project-manager/tests/CardStatusTest.php

<?php

declare(strict_types=1);

namespace Tests;

final class CardStatusTest extends ApiTestCase
{
    /** Create a project and return its id. */
    private function newProject(array $auth, string $title = 'Board'): int
    {
        return $this->decode(
            $this->request('POST', '/api/projects', ['title' => $title], $auth),
        )['project']['id'];
    }

    /** @param array<string, string> $auth @return array<int, mixed> */
    private function statuses(int $projectId, array $auth): array
    {
        return $this->decode(
            $this->request('GET', "/api/projects/{$projectId}/statuses", null, $auth),
        )['statuses'];
    }

    public function test_statuses_require_authentication(): void
    {
        $projectId = $this->newProject($this->authHeader());

        self::assertSame(401, $this->request('GET', "/api/projects/{$projectId}/statuses")->getStatusCode());
    }

    public function test_new_projects_are_seeded_with_the_default_statuses(): void
    {
        $auth = $this->authHeader();
        $projectId = $this->newProject($auth);

        $statuses = $this->statuses($projectId, $auth);

        self::assertSame(['To do', 'Doing', 'Done'], array_column($statuses, 'name'));
        self::assertSame([0, 1, 2], array_column($statuses, 'position'));
        self::assertSame([$projectId, $projectId, $projectId], array_column($statuses, 'project_id'));
    }

    public function test_each_project_gets_its_own_status_rows(): void
    {
        $auth = $this->authHeader();
        $first = $this->newProject($auth, 'One');
        $second = $this->newProject($auth, 'Two');

        $firstIds = array_column($this->statuses($first, $auth), 'id');
        $secondIds = array_column($this->statuses($second, $auth), 'id');

        self::assertSame([], array_intersect($firstIds, $secondIds));
    }

    public function test_statuses_are_only_visible_to_the_project_owner(): void
    {
        $owner = $this->authHeader('owner@example.com');
        $other = $this->authHeader('other@example.com');
        $projectId = $this->newProject($owner, 'Private');

        self::assertSame(200, $this->request('GET', "/api/projects/{$projectId}/statuses", null, $owner)->getStatusCode());
        self::assertSame(404, $this->request('GET', "/api/projects/{$projectId}/statuses", null, $other)->getStatusCode());
    }

    public function test_a_new_card_has_no_status(): void
    {
        $auth = $this->authHeader();
        $projectId = $this->newProject($auth);

        $card = $this->decode(
            $this->request('POST', "/api/projects/{$projectId}/cards", ['text' => 'First'], $auth),
        )['card'];

        // New cards sit in the "inbox" — no status until the user assigns one.
        self::assertArrayHasKey('status_id', $card);
        self::assertNull($card['status_id']);
        self::assertNull($card['status']);
    }

    public function test_a_card_can_be_moved_between_statuses_and_back_to_the_inbox(): void
    {
        $auth = $this->authHeader();
        $projectId = $this->newProject($auth);
        $statuses = $this->statuses($projectId, $auth);
        $cardId = $this->decode(
            $this->request('POST', "/api/projects/{$projectId}/cards", ['text' => 'Move me'], $auth),
        )['card']['id'];

        $doing = $this->decode(
            $this->request('PATCH', "/api/projects/{$projectId}/cards/{$cardId}", ['status_id' => $statuses[1]['id']], $auth),
        )['card'];
        self::assertSame($statuses[1]['id'], $doing['status_id']);
        self::assertSame('Doing', $doing['status']['name']);

        $backToInbox = $this->decode(
            $this->request('PATCH', "/api/projects/{$projectId}/cards/{$cardId}", ['status_id' => null], $auth),
        )['card'];
        self::assertNull($backToInbox['status_id']);
        self::assertNull($backToInbox['status']);
    }

    public function test_a_card_rejects_a_status_from_another_project(): void
    {
        $auth = $this->authHeader();
        $mine = $this->newProject($auth, 'Mine');
        $other = $this->newProject($auth, 'Other');
        $foreignStatusId = $this->statuses($other, $auth)[0]['id'];
        $cardId = $this->decode(
            $this->request('POST', "/api/projects/{$mine}/cards", ['text' => 'x'], $auth),
        )['card']['id'];

        $response = $this->request('PATCH', "/api/projects/{$mine}/cards/{$cardId}", ['status_id' => $foreignStatusId], $auth);

        self::assertSame(422, $response->getStatusCode());
        self::assertArrayHasKey('status_id', $this->decode($response)['error']['details']);
    }

    public function test_a_card_rejects_an_unknown_status(): void
    {
        $auth = $this->authHeader();
        $projectId = $this->newProject($auth);
        $cardId = $this->decode(
            $this->request('POST', "/api/projects/{$projectId}/cards", ['text' => 'x'], $auth),
        )['card']['id'];

        $response = $this->request('PATCH', "/api/projects/{$projectId}/cards/{$cardId}", ['status_id' => 999999], $auth);

        self::assertSame(422, $response->getStatusCode());
    }

    public function test_deleting_a_status_clears_it_from_its_cards(): void
    {
        $auth = $this->authHeader();
        $projectId = $this->newProject($auth);
        $cardId = $this->decode(
            $this->request('POST', "/api/projects/{$projectId}/cards", ['text' => 'Orphan me'], $auth),
        )['card']['id'];
        $statusId = $this->statuses($projectId, $auth)[0]['id'];

        $this->request('PATCH', "/api/projects/{$projectId}/cards/{$cardId}", ['status_id' => $statusId], $auth);

        // No delete endpoint for statuses yet — remove the row directly to
        // exercise ON DELETE SET NULL.
        $this->db()->exec('PRAGMA foreign_keys = ON');
        $this->db()->prepare('DELETE FROM card_statuses WHERE id = ?')->execute([$statusId]);

        $reread = $this->decode(
            $this->request('GET', "/api/projects/{$projectId}/cards/{$cardId}", null, $auth),
        )['card'];
        self::assertNull($reread['status_id']);
        self::assertNull($reread['status']);
    }

    public function test_deleting_a_project_cascades_to_its_statuses(): void
    {
        $auth = $this->authHeader();
        $projectId = $this->newProject($auth, 'Temp');

        $count = fn (): int => (int) $this->db()
            ->query("SELECT COUNT(*) FROM card_statuses WHERE project_id = {$projectId}")
            ->fetchColumn();

        self::assertSame(3, $count());

        $this->request('DELETE', "/api/projects/{$projectId}", null, $auth);

        self::assertSame(0, $count());
    }
}