Add stage 3: todo list and item CRUD API

Two migrations add todo_lists (owner_id FK to users, title, description) and todo_items (list_id FK, text, complete, position), both with ON DELETE CASCADE. New endpoints under /api/lists, all behind AuthMiddleware: - lists: index / store / show / update (PATCH) / destroy - items: nested under a list, same five verbs Lists are owner-scoped — another user's or a missing list responds 404, never 403. New items append after the highest position unless one is given; the list carries item_count / completed_count. Item PATCH is partial and never renumbers siblings. Adds App\Support\Validator for request-body checks, TodoList/TodoItem repositories, and body()/user() helpers on the Controller base. Feature tests move their shared harness into tests/ApiTestCase; TodoTest covers CRUD, ownership isolation, ordering, completion counts, validation and cascade delete. Full suite: 15 passing. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-03 18:30:52 +01:00
parent 5e3b8dbd7e
commit 5a0d29a308
12 changed files with 1093 additions and 4 deletions
@@ -0,0 +1,130 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Repository;
+
+use PDO;
+
+/**
+ * Data access for the `todo_lists` table.
+ *
+ * @phpstan-type TodoListRow array{
+ *     id: int, owner_id: int, title: string, description: string,
+ *     item_count: int, completed_count: int, created_at: string, updated_at: string
+ * }
+ */
+final class TodoListRepository
+{
+    private const SELECT = <<<'SQL'
+        SELECT l.id, l.owner_id, l.title, l.description, l.created_at, l.updated_at,
+               (SELECT COUNT(*) FROM todo_items i WHERE i.list_id = l.id) AS item_count,
+               (SELECT COUNT(*) FROM todo_items i WHERE i.list_id = l.id AND i.complete = 1) AS completed_count
+        FROM todo_lists l
+        SQL;
+
+    public function __construct(private readonly PDO $pdo)
+    {
+    }
+
+    /**
+     * @return TodoListRow[]
+     */
+    public function allForOwner(int $ownerId): array
+    {
+        $stmt = $this->pdo->prepare(self::SELECT . ' WHERE l.owner_id = :owner ORDER BY l.created_at DESC, l.id DESC');
+        $stmt->execute(['owner' => $ownerId]);
+
+        return array_map($this->cast(...), $stmt->fetchAll());
+    }
+
+    /**
+     * @return TodoListRow|null
+     */
+    public function findOwnedBy(int $id, int $ownerId): ?array
+    {
+        $stmt = $this->pdo->prepare(self::SELECT . ' WHERE l.id = :id AND l.owner_id = :owner');
+        $stmt->execute(['id' => $id, 'owner' => $ownerId]);
+
+        $row = $stmt->fetch();
+
+        return $row === false ? null : $this->cast($row);
+    }
+
+    /**
+     * @return TodoListRow
+     */
+    public function create(int $ownerId, string $title, string $description): array
+    {
+        $stmt = $this->pdo->prepare(
+            'INSERT INTO todo_lists (owner_id, title, description) VALUES (:owner, :title, :description)'
+        );
+        $stmt->execute([
+            'owner' => $ownerId,
+            'title' => $title,
+            'description' => $description,
+        ]);
+
+        /** @var TodoListRow $list */
+        $list = $this->findOwnedBy((int) $this->pdo->lastInsertId(), $ownerId);
+
+        return $list;
+    }
+
+    /**
+     * @param array{title?: string, description?: string} $fields
+     * @return TodoListRow
+     */
+    public function update(int $id, int $ownerId, array $fields): array
+    {
+        $sets = ['updated_at = ' . $this->nowExpr()];
+        $params = ['id' => $id];
+
+        foreach (['title', 'description'] as $column) {
+            if (array_key_exists($column, $fields)) {
+                $sets[] = "{$column} = :{$column}";
+                $params[$column] = $fields[$column];
+            }
+        }
+
+        $stmt = $this->pdo->prepare('UPDATE todo_lists SET ' . implode(', ', $sets) . ' WHERE id = :id');
+        $stmt->execute($params);
+
+        /** @var TodoListRow $list */
+        $list = $this->findOwnedBy($id, $ownerId);
+
+        return $list;
+    }
+
+    public function delete(int $id): void
+    {
+        $this->pdo->prepare('DELETE FROM todo_lists WHERE id = :id')->execute(['id' => $id]);
+    }
+
+    /** Bump updated_at, e.g. when the list's items change. */
+    public function touch(int $id): void
+    {
+        $this->pdo->prepare('UPDATE todo_lists SET updated_at = ' . $this->nowExpr() . ' WHERE id = :id')
+            ->execute(['id' => $id]);
+    }
+
+    private function nowExpr(): string
+    {
+        return "strftime('%Y-%m-%dT%H:%M:%SZ', 'now')";
+    }
+
+    /**
+     * @param array<string, mixed> $row
+     * @return TodoListRow
+     */
+    private function cast(array $row): array
+    {
+        $row['id'] = (int) $row['id'];
+        $row['owner_id'] = (int) $row['owner_id'];
+        $row['item_count'] = (int) $row['item_count'];
+        $row['completed_count'] = (int) $row['completed_count'];
+
+        /** @var TodoListRow $row */
+        return $row;
+    }
+}