project-manager/tests/CardStatusTest.php

<?php

declare(strict_types=1);

namespace Tests;

use PDOException;

final class CardStatusTest extends ApiTestCase
{
    /** Create a project and return its id. */
    private function newProject(array $auth, string $title = 'Board'): int
    {
        return $this->decode(
            $this->request('POST', '/api/projects', ['title' => $title], $auth),
        )['project']['id'];
    }

    /** @param array<string, string> $auth @return array<int, mixed> */
    private function statuses(int $projectId, array $auth): array
    {
        return $this->decode(
            $this->request('GET', "/api/projects/{$projectId}/statuses", null, $auth),
        )['statuses'];
    }

    public function test_statuses_require_authentication(): void
    {
        $projectId = $this->newProject($this->authHeader());

        self::assertSame(401, $this->request('GET', "/api/projects/{$projectId}/statuses")->getStatusCode());
    }

    public function test_new_projects_are_seeded_with_the_default_statuses(): void
    {
        $auth = $this->authHeader();
        $projectId = $this->newProject($auth);

        $statuses = $this->statuses($projectId, $auth);

        self::assertSame(['To do', 'Doing', 'Done'], array_column($statuses, 'name'));
        self::assertSame([0, 1, 2], array_column($statuses, 'position'));
        self::assertSame([$projectId, $projectId, $projectId], array_column($statuses, 'project_id'));
    }

    public function test_each_project_gets_its_own_status_rows(): void
    {
        $auth = $this->authHeader();
        $first = $this->newProject($auth, 'One');
        $second = $this->newProject($auth, 'Two');

        $firstIds = array_column($this->statuses($first, $auth), 'id');
        $secondIds = array_column($this->statuses($second, $auth), 'id');

        self::assertSame([], array_intersect($firstIds, $secondIds));
    }

    public function test_statuses_are_only_visible_to_the_project_owner(): void
    {
        $owner = $this->authHeader('owner@example.com');
        $other = $this->authHeader('other@example.com');
        $projectId = $this->newProject($owner, 'Private');

        self::assertSame(200, $this->request('GET', "/api/projects/{$projectId}/statuses", null, $owner)->getStatusCode());
        self::assertSame(404, $this->request('GET', "/api/projects/{$projectId}/statuses", null, $other)->getStatusCode());
    }

    public function test_a_card_created_directly_in_a_project_starts_in_its_first_status(): void
    {
        $auth = $this->authHeader();
        $projectId = $this->newProject($auth);
        $firstStatus = $this->statuses($projectId, $auth)[0];

        $card = $this->decode(
            $this->request('POST', "/api/projects/{$projectId}/cards", ['text' => 'First'], $auth),
        )['card'];

        self::assertSame($firstStatus['id'], $card['status_id']);
        self::assertSame('To do', $card['status']['name']);
        self::assertSame($projectId, $card['project_id']);
    }

    public function test_a_referenced_status_cannot_be_deleted_at_the_database_level(): void
    {
        // The DELETE /statuses/{id} endpoint reassigns cards away before
        // deleting (see below); this is the lower-level guarantee it relies
        // on. A card with a project must have a status (the CHECK
        // constraint), so the FK is ON DELETE RESTRICT rather than SET NULL.
        $auth = $this->authHeader();
        $projectId = $this->newProject($auth);
        $statusId = $this->statuses($projectId, $auth)[0]['id'];
        $this->request('POST', "/api/projects/{$projectId}/cards", ['text' => 'x'], $auth);

        $this->expectException(PDOException::class);
        $this->db()->prepare('DELETE FROM card_statuses WHERE id = ?')->execute([$statusId]);
    }

    public function test_a_status_can_be_added(): void
    {
        $auth = $this->authHeader();
        $projectId = $this->newProject($auth);

        $response = $this->request('POST', "/api/projects/{$projectId}/statuses", ['name' => 'Blocked'], $auth);

        self::assertSame(201, $response->getStatusCode());
        $status = $this->decode($response)['status'];
        self::assertSame('Blocked', $status['name']);
        self::assertSame(3, $status['position']);
        self::assertSame(['To do', 'Doing', 'Done', 'Blocked'], array_column($this->statuses($projectId, $auth), 'name'));
    }

    public function test_adding_a_status_requires_a_name(): void
    {
        $auth = $this->authHeader();
        $projectId = $this->newProject($auth);

        $response = $this->request('POST', "/api/projects/{$projectId}/statuses", ['name' => ''], $auth);

        self::assertSame(422, $response->getStatusCode());
    }

    public function test_a_status_cannot_be_added_to_another_owners_project(): void
    {
        $owner = $this->authHeader('owner@example.com');
        $other = $this->authHeader('other@example.com');
        $projectId = $this->newProject($owner, 'Private');

        $response = $this->request('POST', "/api/projects/{$projectId}/statuses", ['name' => 'x'], $other);

        self::assertSame(404, $response->getStatusCode());
    }

    public function test_statuses_can_be_reordered(): void
    {
        $auth = $this->authHeader();
        $projectId = $this->newProject($auth);
        $ids = array_column($this->statuses($projectId, $auth), 'id');
        $reversed = array_reverse($ids);

        $response = $this->request(
            'PUT',
            "/api/projects/{$projectId}/statuses/order",
            ['status_ids' => $reversed],
            $auth,
        );

        self::assertSame(200, $response->getStatusCode());
        $statuses = $this->decode($response)['statuses'];
        self::assertSame($reversed, array_column($statuses, 'id'));
        self::assertSame([0, 1, 2], array_column($statuses, 'position'));
    }

    public function test_reordering_statuses_requires_every_status_exactly_once(): void
    {
        $auth = $this->authHeader();
        $projectId = $this->newProject($auth);
        $ids = array_column($this->statuses($projectId, $auth), 'id');

        $missing = $this->request(
            'PUT',
            "/api/projects/{$projectId}/statuses/order",
            ['status_ids' => array_slice($ids, 0, 2)],
            $auth,
        );
        self::assertSame(422, $missing->getStatusCode());

        $foreign = $this->request(
            'PUT',
            "/api/projects/{$projectId}/statuses/order",
            ['status_ids' => [...$ids, 999999]],
            $auth,
        );
        self::assertSame(422, $foreign->getStatusCode());
    }

    public function test_an_empty_status_can_be_deleted_directly(): void
    {
        $auth = $this->authHeader();
        $projectId = $this->newProject($auth);
        $statusId = $this->statuses($projectId, $auth)[0]['id'];

        $response = $this->request('DELETE', "/api/projects/{$projectId}/statuses/{$statusId}", null, $auth);

        self::assertSame(204, $response->getStatusCode());
        self::assertSame(['Doing', 'Done'], array_column($this->statuses($projectId, $auth), 'name'));
        self::assertSame([0, 1], array_column($this->statuses($projectId, $auth), 'position'));
    }

    public function test_deleting_a_status_with_cards_requires_reassignment(): void
    {
        $auth = $this->authHeader();
        $projectId = $this->newProject($auth);
        $statusId = $this->statuses($projectId, $auth)[0]['id'];
        $this->request('POST', "/api/projects/{$projectId}/cards", ['text' => 'x'], $auth);

        $response = $this->request('DELETE', "/api/projects/{$projectId}/statuses/{$statusId}", null, $auth);

        self::assertSame(409, $response->getStatusCode());
        self::assertSame(1, $this->decode($response)['error']['details']['card_count']);
        // Still there -- the delete was rejected, not partially applied.
        self::assertSame(['To do', 'Doing', 'Done'], array_column($this->statuses($projectId, $auth), 'name'));
    }

    public function test_deleting_a_status_reassigns_its_cards(): void
    {
        $auth = $this->authHeader();
        $projectId = $this->newProject($auth);
        [$toDo, $doing] = $this->statuses($projectId, $auth);
        $card = $this->decode(
            $this->request('POST', "/api/projects/{$projectId}/cards", ['text' => 'x'], $auth),
        )['card'];
        self::assertSame($toDo['id'], $card['status_id']);

        $response = $this->request(
            'DELETE',
            "/api/projects/{$projectId}/statuses/{$toDo['id']}",
            ['reassign_to' => $doing['id']],
            $auth,
        );

        self::assertSame(204, $response->getStatusCode());
        self::assertSame(['Doing', 'Done'], array_column($this->statuses($projectId, $auth), 'name'));

        $moved = $this->decode($this->request('GET', "/api/cards/{$card['id']}", null, $auth))['card'];
        self::assertSame($doing['id'], $moved['status_id']);
    }

    public function test_reassign_to_must_be_a_different_status_in_the_same_project(): void
    {
        $auth = $this->authHeader();
        $projectId = $this->newProject($auth);
        $other = $this->newProject($auth, 'Other');
        $toDo = $this->statuses($projectId, $auth)[0];
        $otherStatus = $this->statuses($other, $auth)[0];
        $this->request('POST', "/api/projects/{$projectId}/cards", ['text' => 'x'], $auth);

        $sameStatus = $this->request(
            'DELETE',
            "/api/projects/{$projectId}/statuses/{$toDo['id']}",
            ['reassign_to' => $toDo['id']],
            $auth,
        );
        self::assertSame(422, $sameStatus->getStatusCode());

        $foreignStatus = $this->request(
            'DELETE',
            "/api/projects/{$projectId}/statuses/{$toDo['id']}",
            ['reassign_to' => $otherStatus['id']],
            $auth,
        );
        self::assertSame(422, $foreignStatus->getStatusCode());
    }

    public function test_the_last_status_in_a_project_cannot_be_deleted(): void
    {
        $auth = $this->authHeader();
        $projectId = $this->newProject($auth);
        $ids = array_column($this->statuses($projectId, $auth), 'id');

        $this->request('DELETE', "/api/projects/{$projectId}/statuses/{$ids[0]}", null, $auth);
        $this->request('DELETE', "/api/projects/{$projectId}/statuses/{$ids[1]}", null, $auth);
        $response = $this->request('DELETE', "/api/projects/{$projectId}/statuses/{$ids[2]}", null, $auth);

        self::assertSame(409, $response->getStatusCode());
        self::assertSame(1, count($this->statuses($projectId, $auth)));
    }

    public function test_a_status_cannot_be_deleted_from_another_owners_project(): void
    {
        $owner = $this->authHeader('owner@example.com');
        $other = $this->authHeader('other@example.com');
        $projectId = $this->newProject($owner, 'Private');
        $statusId = $this->statuses($projectId, $owner)[0]['id'];

        $response = $this->request('DELETE', "/api/projects/{$projectId}/statuses/{$statusId}", null, $other);

        self::assertSame(404, $response->getStatusCode());
    }

    public function test_deleting_a_project_cascades_to_its_statuses(): void
    {
        $auth = $this->authHeader();
        $projectId = $this->newProject($auth, 'Temp');

        $count = fn (): int => (int) $this->db()
            ->query("SELECT COUNT(*) FROM card_statuses WHERE project_id = {$projectId}")
            ->fetchColumn();

        self::assertSame(3, $count());

        $this->request('DELETE', "/api/projects/{$projectId}", null, $auth);

        self::assertSame(0, $count());
    }
}