customers"/);
+  assert.match(page, /user\?\.role !== "admin"/);
+});
+
+test("customer import page implements upload mapping preview and confirm", () => {
+  assert.match(page, /accept="\.csv,\.xlsx/);
+  assert.match(page, /Vorschau vorbereiten/);
+  assert.match(page, /Spalten zuordnen/);
+  assert.match(page, /preview\.target_fields/);
+  assert.match(page, /Importvorschau prüfen/);
+  assert.match(page, /Mögliche Dubletten/);
+  assert.match(page, /Kunden jetzt importieren/);
+  assert.match(page, /ignore_empty_values/);
+  assert.match(page, /row_actions/);
+});
+
+test("customer import BFF forwards multipart through HttpOnly cookie", () => {
+  for (const source of [previewBff, confirmBff]) {
+    assert.match(source, /AUTH_COOKIE_NAME/);
+    assert.match(source, /Authorization: `Bearer \$\{token\}`/);
+    assert.match(source, /request\.formData\(\)/);
+  }
+  assert.match(previewBff, /\/customer-imports\/preview/);
+  assert.match(confirmBff, /\/customer-imports\/confirm/);
+});