373 lines
11 KiB
Go
373 lines
11 KiB
Go
package handlers
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"net/http"
|
|
"testing"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
|
|
"git.gobha.me/xcaliber/chat-switchboard/config"
|
|
"git.gobha.me/xcaliber/chat-switchboard/database"
|
|
"git.gobha.me/xcaliber/chat-switchboard/middleware"
|
|
"git.gobha.me/xcaliber/chat-switchboard/models"
|
|
"git.gobha.me/xcaliber/chat-switchboard/store"
|
|
postgres "git.gobha.me/xcaliber/chat-switchboard/store/postgres"
|
|
sqlite "git.gobha.me/xcaliber/chat-switchboard/store/sqlite"
|
|
)
|
|
|
|
// ── Project Test Harness ──────────────────
|
|
|
|
type projectHarness struct {
|
|
*testHarness
|
|
stores store.Stores
|
|
userToken string
|
|
userID string
|
|
adminToken string
|
|
adminID string
|
|
}
|
|
|
|
func setupProjectHarness(t *testing.T) *projectHarness {
|
|
t.Helper()
|
|
database.RequireTestDB(t)
|
|
database.TruncateAll(t)
|
|
|
|
cfg := &config.Config{
|
|
JWTSecret: testJWTSecret,
|
|
BasePath: "",
|
|
}
|
|
|
|
var stores store.Stores
|
|
if database.IsSQLite() {
|
|
stores = sqlite.NewStores(database.TestDB)
|
|
} else {
|
|
stores = postgres.NewStores(database.TestDB)
|
|
}
|
|
|
|
r := gin.New()
|
|
api := r.Group("/api/v1")
|
|
protected := api.Group("")
|
|
protected.Use(middleware.Auth(cfg))
|
|
|
|
projH := NewProjectHandler(stores)
|
|
protected.GET("/projects", projH.List)
|
|
protected.POST("/projects", projH.Create)
|
|
protected.GET("/projects/:id", projH.Get)
|
|
protected.PUT("/projects/:id", projH.Update)
|
|
protected.DELETE("/projects/:id", projH.Delete)
|
|
protected.POST("/projects/:id/channels", projH.AddChannel)
|
|
protected.DELETE("/projects/:id/channels/:channelId", projH.RemoveChannel)
|
|
protected.GET("/projects/:id/channels", projH.ListChannels)
|
|
protected.PUT("/projects/:id/channels/reorder", projH.ReorderChannels)
|
|
protected.POST("/projects/:id/knowledge-bases", projH.AddKB)
|
|
protected.DELETE("/projects/:id/knowledge-bases/:kbId", projH.RemoveKB)
|
|
protected.GET("/projects/:id/knowledge-bases", projH.ListKBs)
|
|
protected.POST("/projects/:id/notes", projH.AddNote)
|
|
protected.DELETE("/projects/:id/notes/:noteId", projH.RemoveNote)
|
|
protected.GET("/projects/:id/notes", projH.ListNotes)
|
|
|
|
// Admin routes
|
|
admin := api.Group("/admin")
|
|
admin.Use(middleware.Auth(cfg))
|
|
admin.Use(middleware.RequireAdmin())
|
|
admin.GET("/projects", projH.AdminList)
|
|
admin.DELETE("/projects/:id", projH.Delete)
|
|
|
|
userID := database.SeedTestUser(t, "projuser", "projuser@test.com")
|
|
database.TestDB.Exec(dialectSQL("UPDATE users SET is_active = true WHERE id = $1"), userID)
|
|
userToken := makeToken(userID, "projuser@test.com", "user")
|
|
|
|
adminID := database.SeedTestUser(t, "projadmin", "projadmin@test.com")
|
|
database.TestDB.Exec(dialectSQL("UPDATE users SET is_active = true, role = 'admin' WHERE id = $1"), adminID)
|
|
adminToken := makeToken(adminID, "projadmin@test.com", "admin")
|
|
|
|
return &projectHarness{
|
|
testHarness: &testHarness{router: r, t: t},
|
|
stores: stores,
|
|
userToken: userToken,
|
|
userID: userID,
|
|
adminToken: adminToken,
|
|
adminID: adminID,
|
|
}
|
|
}
|
|
|
|
// seedProject creates a project via the store and returns it.
|
|
func (h *projectHarness) seedProject(name, ownerID string) *models.Project {
|
|
h.t.Helper()
|
|
p := &models.Project{
|
|
Name: name,
|
|
Scope: models.ScopePersonal,
|
|
OwnerID: ownerID,
|
|
}
|
|
if err := h.stores.Projects.Create(context.Background(), p); err != nil {
|
|
h.t.Fatalf("seedProject: %v", err)
|
|
}
|
|
return p
|
|
}
|
|
|
|
// ── GET /projects — envelope ──────────────
|
|
|
|
func TestProjects_List_Empty_Envelope(t *testing.T) {
|
|
h := setupProjectHarness(t)
|
|
|
|
resp := h.request("GET", "/api/v1/projects", h.userToken, nil)
|
|
if resp.Code != http.StatusOK {
|
|
t.Fatalf("got %d, body: %s", resp.Code, resp.Body.String())
|
|
}
|
|
|
|
var body map[string]interface{}
|
|
json.Unmarshal(resp.Body.Bytes(), &body)
|
|
|
|
data, ok := body["data"]
|
|
if !ok {
|
|
t.Fatal("GET /projects must return {\"data\": [...]}, missing \"data\" key")
|
|
}
|
|
arr, ok := data.([]interface{})
|
|
if !ok {
|
|
t.Fatalf("data should be an array, got %T", data)
|
|
}
|
|
if len(arr) != 0 {
|
|
t.Errorf("expected empty array, got %d items", len(arr))
|
|
}
|
|
}
|
|
|
|
func TestProjects_List_WithData_Shape(t *testing.T) {
|
|
h := setupProjectHarness(t)
|
|
h.seedProject("test-proj", h.userID)
|
|
|
|
resp := h.request("GET", "/api/v1/projects", h.userToken, nil)
|
|
if resp.Code != http.StatusOK {
|
|
t.Fatalf("got %d, body: %s", resp.Code, resp.Body.String())
|
|
}
|
|
|
|
var body map[string]interface{}
|
|
json.Unmarshal(resp.Body.Bytes(), &body)
|
|
|
|
data, ok := body["data"].([]interface{})
|
|
if !ok {
|
|
t.Fatal("data must be an array")
|
|
}
|
|
if len(data) != 1 {
|
|
t.Fatalf("expected 1 project, got %d", len(data))
|
|
}
|
|
|
|
proj := data[0].(map[string]interface{})
|
|
for _, key := range []string{"id", "name", "scope", "owner_id", "is_archived", "created_at", "updated_at"} {
|
|
if _, exists := proj[key]; !exists {
|
|
t.Errorf("missing field %q in project object", key)
|
|
}
|
|
}
|
|
if proj["name"] != "test-proj" {
|
|
t.Errorf("name: got %v, want test-proj", proj["name"])
|
|
}
|
|
}
|
|
|
|
// ── POST /projects — create ──────────────
|
|
|
|
func TestProjects_Create_201_Shape(t *testing.T) {
|
|
h := setupProjectHarness(t)
|
|
|
|
resp := h.request("POST", "/api/v1/projects", h.userToken, map[string]interface{}{
|
|
"name": "new-project",
|
|
"description": "test desc",
|
|
"color": "#ff0000",
|
|
"icon": "star",
|
|
})
|
|
if resp.Code != http.StatusCreated {
|
|
t.Fatalf("expected 201, got %d, body: %s", resp.Code, resp.Body.String())
|
|
}
|
|
|
|
var body map[string]interface{}
|
|
json.Unmarshal(resp.Body.Bytes(), &body)
|
|
|
|
// Bare object, not wrapped in "data"
|
|
if _, exists := body["data"]; exists {
|
|
t.Error("POST /projects should return bare object, not wrapped in 'data'")
|
|
}
|
|
if body["name"] != "new-project" {
|
|
t.Errorf("name: got %v, want new-project", body["name"])
|
|
}
|
|
if body["scope"] != "personal" {
|
|
t.Errorf("scope should be forced to personal, got %v", body["scope"])
|
|
}
|
|
if body["owner_id"] != h.userID {
|
|
t.Errorf("owner_id: got %v, want %s", body["owner_id"], h.userID)
|
|
}
|
|
if body["color"] != "#ff0000" {
|
|
t.Errorf("color: got %v, want #ff0000", body["color"])
|
|
}
|
|
if body["icon"] != "star" {
|
|
t.Errorf("icon: got %v, want star", body["icon"])
|
|
}
|
|
}
|
|
|
|
func TestProjects_Create_RequiresName(t *testing.T) {
|
|
h := setupProjectHarness(t)
|
|
|
|
resp := h.request("POST", "/api/v1/projects", h.userToken, map[string]interface{}{
|
|
"description": "no name",
|
|
})
|
|
if resp.Code != http.StatusBadRequest {
|
|
t.Fatalf("expected 400 for missing name, got %d", resp.Code)
|
|
}
|
|
}
|
|
|
|
// ── GET /projects/:id — single object ─────
|
|
|
|
func TestProjects_Get_Shape(t *testing.T) {
|
|
h := setupProjectHarness(t)
|
|
p := h.seedProject("detail-proj", h.userID)
|
|
|
|
resp := h.request("GET", "/api/v1/projects/"+p.ID, h.userToken, nil)
|
|
if resp.Code != http.StatusOK {
|
|
t.Fatalf("got %d, body: %s", resp.Code, resp.Body.String())
|
|
}
|
|
|
|
var body map[string]interface{}
|
|
json.Unmarshal(resp.Body.Bytes(), &body)
|
|
|
|
// Bare object
|
|
if _, exists := body["data"]; exists {
|
|
t.Error("GET /:id should return object directly, not wrapped in 'data'")
|
|
}
|
|
if body["id"] != p.ID {
|
|
t.Errorf("id: got %v, want %s", body["id"], p.ID)
|
|
}
|
|
// Computed counts use omitempty — absent when zero, present as number when nonzero.
|
|
// With a fresh project all counts are 0, so they'll be omitted. Verify that if
|
|
// present they're numeric (the AdminList test covers nonzero count visibility).
|
|
for _, key := range []string{"channel_count", "kb_count", "note_count"} {
|
|
if val, exists := body[key]; exists {
|
|
if _, ok := val.(float64); !ok {
|
|
t.Errorf("%s should be numeric, got %T", key, val)
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestProjects_Get_NotFound(t *testing.T) {
|
|
h := setupProjectHarness(t)
|
|
|
|
resp := h.request("GET", "/api/v1/projects/00000000-0000-0000-0000-000000000000", h.userToken, nil)
|
|
if resp.Code != http.StatusNotFound {
|
|
t.Fatalf("expected 404, got %d", resp.Code)
|
|
}
|
|
}
|
|
|
|
// ── PUT /projects/:id — update ────────────
|
|
|
|
func TestProjects_Update_ReturnsRefreshed(t *testing.T) {
|
|
h := setupProjectHarness(t)
|
|
p := h.seedProject("old-name", h.userID)
|
|
|
|
resp := h.request("PUT", "/api/v1/projects/"+p.ID, h.userToken, map[string]interface{}{
|
|
"name": "new-name",
|
|
})
|
|
if resp.Code != http.StatusOK {
|
|
t.Fatalf("got %d, body: %s", resp.Code, resp.Body.String())
|
|
}
|
|
|
|
var body map[string]interface{}
|
|
json.Unmarshal(resp.Body.Bytes(), &body)
|
|
|
|
if body["name"] != "new-name" {
|
|
t.Errorf("name should be updated to new-name, got %v", body["name"])
|
|
}
|
|
if body["id"] != p.ID {
|
|
t.Errorf("id mismatch: got %v, want %s", body["id"], p.ID)
|
|
}
|
|
}
|
|
|
|
// ── DELETE /projects/:id ──────────────────
|
|
|
|
func TestProjects_Delete_Shape(t *testing.T) {
|
|
h := setupProjectHarness(t)
|
|
p := h.seedProject("doomed", h.userID)
|
|
|
|
resp := h.request("DELETE", "/api/v1/projects/"+p.ID, h.userToken, nil)
|
|
if resp.Code != http.StatusOK {
|
|
t.Fatalf("got %d, body: %s", resp.Code, resp.Body.String())
|
|
}
|
|
|
|
var body map[string]interface{}
|
|
json.Unmarshal(resp.Body.Bytes(), &body)
|
|
|
|
if body["message"] != "project deleted" {
|
|
t.Errorf("expected message 'project deleted', got %v", body["message"])
|
|
}
|
|
|
|
// Confirm actually deleted
|
|
resp = h.request("GET", "/api/v1/projects/"+p.ID, h.userToken, nil)
|
|
if resp.Code != http.StatusNotFound {
|
|
t.Errorf("project should be gone, got %d", resp.Code)
|
|
}
|
|
}
|
|
|
|
func TestProjects_Delete_ForbiddenForNonOwner(t *testing.T) {
|
|
h := setupProjectHarness(t)
|
|
|
|
otherID := database.SeedTestUser(t, "other", "other@test.com")
|
|
p := h.seedProject("others-proj", otherID)
|
|
|
|
resp := h.request("DELETE", "/api/v1/projects/"+p.ID, h.userToken, nil)
|
|
// Non-owner, non-admin user should not be able to access (404 from loadAndAuthorize)
|
|
if resp.Code != http.StatusNotFound {
|
|
t.Fatalf("expected 404 for other user's personal project, got %d", resp.Code)
|
|
}
|
|
}
|
|
|
|
// ── Auth ──────────────────────────────────
|
|
|
|
func TestProjects_RequiresAuth(t *testing.T) {
|
|
h := setupProjectHarness(t)
|
|
|
|
resp := h.request("GET", "/api/v1/projects", "", nil)
|
|
if resp.Code != http.StatusUnauthorized {
|
|
t.Fatalf("expected 401 without token, got %d", resp.Code)
|
|
}
|
|
}
|
|
|
|
// ── Admin List ────────────────────────────
|
|
|
|
func TestProjects_AdminList_Envelope(t *testing.T) {
|
|
h := setupProjectHarness(t)
|
|
h.seedProject("admin-visible", h.userID)
|
|
|
|
resp := h.request("GET", "/api/v1/admin/projects", h.adminToken, nil)
|
|
if resp.Code != http.StatusOK {
|
|
t.Fatalf("got %d, body: %s", resp.Code, resp.Body.String())
|
|
}
|
|
|
|
var body map[string]interface{}
|
|
json.Unmarshal(resp.Body.Bytes(), &body)
|
|
|
|
data, ok := body["data"].([]interface{})
|
|
if !ok {
|
|
t.Fatal("admin list must return {\"data\": [...]}")
|
|
}
|
|
if len(data) < 1 {
|
|
t.Fatal("expected at least 1 project in admin list")
|
|
}
|
|
|
|
proj := data[0].(map[string]interface{})
|
|
// Admin list has extra owner_name field
|
|
if _, exists := proj["owner_name"]; !exists {
|
|
t.Error("admin list project should include owner_name")
|
|
}
|
|
for _, key := range []string{"channel_count", "kb_count", "note_count"} {
|
|
if _, exists := proj[key]; !exists {
|
|
t.Errorf("admin list missing computed field %q", key)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestProjects_AdminList_ForbiddenForUser(t *testing.T) {
|
|
h := setupProjectHarness(t)
|
|
|
|
resp := h.request("GET", "/api/v1/admin/projects", h.userToken, nil)
|
|
if resp.Code != http.StatusForbidden {
|
|
t.Fatalf("expected 403 for non-admin, got %d", resp.Code)
|
|
}
|
|
}
|