project-manager/tests/TodoTest.php

<?php

declare(strict_types=1);

namespace Tests;

final class TodoTest extends ApiTestCase
{
    public function test_lists_require_authentication(): void
    {
        self::assertSame(401, $this->request('GET', '/api/lists')->getStatusCode());
    }

    public function test_create_and_list_lists(): void
    {
        $auth = $this->authHeader();

        $created = $this->request('POST', '/api/lists', [
            'title' => '  Groceries  ',
            'description' => 'Weekly shop',
        ], $auth);

        self::assertSame(201, $created->getStatusCode());
        $list = $this->decode($created)['list'];
        self::assertSame('Groceries', $list['title']);
        self::assertSame('Weekly shop', $list['description']);
        self::assertSame(0, $list['item_count']);

        $index = $this->decode($this->request('GET', '/api/lists', null, $auth));
        self::assertCount(1, $index['lists']);
        self::assertSame($list['id'], $index['lists'][0]['id']);
    }

    public function test_lists_come_back_alphabetically(): void
    {
        $auth = $this->authHeader();

        foreach (['Banana', 'apple', 'Cherry'] as $title) {
            $this->request('POST', '/api/lists', ['title' => $title], $auth);
        }

        $titles = array_column($this->decode($this->request('GET', '/api/lists', null, $auth))['lists'], 'title');
        self::assertSame(['apple', 'Banana', 'Cherry'], $titles);
    }

    public function test_an_owner_cannot_exceed_100_lists(): void
    {
        $auth = $this->authHeader();

        for ($i = 1; $i <= 100; $i++) {
            $response = $this->request('POST', '/api/lists', ['title' => "List {$i}"], $auth);
            self::assertSame(201, $response->getStatusCode(), "list {$i} should be created");
        }

        $overflow = $this->request('POST', '/api/lists', ['title' => 'One too many'], $auth);
        self::assertSame(409, $overflow->getStatusCode());
        self::assertStringContainsString('100', $this->decode($overflow)['error']['message']);

        // The cap is per owner, so a different user is unaffected.
        $other = $this->authHeader('roomy@example.com');
        self::assertSame(201, $this->request('POST', '/api/lists', ['title' => 'Fine'], $other)->getStatusCode());
    }

    public function test_list_creation_validates_title(): void
    {
        $response = $this->request('POST', '/api/lists', ['description' => 'no title'], $this->authHeader());

        self::assertSame(422, $response->getStatusCode());
        self::assertArrayHasKey('title', $this->decode($response)['error']['details']);
    }

    public function test_a_list_is_only_visible_to_its_owner(): void
    {
        $owner = $this->authHeader('owner@example.com');
        $other = $this->authHeader('other@example.com');

        $listId = $this->decode(
            $this->request('POST', '/api/lists', ['title' => 'Private'], $owner),
        )['list']['id'];

        self::assertSame(200, $this->request('GET', "/api/lists/{$listId}", null, $owner)->getStatusCode());
        self::assertSame(404, $this->request('GET', "/api/lists/{$listId}", null, $other)->getStatusCode());
        self::assertSame(404, $this->request('PATCH', "/api/lists/{$listId}", ['title' => 'x'], $other)->getStatusCode());
        self::assertSame(404, $this->request('DELETE', "/api/lists/{$listId}", null, $other)->getStatusCode());
    }

    public function test_update_and_delete_list(): void
    {
        $auth = $this->authHeader();
        $listId = $this->decode(
            $this->request('POST', '/api/lists', ['title' => 'Draft'], $auth),
        )['list']['id'];

        $updated = $this->decode(
            $this->request('PATCH', "/api/lists/{$listId}", ['title' => 'Final'], $auth),
        )['list'];
        self::assertSame('Final', $updated['title']);

        self::assertSame(204, $this->request('DELETE', "/api/lists/{$listId}", null, $auth)->getStatusCode());
        self::assertSame(404, $this->request('GET', "/api/lists/{$listId}", null, $auth)->getStatusCode());
    }

    public function test_items_append_in_order_and_track_completion(): void
    {
        $auth = $this->authHeader();
        $listId = $this->decode(
            $this->request('POST', '/api/lists', ['title' => 'Chores'], $auth),
        )['list']['id'];

        foreach (['Wash up', 'Hoover', 'Bins'] as $text) {
            $this->request('POST', "/api/lists/{$listId}/items", ['text' => $text], $auth);
        }

        $items = $this->decode($this->request('GET', "/api/lists/{$listId}/items", null, $auth))['items'];
        self::assertSame(['Wash up', 'Hoover', 'Bins'], array_column($items, 'text'));
        self::assertSame([0, 1, 2], array_column($items, 'position'));
        self::assertFalse($items[0]['complete']);

        $done = $this->decode(
            $this->request('PATCH', "/api/lists/{$listId}/items/{$items[0]['id']}", ['complete' => true], $auth),
        )['item'];
        self::assertTrue($done['complete']);

        $list = $this->decode($this->request('GET', "/api/lists/{$listId}", null, $auth))['list'];
        self::assertSame(3, $list['item_count']);
        self::assertSame(1, $list['completed_count']);
    }

    public function test_item_creation_accepts_explicit_position_and_validates_text(): void
    {
        $auth = $this->authHeader();
        $listId = $this->decode(
            $this->request('POST', '/api/lists', ['title' => 'L'], $auth),
        )['list']['id'];

        $item = $this->decode(
            $this->request('POST', "/api/lists/{$listId}/items", ['text' => 'Pinned', 'position' => 5], $auth),
        )['item'];
        self::assertSame(5, $item['position']);

        $bad = $this->request('POST', "/api/lists/{$listId}/items", ['text' => '   '], $auth);
        self::assertSame(422, $bad->getStatusCode());
        self::assertArrayHasKey('text', $this->decode($bad)['error']['details']);
    }

    public function test_items_can_be_reordered_in_bulk(): void
    {
        $auth = $this->authHeader();
        $listId = $this->decode(
            $this->request('POST', '/api/lists', ['title' => 'Reorder'], $auth),
        )['list']['id'];

        $ids = [];
        foreach (['A', 'B', 'C'] as $text) {
            $ids[$text] = $this->decode(
                $this->request('POST', "/api/lists/{$listId}/items", ['text' => $text], $auth),
            )['item']['id'];
        }

        $response = $this->request('PUT', "/api/lists/{$listId}/items/order", [
            'item_ids' => [$ids['C'], $ids['A'], $ids['B']],
        ], $auth);

        self::assertSame(200, $response->getStatusCode());
        $items = $this->decode($response)['items'];
        self::assertSame(['C', 'A', 'B'], array_column($items, 'text'));
        self::assertSame([0, 1, 2], array_column($items, 'position'));

        // Order persists on a fresh read.
        $reread = $this->decode($this->request('GET', "/api/lists/{$listId}/items", null, $auth))['items'];
        self::assertSame(['C', 'A', 'B'], array_column($reread, 'text'));
    }

    public function test_reorder_rejects_an_incomplete_id_set(): void
    {
        $auth = $this->authHeader();
        $listId = $this->decode(
            $this->request('POST', '/api/lists', ['title' => 'Reorder'], $auth),
        )['list']['id'];
        $first = $this->decode(
            $this->request('POST', "/api/lists/{$listId}/items", ['text' => 'one'], $auth),
        )['item']['id'];
        $this->request('POST', "/api/lists/{$listId}/items", ['text' => 'two'], $auth);

        $response = $this->request('PUT', "/api/lists/{$listId}/items/order", [
            'item_ids' => [$first],
        ], $auth);

        self::assertSame(422, $response->getStatusCode());
    }

    public function test_reorder_is_scoped_to_the_owner(): void
    {
        $owner = $this->authHeader('ro@example.com');
        $other = $this->authHeader('rx@example.com');
        $listId = $this->decode(
            $this->request('POST', '/api/lists', ['title' => 'Mine'], $owner),
        )['list']['id'];
        $itemId = $this->decode(
            $this->request('POST', "/api/lists/{$listId}/items", ['text' => 'x'], $owner),
        )['item']['id'];

        self::assertSame(404, $this->request('PUT', "/api/lists/{$listId}/items/order", [
            'item_ids' => [$itemId],
        ], $other)->getStatusCode());
    }

    public function test_deleting_a_list_cascades_to_its_items(): void
    {
        $auth = $this->authHeader();
        $listId = $this->decode(
            $this->request('POST', '/api/lists', ['title' => 'Temp'], $auth),
        )['list']['id'];
        $itemId = $this->decode(
            $this->request('POST', "/api/lists/{$listId}/items", ['text' => 'x'], $auth),
        )['item']['id'];

        $this->request('DELETE', "/api/lists/{$listId}", null, $auth);

        // The parent list is gone, so the item route 404s on the list check.
        self::assertSame(
            404,
            $this->request('GET', "/api/lists/{$listId}/items/{$itemId}", null, $auth)->getStatusCode(),
        );
    }

    public function test_items_under_another_users_list_are_not_reachable(): void
    {
        $owner = $this->authHeader('owner2@example.com');
        $other = $this->authHeader('other2@example.com');

        $listId = $this->decode(
            $this->request('POST', '/api/lists', ['title' => 'Mine'], $owner),
        )['list']['id'];

        self::assertSame(
            404,
            $this->request('POST', "/api/lists/{$listId}/items", ['text' => 'sneaky'], $other)->getStatusCode(),
        );
        self::assertSame(
            404,
            $this->request('GET', "/api/lists/{$listId}/items", null, $other)->getStatusCode(),
        );
    }
}